Platform services

Password reset

Behind “forgot password”: $auth.requestPasswordReset(email) mails a one-time token to the address, and $auth.resetPassword(token, newPassword) spends it. The reply to a request is the same whether or not the address has an account, so the form tells nobody who is registered.

async $requestReset() {
  // Always answers { ok: true }, known address or not. The token goes
  // to the address by email, never back to the page.
  await this.$auth.requestPasswordReset(this.email)
},

async $resetPassword() {
  // Works once, then the token is spent. Every session of that person ends.
  await this.$auth.resetPassword(this.token, this.newPassword)
},

1. An account

2. Forgot password

3. Set a new password

(no calls yet: start at step 1)