[Auth] As a registered user, I want to reset my password so that I can regain access to my account
Users who forget their password currently have to contact support. A self-service reset via an emailed, time-limited link lets them get back in on their own.
Acceptance Criteria
- A "Forgot password?" link on the login page opens a form that asks for the account email
- Submitting the form always shows the same confirmation message, whether or not the email exists
- If the account exists, an email with a single-use reset link is sent within one minute
- The link expires 60 minutes after it was sent; an expired link shows a clear message and a way to request a new one
- After setting a new password the user is logged in and the link can no longer be used
Technical Details
- Store only a hash of the reset token, together with its expiry
- Rate-limit reset requests per email and per IP address
- Invalidate existing sessions after a successful reset