Talha Ahmed
2aed450f4c
New flow (active once AR_SMTP_* is configured; hidden otherwise): - POST /api/auth/request-code emails a code to the account address (usernames are emails). HMAC-stored, 10-min expiry, single-use, 5-attempt lockout, 60s resend throttle, no user enumeration. - POST /api/auth/reset-password sets the new password with the code — works signed-in (Settings) and from the login screen (Forgot password?), so users can self-recover without the admin. - Mailer: stdlib smtplib (STARTTLS/SSL, certifi CA bundle); SMTP settings documented in .env templates. - Settings switches to the code flow when email is on; the current-password form remains the fallback. Note: CRAI_Report was checked as the reference for code-sending — it has no email/OTP functionality, so this is a fresh implementation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api | ||
| core | ||
| db | ||
| services | ||
| __init__.py | ||
| config.py | ||