amaurycoudr/chess-project
2
0
Fork 0
Code Issues 17 Pull requests 2 Projects Releases Packages 1 Activity Actions 1

Password reset by email: a single-use link, caught by Mailpit, sent by Resend in production #380

New issue
Closed
opened 2026-10-11 16:26:56 +00:00 by root · 8 comments
root commented 2026-10-11 16:26:56 +00:00 (Migrated from gitlab.core-project.space)
Copy link

Imported from GitHub amaurycoudr/chess-project#380, opened by @amaurycoudr on 2026-10-11 16:26 UTC.

Parent

#364

What to build

A Player who forgot their password asks for a reset link at /forgot-password and always gets the same answer. If the email has an Account, a message goes out with a link to /reset-password that holds 256 random bits in the URL fragment. The link is valid one hour and works once. The page reads the token, removes it from the address bar and posts it with the new password. A successful reset deletes every Session and every reset token of the Account, then signs this browser in. An expired, used or unknown link is told so and offered a new one.

Mail goes through a mail module with one port. Production sends through Resend over SMTP. Mailpit catches mail in dev (beside the shared dev Postgres), in CI (a service container) and in each preview (a preview-only container behind basic auth, under a path prefix on the preview's host). Tests inject an in-memory outbox. An hourly sweep on the injected clock removes expired Sessions and reset tokens.

The owner runs the Resend and DNS checklist with the wizard skill before this merges, because the API now refuses to start without its mail settings.

Seam: loadConfig; the RPC wire (with the in-memory outbox and the fake clock); the front views; e2e

Acceptance criteria

  • auth.requestPasswordReset and auth.resetPassword exist, the latter with RESET_LINK_INVALID for unknown, used and expired alike
  • On the wire, the outbox holds a working link; the link is single-use and expires after one hour; a link older than a completed reset fails; success deletes every Session and sets this browser's cookies; an unknown email sends nothing and gets the same answer
  • Only the SHA-256 hash of a reset token is stored
  • The sweep removes expired Sessions and reset tokens, tested on the fake clock
  • loadConfig requires the SMTP URL, the sender address and the public URL, tested beside the existing config tests
  • The forgot-password view and the reset-password view (including the expired, used or unknown state and its offer of a new link) are tested beside their views; new strings are in English and French
  • The reset email is English, plain text plus minimal HTML, with the link only
  • Mailpit runs in dev (written by env:sync), in CI's e2e job and in each preview, never in production; the preview e2e job passes its URL and credentials to the suite
  • A new e2e spec holds its first test: a Player asks for a reset link, reads it from Mailpit over its HTTP API, sets a new password and is signed in, and signing in with the old password then fails
  • The Resend checklist is run: the subdomain verified, SPF, DKIM and a _dmarc record at p=none added, the SMTP URL stored as a production secret, and one real reset received by the owner with SPF, DKIM and DMARC passing
  • The API's new mail/ folder is declared in the API's layer order and framework-import rules (the owner ruled on the accounts breakdown that declaring a folder the spec creates counts as the requested lint change; nothing else in lint config changes)
> _Imported from GitHub [amaurycoudr/chess-project#380](https://github.com/amaurycoudr/chess-project/issues/380), opened by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 16:26 UTC._ <!-- github-issue:380 --> --- ## Parent #364 ## What to build A **Player** who forgot their password asks for a reset link at `/forgot-password` and always gets the same answer. If the email has an **Account**, a message goes out with a link to `/reset-password` that holds 256 random bits in the URL fragment. The link is valid one hour and works once. The page reads the token, removes it from the address bar and posts it with the new password. A successful reset deletes every **Session** and every reset token of the **Account**, then signs this browser in. An expired, used or unknown link is told so and offered a new one. Mail goes through a mail module with one port. Production sends through Resend over SMTP. Mailpit catches mail in dev (beside the shared dev Postgres), in CI (a service container) and in each preview (a preview-only container behind basic auth, under a path prefix on the preview's host). Tests inject an in-memory outbox. An hourly sweep on the injected clock removes expired **Sessions** and reset tokens. The owner runs the Resend and DNS checklist with the `wizard` skill before this merges, because the API now refuses to start without its mail settings. Seam: `loadConfig`; the RPC wire (with the in-memory outbox and the fake clock); the front views; e2e ## Acceptance criteria - [ ] `auth.requestPasswordReset` and `auth.resetPassword` exist, the latter with `RESET_LINK_INVALID` for unknown, used and expired alike - [ ] On the wire, the outbox holds a working link; the link is single-use and expires after one hour; a link older than a completed reset fails; success deletes every **Session** and sets this browser's cookies; an unknown email sends nothing and gets the same answer - [ ] Only the SHA-256 hash of a reset token is stored - [ ] The sweep removes expired **Sessions** and reset tokens, tested on the fake clock - [ ] `loadConfig` requires the SMTP URL, the sender address and the public URL, tested beside the existing config tests - [ ] The forgot-password view and the reset-password view (including the expired, used or unknown state and its offer of a new link) are tested beside their views; new strings are in English and French - [ ] The reset email is English, plain text plus minimal HTML, with the link only - [ ] Mailpit runs in dev (written by `env:sync`), in CI's e2e job and in each preview, never in production; the preview e2e job passes its URL and credentials to the suite - [ ] A new e2e spec holds its first test: a **Player** asks for a reset link, reads it from Mailpit over its HTTP API, sets a new password and is signed in, and signing in with the old password then fails - [ ] The Resend checklist is run: the subdomain verified, SPF, DKIM and a `_dmarc` record at `p=none` added, the SMTP URL stored as a production secret, and one real reset received by the owner with SPF, DKIM and DMARC passing - [ ] The API's new `mail/` folder is declared in the API's layer order and framework-import rules (the owner ruled on the accounts breakdown that declaring a folder the spec creates counts as the requested lint change; nothing else in lint config changes)
root commented 2026-10-11 16:26:56 +00:00 (Migrated from gitlab.core-project.space)
Copy link

GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links).

  • Parent (sub-issue of): #364
  • Blocked by: #379
  • Blocking: #381
> _GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links)._ <!-- github-relations --> - Parent (sub-issue of): #364 - Blocked by: #379 - Blocking: #381
root commented 2026-10-13 08:39:48 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #381

mentioned in issue #381
root commented 2026-10-13 08:41:22 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #364

mentioned in issue #364
root commented 2026-10-13 08:41:27 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #379

mentioned in issue #379
root commented 2026-10-13 08:42:29 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #364

marked this issue as related to #364
root commented 2026-10-13 08:42:38 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #379

marked this issue as related to #379
root commented 2026-10-13 08:42:39 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #381

marked this issue as related to #381
root commented 2026-10-14 10:36:16 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in merge request !523

mentioned in merge request !523
root (Migrated from gitlab.core-project.space) closed this issue 2026-10-14 13:28:24 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
claude/forgejo-ci-refactor-637a4b
claude/implement-spec-576-809869
fix/front-browser-pages
docs/contributing-forgejo-ci
fix/storybook-ghsa-f2ph-cmg5-wxc8
prototype/dead-end-page
prototype/puzzles-ui-redesign
prototype/399-front-screens
ci/front-test-one-job
feat/370-drizzle-gateway
pr-screenshots
feat/369-postgres-per-stack
claude/pawn-promotion-capture-score-46fffb
claude/github-workflow-improvements-30cf86
docs/352-adr-claim-guest
docs/351-adr-seat-identity
claude/retro-last-10-conversations-9af723
docs/accounts-adrs
claude/lighthouse-pt-4b5a78
docs/350-adr-sessions
feat/game-status-326
research/postgres-on-vps
research/email-provider
prototype/offer-overlay
ci/339-pr-screenshots
prototype/game-status
ci/317-faster-pipeline
spec/303-vps-hosting
claude/paste-invite-link-room-code
docs/309-adr-vps-hosting
fix/311-client-route-fallback
claude/back-navigation-feature-2166ea
claude/resource-contract
claude/api-nest-orpc
claude/adr-nest-orpc
claude/e2e-tests-new-features-1ce2a1
claude/la-spec-273-fd55ac
claude/matt-pocock-skills-integration-444ba9
chore/adopt-the-cognitive-load-coding-rules-270
feat/choose-the-promotion-piece-in-a-popover-instead-of-auto-queening-267
feat/animate-piece-moves-on-the-board-264
feat/show-drag-state-on-the-board-263
feat/move-a-piece-by-dragging-and-dropping-it-261
feat/blocking-modal-when-the-room-has-closed-246
feat/truthful-opponent-presence-lost-connection-left-new-opponent-248
feat/horizontal-game-and-room-action-bars-with-a-confirmed-leave-247
feat/room-status-block-with-a-fixed-height-and-seat-relative-wording-245
docs/amend-adr-0016-a-vacated-seat-replaces-the-60-second-left-timer-244
feat/lint-against-hard-coded-copy-in-the-front-front-no-literal-copy-252
feat/translate-the-front-with-a-language-provider-english-french-242
docs/adr-front-i18n-paraglide
docs/stacked-prs
fix/render-build-fails-on-corepack-enable-record-the-hosting-adr-240
front/8-lint-error
front/7-local-home-align
front/6-comment-purge
front/5-cache-policy
front/3-dissolve-room-actions
front/4-tests-through-view
front/2-room-restructure
front/1-test-harness
feat/deploy-to-render-free-tier-with-a-preview-per-pr-233
harness/6-coding-standards
harness/5-adrs
harness/4-mechanical-rules
harness/3-drop-sandcastle
harness/2-skill-forks
harness/1-adr-index
claude/e2e-test-sub-agents-f8d06b
claude/e2e-hook-performance-072aa8
e2e-restart
e2e-spectator
e2e-draw-offer
e2e-resign-and-reload
e2e-mate-two-browsers
orchestrate-issue-168-implementation
implement-issue-169-and-pr
orpc-ws-room-feature
home-page-issues
comment-audit-and-rules
local/4-local-rail
local/3-local-board
local/2-design-prep
local/1-engine-accessors
prototype/home-page
prototype/game-screen-layout
worktree-front
chore/worktree-env-and-ports
feat/slice-1-3a-front-store-ws-effect-connection-status-screen-136
fix/143-release-seat-on-disconnect
claude/sandcastle-runner-contract
feat/slice-1-2a-apps-api-skeleton-hono-ws-echo-origin-allowlist-132
feat/slice-1-1-chess-contracts-package-context-md-cleanup-128
refactor/reorganise-src-into-layered-folders-per-adr-0008-123
refactor/refactor-engine-reorganise-src-into-layered-folders-per-adr-0008-123
refactor/introduce-the-piecereader-read-port-118
refactor/move-isattacked-to-attacks-ts-with-board-only-signature-111
feat/slice-b1-zobrist-key-computation-for-positions-99
refactor/slice-a-re-back-squareset-with-split-32-representation-97
sandcastle/sequential-reviewer/1779180017269
feat/san-formatter-core-encoding-moves-captures-en-passant-promotion-castling-92
sandcastle/sequential-reviewer/1779111400188
refactor/engine-pr-10-1-migrate-stalemate-into-a-draw-status-variant-86
sandcastle/sequential-reviewer/1779099667568
feat/engine-pr-9-1-castling-rights-tracking-updatecastlingrights-applymove-wiring-80
refactor/extract-piece-attacks-registry-and-rewire-isattacked-movegen-77
sandcastle/sequential-reviewer/1779027444485
backup/pre-axis-a-rewrite
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
spec
Parent spec written by to-spec

  
wayfinder:grilling

   
wayfinder:map

   
wayfinder:prototype

   
wayfinder:research

   
wayfinder:task

   
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
spec
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wayfinder:task
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#381 Rate limits on sign-up, sign-in and reset requests, with when to try again
amaurycoudr/chess-project
Depends on
#379 Sign-up and sign-in pages: the navigation names the Account, a refresh keeps it signed in
amaurycoudr/chess-project
Reference
amaurycoudr/chess-project#380
No description provided.