Feature: Implement Password Recovery and Reset API

[3m1n3nc3]

Description

Implement anti-enumerating recovery and one-time password reset.

File Location

Password reset service/routes/controllers, templates, and tests

Design Reference

API Roadmap Phase 1: Implement Password Recovery and Reset API.

Dependencies

• Status: Blocked
• Blocked by: Feature: Add Auth Token and Session Persistence Models; Feature: Add Transaction Outbox and Job Delivery Foundation
• Blocks: Feature: Harden Authentication and Account Security Policy

Tasks

• Add neutral forgot-password response with limits
• Issue hashed one-time expiring reset token via outbox email
• Validate policy and reset atomically
• Revoke reset tokens and applicable sessions on success
• Audit without recording secrets
• Test unknown account, expiry, replay, concurrency, limits, and revocation

Acceptance Criteria

• Responses do not reveal account existence
• Token resets at most once
• Session revocation follows documented policy
• No raw token/password is logged or persisted
• Tests and OpenAPI pass

Verification Evidence

• Attach redacted curl and anti-enumeration, replay, and revocation tests

Difficulty

Advanced

[shepherd-001]

Hello, I have reviewed the issue and am confident in my ability to resolve it. I'm experienced with authentication services. Please assign this task to me.

[shepherd-001]

Hello, I have reviewed the issue and am confident in my ability to resolve it. I'm experienced with authentication services. Please assign this task to me.

[grantfox-oss]

🦊 GrantFox — @shepherd-001 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #78)
2. Your PR will be reviewed by the learnault maintainers

Good luck! Track your progress on GrantFox.