xarmian 616a6d2a0a feat(auth): localhost password recovery for locked-out self-host admins (#760) ...

Add a loopback-only account-recovery path so a self-hosted operator who
forgot their password (with no email provider configured) can recover
without editing the database by hand.

- POST /api/v1/auth/local-reset: loopback-gated, non-cloud, no auth
  required (same trust model as bootstrap). Returns a single-use reset
  link, or a temporary password with {"temp_password": true}.
- pad auth reset-password <email> [--temp-password]: talks to the local
  server over loopback directly (not the configured public URL), so the
  command works on the server host regardless of CLI config. Prints the
  server's shareable reset_url when a public base URL is known.
- Web /forgot-password reads email_configured from the session and shows
  host-recovery instructions instead of a dead "we emailed you a link"
  when no provider is configured.
- forgot-password server log emits the reset path on non-cloud instances
  so operators can also recover straight from the logs.
- Docs: CLAUDE.md + docs/deployment.md recovery sections.

Tests cover the loopback/cloud gates, the shareable reset_url, and both
output modes (reset link + temp password).

2026-06-22 20:58:50 -04:00

..

screenshots

test(screenshots): capture in dark mode (Pad's default theme) (#319)

2026-04-30 13:10:51 -04:00

architecture.md

feat(cli): add Cloud mode to pad init, drop Docker option (TASK-837, TASK-838) (#272)

2026-04-28 09:41:50 -04:00

backup.md

fix(docs): replace 'pad serve' with 'pad server start' (TASK-675) (#199)

2026-04-22 14:50:24 -04:00

brand.md

docs(brand): add brand spec defining cohesion contract (TASK-904) (#312)

2026-04-29 22:49:25 -04:00

deployment.md

feat(auth): localhost password recovery for locked-out self-host admins (#760)

2026-06-22 20:58:50 -04:00