Flowchart · from auth/password-reset.ts

Password reset, as the code runs it

The two functions behind “Forgot password?”: one emails a link, the other checks it and sets the new password. Every early return is an error reply.

Password reset, as the code runs it Flowchart of a password reset: requestReset validates the email, rate-limits, checks the account, creates a hashed expiring token and emails a link; confirmReset checks the token and its expiry, then saves the new password. 1 · ASK FOR A RESET LINK 2 · USE THE LINK NO YES NO YES NO YES NO YES YES NO EMAIL LINK requestReset(email) Email addresswell-formed? 400 bad_email Under 5 requeststhis hour? 429 rate_limited Account existsfor this email? Create reset token store only its SHA-256 expires in 30 minutes Send reset email link carries raw token 202 check inbox confirmReset(token) Token hashmatches a row? 400 bad_link Token expired?(expires_at < now) 410 link_expired Save new password delete the token sign out other sessions 200 password set Same reply either way,so the form never showswho has an account. Only the hash is stored. A copy of thedatabase can’t be used to resetanyone’s password. LEGEND start / reply error reply step decision the decision that matters most paths join the person acts between the two calls