Set your password by email code #822

Parent

#776

What to build

One "set your password" flow, by email code, creates an account or resets a password.

1. You enter an email.
2. The page answers the same way whatever the address.
3. An allowed address is sent a 6-digit code from email.from, through Resend, using the key from the environment or the Credentials. The code is valid for 15 minutes, with 5 tries, and stored only as a hash. Codes go out at most once a minute and 10 times a day per address.
4. You enter the code and a new password. That sets the password, marks the address verified, and signs you in.

With no Resend key, the flow is off, and the page says to ask the machine's owner to run thirdshift console password. Each code sent and password set goes in the Console log.

Acceptance criteria

• Allowed and unknown addresses get identical answers. Only allowed ones get an email, at the Resend stand-in.
• Expiry, the 5 tries and both send limits are enforced.
• A correct code and a new password set the password, verify the address, sign in, and end other sessions.
• With no Resend key, the flow is off and the page explains how to get a password.
• Console log lines are written for codes sent and passwords set.
• Tested over HTTP with the Resend stand-in (THIRDSHIFT_RESEND_URL).