[anneoneone]

• Let Host and Admin users verify a recovery email and reset a forgotten password.
• Add recovery settings, public reset pages and an admin clear action.
• Revoke old reset links on password changes and sign out sessions after an email reset.
• Keep mail disabled until the Resend sender and Bitwarden configuration are ready.

Closes: #711

Implementation and checks

• Store verified addresses separately, with normalized unique emails. Keep a replacement pending until verified.
• Use hashed, single-use tokens with a 30-minute expiry and atomic SQLite transactions.
• Allow unexpired Host and Admin accounts. Keep Guest and Superadmin recovery with administrators.
• Limit requests by IP and email. Use a configured HTTPS URL for emailed links.
• Send mail after commit with bounded concurrency and timeouts. Report delivery failures through logs and the existing Telegram admin channel. No durable queue.
• Preserve active broadcasts when reset deletes sessions. New connections require login.
• Setup and delivery limits: docs/password-recovery.md. The production workflow still needs the actual Bitwarden secret mapping before activation.

Validation:

• Backend: 110 tests passed; 2 existing live-storage tests ignored.
• Final focused recovery run: 17 passed, including real HTTP enrollment, emailed link verification, reset and username login.
• Frontend: 174 tests passed; typecheck, lint and production build passed. Focused tests also passed after the final route-state change.
• Cargo clippy passed with existing warnings outside the recovery code.
• Independent code review found no blockers.

Live delivery and production deployment were not performed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
live-moafunk-de	Ready	Preview	Oct 10, 2026 11:00pm UTC

[anneoneone]

Review

Verdict: good to merge once marked ready. No blocking bugs. One setting must be added before mail is turned on.

Before enabling mail

Set RECOVERY_TRUST_PROXY=true in prod. Prod runs the backend behind nginx, so every request comes from the same address. With the default false, all users share one IP limit: 20 public requests per 15 minutes, for request, verify and complete together. One person spamming the form blocks recovery for everyone.

The docs explain the setting, but the activation steps do not list it. Add it to step 3 of docs/password-recovery.md, together with the three mail settings, when the Bitwarden mapping goes into backend.yml.

This does not block the merge: mail is off by default, so the public endpoints return 503 until setup.

Note

Backend tests do not run on PRs. backend.yml only runs on push to main, so only the frontend workflow ran here. Ran cargo test locally on a8d3edf: 110 passed, 2 ignored. This matches the PR body. The CI gap is older than this PR; a follow-up could run cargo test on PRs.

Checked and fine

• Tokens: random, stored as SHA-256, epoch expiry, one live token per kind. All writes use BEGIN IMMEDIATE; a busy database returns 503.
• Complete reset: checks the link before Argon2, checks again in the transaction, then deletes sessions, clears the forced-change flag and drops all tokens in one commit. The double-submit test passes.
• Password writers: change-password, initial password and admin reset all use update_password, so they kill open reset links.
• Eligibility: explicit Host/Admin allow-list plus an expiry check.
• Reset request: same answer for unknown, invalid and ineligible addresses. The email limit counts unknown addresses too. Mail is sent after the commit.
• Mail: no tokens in logs, fixed provider URL, no redirects. The link matches the hash router.
• Frontend: recovery pages are public and skip the forced-change redirect. Opening a link only shows a confirm page. The invalid-link page offers a new link.
• Admin clear: follows the same role rules as admin password reset.

Code references

Checked at a8d3edf.

• Shared IP key: public_limit in backend/src/handlers/recovery.rs (lines 122-127) uses one ip: key with limit 20 for verify, request and complete. RecoveryControls::ip (lines 86-98) uses the peer address unless RECOVERY_TRUST_PROXY=true.
• Backend bound to localhost behind nginx: backend/docker-compose.prod.yml:7. nginx sets X-Real-IP: backend/scripts/deploy_hetzner.sh:467.
• Backend workflow triggers: .github/workflows/backend.yml lines 3-10 (push to main and manual runs only).
• Token and transaction logic: backend/src/recovery.rs (begin, issue_token, find_token, complete_reset, update_password).
• Host expiry is a date (frontend/src/admin/pages/UsersPage.vue:320). unixepoch() makes it end at the start of that day, the same as the login check.

[anneoneone]

Approved at c0439d1.

• The proxy-trust step is now in the activation docs (RECOVERY_TRUST_PROXY=true in production behind nginx).
• No code change since the reviewed commit. Backend tests (cargo test, run locally): 110 passed, 2 ignored. Frontend CI is green.
• Before enabling mail: add the Bitwarden mapping and the four settings in backend.yml, as described in docs/password-recovery.md.

GitHub does not allow an approving review from the PR author, so this approval is a comment.

[anneoneone]

Review: APPROVED by Claude at c0439d1

[anneoneone]

This PR is merged but not deployed.

• On main, the old backend workflow still deploys on every matching push. The build-only change (ci(backend): remove API deployment from image builds #718) is only on dev/312-interim.
• This merge started https://github.com/phaabe/live.moafunk.de/actions/runs/38094047625. I cancelled it during the build, at Anton's request. The deploy job ran no step, and no image was pushed. Production still runs 7093fe5.
• Do not rerun that run. A rerun would replace the API with no maintenance window.
• feat(auth): reset passwords through an emailed link #711 was closed automatically by this merge, but the feature is not live yet. Deploy it later through the approved maintenance procedure. Context: [O1.2] Remove the unsafe deployment trigger and bootstrap the gate #381 (comment)