Same internal mail service the TikTok dashboard uses for its
verification codes: bearer-token multipart POST (stdlib urllib, no new
deps). Configured with AR_MAIL_API_URL/TOKEN; credentials live only in
the gitignored env files. Live send verified ({status:sent}).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New flow (active once AR_SMTP_* is configured; hidden otherwise):
- POST /api/auth/request-code emails a code to the account address
(usernames are emails). HMAC-stored, 10-min expiry, single-use,
5-attempt lockout, 60s resend throttle, no user enumeration.
- POST /api/auth/reset-password sets the new password with the code —
works signed-in (Settings) and from the login screen (Forgot
password?), so users can self-recover without the admin.
- Mailer: stdlib smtplib (STARTTLS/SSL, certifi CA bundle); SMTP
settings documented in .env templates.
- Settings switches to the code flow when email is on; the
current-password form remains the fallback.
Note: CRAI_Report was checked as the reference for code-sending — it
has no email/OTP functionality, so this is a fresh implementation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Talha Ahmed