Let console admins reset a forgotten password

[om986]

Summary

• The sign-in page can email a one-hour, single-use password reset link when SMTP is configured. The response does not reveal whether the address is an admin.
• Using the link sets a new password and ends that admin's browser sessions. Two-factor authentication and personal API tokens stay in place.
• Without SMTP, the link stays hidden. om admin reset-password still sets a password from the machine. Run om migrate for the new reset-token table.

Test plan

• With SMTP and OM_PUBLIC_URL set, request a reset for a password admin and confirm the email link works once.
• Request a reset for an unknown address and confirm the page shows the same message and no email is sent.
• Confirm a reset ends existing browser sessions, rejects the old password, and still requires an authenticator code when two-factor authentication is on.
• Confirm the forgot-password link is absent when SMTP is not configured.
• Run om migrate on an existing database and sign in afterward.

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: OpenSourceOM/core/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3bb69e7e-5abe-4da4-a20d-8c97f9dc9119

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}