docs(backend): document the password-reset endpoints and table #8

wtclaude · 2026-07-19T08:58:15Z

wtclaude commented

2026-07-19 08:58:15 +00:00

What & why

Documents the new self-service password-reset flow in website/BACKEND_DESIGN.md, keeping the canonical docs in lockstep with the code (per the repo's "docs must track code" rule). Counterpart to RunicGateway/website#75.

Adds POST /auth/password/forgot and GET|POST /auth/password/reset/:token to the /auth API-contract table, with the no-enumeration behaviour, session-revoke semantics, and no-auto-login note.
Adds the password_resets table to the §3 schema section (hashed opaque token, single-use, ~1h TTL).
Notes that the Android app hands off to the web reset page (docs/android/PLAN.md §4.2) rather than shipping a native screen.

How it was tested

Docs-only change — proofread against the implemented endpoints and the regenerated OpenAPI spec in website#75.

Checklist

I have read CONTRIBUTING.md.
The change builds and existing tests/checks pass locally.
I have added or updated tests/docs where it makes sense.
My commits are reasonably scoped with clear messages.

AI-assisted contributions (required)

No AI tools were used to produce this contribution.
AI tools were used. Tool(s): Claude Code (Claude Opus 4.8). I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a Co-Authored-By trailer.

License

I agree that my contribution is licensed under this project's license (GNU GPL v3.0 or later), and I have the right to contribute it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

## What & why Documents the new self-service password-reset flow in `website/BACKEND_DESIGN.md`, keeping the canonical docs in lockstep with the code (per the repo's "docs must track code" rule). Counterpart to **RunicGateway/website#75**. - Adds `POST /auth/password/forgot` and `GET|POST /auth/password/reset/:token` to the `/auth` API-contract table, with the no-enumeration behaviour, session-revoke semantics, and no-auto-login note. - Adds the `password_resets` table to the §3 schema section (hashed opaque token, single-use, ~1h TTL). - Notes that the Android app hands off to the web reset page (`docs/android/PLAN.md` §4.2) rather than shipping a native screen. ## How it was tested Docs-only change — proofread against the implemented endpoints and the regenerated OpenAPI spec in website#75. ## Checklist - [x] I have read [CONTRIBUTING.md](CONTRIBUTING.md). - [x] The change builds and existing tests/checks pass locally. - [x] I have added or updated tests/docs where it makes sense. - [x] My commits are reasonably scoped with clear messages. ## AI-assisted contributions (required) - [ ] No AI tools were used to produce this contribution. - [x] AI tools were used. Tool(s): `Claude Code (Claude Opus 4.8)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a `Co-Authored-By` trailer. ## License - [x] I agree that my contribution is licensed under this project's license (**GNU GPL v3.0 or later**), and I have the right to contribute it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

wtclaude added 1 commit 2026-07-19 08:58:17 +00:00

docs(backend): document the password-reset endpoints and table d87a45e914

Add /auth/password/forgot and /auth/password/reset/:token to the API
contract and the password_resets table to the schema section, matching the
website change (RunicGateway/website feat/password-reset). Notes the
no-enumeration behaviour, single-use hashed-token model, and that the Android
app hands off to the web reset page (PLAN.md §4.2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

whitlocktech approved these changes 2026-07-19 09:01:27 +00:00

whitlocktech merged commit ee87ce0729 into main

2026-07-19 09:01:36 +00:00

whitlocktech deleted branch docs/password-reset

2026-07-19 09:01:37 +00:00

whitlocktech referenced this issue from a commit

2026-07-19 09:01:38 +00:00

Merge pull request 'docs(backend): document the password-reset endpoints and table' (#8) from docs/password-reset into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/docs#8