mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-11 21:39:01 +00:00
xarmian
a6befde8bf
* feat: email-based password reset flow (IDEA-81) Add full password reset flow: forgot password request, time-limited reset tokens (1hr, single-use, SHA-256 hashed), new password form, and automatic session creation after reset. * fix: use all: prefix in go:embed to include _-prefixed files Go's embed package excludes files starting with _ or . when recursing directories. SvelteKit/Vite occasionally generates chunk filenames with _ prefixes (e.g. _VLZtjCJ.js), causing them to be silently dropped from the embedded filesystem and served as HTML by the SPA fallback. The all: prefix includes everything regardless of filename prefix. Fixed in both embed.go and the Makefile which regenerates it. * fix: address PR review — atomic token consumption, error handling, log reset URL - Replace ValidatePasswordReset + MarkPasswordResetUsed with atomic ConsumePasswordReset using UPDATE ... WHERE ... RETURNING to prevent race conditions where two concurrent requests consume the same token - Handle DeleteUserSessions errors (log instead of silently ignoring) - Log the full reset URL when email is not configured so the admin CLI fallback is actually usable