From 2f5f5b2b939169fa43defb5f6ebe914998dfb8bc Mon Sep 17 00:00:00 2001 From: Mix Date: Sat, 17 Oct 2026 11:02:07 +0300 Subject: [PATCH] design: password-reset - a confirmed e-mail, then a link to reset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Agreed 2026-10-13 ("the e-mail must be confirmed"); his choice of 2026-10-17 for notifications: "Без подтверждения слать" - they go to the address confirmed or not; only a reset link needs it confirmed. Sign-in gets "Forgot your password?" (login.html). login-reset.html asks for the username and says what will happen; login-reset-sent.html is the sign-in page after it, the same answer for any name ("If that account has a confirmed e-mail, the link is on its way"); login-reset-set.html sets the new password from the link and says that every session ends. confirm-email.html is where the confirmation link lands: a button, not a GET that changes state, as a mail scanner opens links. Account: the e-mail's tag (confirmed / not confirmed), what a new address is sent, the current password asked only to change the e-mail (roadmap, 2.0 security review: the e-mail becomes where a reset link goes), and "Send the link again" while it is unconfirmed. The user form shows the tag too. Help #account says it all. The user form loses "The same form, empty, creates a new user" (panel-words: a new user has its own head). Co-Authored-By: Claude Opus 5.5 --- docs/assets/panel-redesign/panel/account.html | 10 ++++- .../panel-redesign/panel/confirm-email.html | 32 +++++++++++++++ docs/assets/panel-redesign/panel/help.html | 2 +- .../panel/login-reset-sent.html | 41 +++++++++++++++++++ .../panel-redesign/panel/login-reset-set.html | 40 ++++++++++++++++++ .../panel-redesign/panel/login-reset.html | 37 +++++++++++++++++ docs/assets/panel-redesign/panel/login.html | 1 + .../panel-redesign/panel/src/account.html | 10 ++++- .../panel/src/confirm-email.html | 18 ++++++++ .../assets/panel-redesign/panel/src/help.html | 2 +- .../panel/src/login-reset-sent.html | 27 ++++++++++++ .../panel/src/login-reset-set.html | 26 ++++++++++++ .../panel-redesign/panel/src/login-reset.html | 23 +++++++++++ .../panel-redesign/panel/src/login.html | 1 + .../assets/panel-redesign/panel/src/user.html | 5 +-- docs/assets/panel-redesign/panel/user.html | 5 +-- 16 files changed, 268 insertions(+), 12 deletions(-) create mode 100644 docs/assets/panel-redesign/panel/confirm-email.html create mode 100644 docs/assets/panel-redesign/panel/login-reset-sent.html create mode 100644 docs/assets/panel-redesign/panel/login-reset-set.html create mode 100644 docs/assets/panel-redesign/panel/login-reset.html create mode 100644 docs/assets/panel-redesign/panel/src/confirm-email.html create mode 100644 docs/assets/panel-redesign/panel/src/login-reset-sent.html create mode 100644 docs/assets/panel-redesign/panel/src/login-reset-set.html create mode 100644 docs/assets/panel-redesign/panel/src/login-reset.html diff --git a/docs/assets/panel-redesign/panel/account.html b/docs/assets/panel-redesign/panel/account.html index 738d454..152e4b9 100644 --- a/docs/assets/panel-redesign/panel/account.html +++ b/docs/assets/panel-redesign/panel/account.html @@ -80,12 +80,18 @@
-
-

Your own address. A domain's report address can be filled with it from Domain settings.

+
+

Your own address. Saving a new one sends it a link to confirm it; once confirmed it is where a link to reset your password can go. A domain's report address can be filled with it from Domain settings.

+
+

Needed only to change the e-mail.

To this address, when something needs you: a DNS record of a domain stops matching, a rate limit refuses mail, the TLS certificate is about to expire, a message has waited in the queue for three days. What is sent and when

+
+

A link was sent to mix@example.org at 14:02; it works once, for 24 hours.

+ +
diff --git a/docs/assets/panel-redesign/panel/confirm-email.html b/docs/assets/panel-redesign/panel/confirm-email.html new file mode 100644 index 0000000..fbc6ee4 --- /dev/null +++ b/docs/assets/panel-redesign/panel/confirm-email.html @@ -0,0 +1,32 @@ + + + + + +Confirm e-mail · SelfPost + + + + + + + + + + diff --git a/docs/assets/panel-redesign/panel/help.html b/docs/assets/panel-redesign/panel/help.html index aeaa036..4713fab 100644 --- a/docs/assets/panel-redesign/panel/help.html +++ b/docs/assets/panel-redesign/panel/help.html @@ -151,7 +151,7 @@
05

Account

-

Your account

Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.

+

Your account

Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected. A new e-mail is sent a link that confirms it, which works once, for 24 hours; changing the e-mail asks for your password. Notifications go to the address whether it is confirmed or not, but only a confirmed one can get a link to reset a forgotten password: Forgot your password? on the sign-in page sends it, for 30 minutes and once, and setting the new password signs every session of the account out. Without a confirmed e-mail the global administrator sets a new password under Users, and the only global administrator recovers from the container.

diff --git a/docs/assets/panel-redesign/panel/login-reset-sent.html b/docs/assets/panel-redesign/panel/login-reset-sent.html new file mode 100644 index 0000000..2581164 --- /dev/null +++ b/docs/assets/panel-redesign/panel/login-reset-sent.html @@ -0,0 +1,41 @@ + + + + + +Sign in · SelfPost + + + + + + + + + + diff --git a/docs/assets/panel-redesign/panel/login-reset-set.html b/docs/assets/panel-redesign/panel/login-reset-set.html new file mode 100644 index 0000000..f1a4fad --- /dev/null +++ b/docs/assets/panel-redesign/panel/login-reset-set.html @@ -0,0 +1,40 @@ + + + + + +New password · SelfPost + + + + + + + + + + diff --git a/docs/assets/panel-redesign/panel/login-reset.html b/docs/assets/panel-redesign/panel/login-reset.html new file mode 100644 index 0000000..7b60edc --- /dev/null +++ b/docs/assets/panel-redesign/panel/login-reset.html @@ -0,0 +1,37 @@ + + + + + +Reset password · SelfPost + + + + + + + + + + diff --git a/docs/assets/panel-redesign/panel/login.html b/docs/assets/panel-redesign/panel/login.html index 078458b..08244f1 100644 --- a/docs/assets/panel-redesign/panel/login.html +++ b/docs/assets/panel-redesign/panel/login.html @@ -30,6 +30,7 @@
+

Forgot your password?

Copyright © 2026 Mikhail Yenuchenko · License (AGPL-3.0) · Source · No warranty

diff --git a/docs/assets/panel-redesign/panel/src/account.html b/docs/assets/panel-redesign/panel/src/account.html index e5ea912..92de965 100644 --- a/docs/assets/panel-redesign/panel/src/account.html +++ b/docs/assets/panel-redesign/panel/src/account.html @@ -14,12 +14,18 @@
-
-

Your own address. A domain's report address can be filled with it from Domain settings.

+
+

Your own address. Saving a new one sends it a link to confirm it; once confirmed it is where a link to reset your password can go. A domain's report address can be filled with it from Domain settings.

+
+

Needed only to change the e-mail.

To this address, when something needs you: a DNS record of a domain stops matching, a rate limit refuses mail, the TLS certificate is about to expire, a message has waited in the queue for three days. What is sent and when

+
+

A link was sent to mix@example.org at 14:02; it works once, for 24 hours.

+ +
diff --git a/docs/assets/panel-redesign/panel/src/confirm-email.html b/docs/assets/panel-redesign/panel/src/confirm-email.html new file mode 100644 index 0000000..abedb2f --- /dev/null +++ b/docs/assets/panel-redesign/panel/src/confirm-email.html @@ -0,0 +1,18 @@ + + diff --git a/docs/assets/panel-redesign/panel/src/help.html b/docs/assets/panel-redesign/panel/src/help.html index 3b9ce28..3b260f9 100644 --- a/docs/assets/panel-redesign/panel/src/help.html +++ b/docs/assets/panel-redesign/panel/src/help.html @@ -85,7 +85,7 @@
05

Account

-

Your account

Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.

+

Your account

Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected. A new e-mail is sent a link that confirms it, which works once, for 24 hours; changing the e-mail asks for your password. Notifications go to the address whether it is confirmed or not, but only a confirmed one can get a link to reset a forgotten password: Forgot your password? on the sign-in page sends it, for 30 minutes and once, and setting the new password signs every session of the account out. Without a confirmed e-mail the global administrator sets a new password under Users, and the only global administrator recovers from the container.

diff --git a/docs/assets/panel-redesign/panel/src/login-reset-sent.html b/docs/assets/panel-redesign/panel/src/login-reset-sent.html new file mode 100644 index 0000000..664c3f5 --- /dev/null +++ b/docs/assets/panel-redesign/panel/src/login-reset-sent.html @@ -0,0 +1,27 @@ + + diff --git a/docs/assets/panel-redesign/panel/src/login-reset-set.html b/docs/assets/panel-redesign/panel/src/login-reset-set.html new file mode 100644 index 0000000..8c34000 --- /dev/null +++ b/docs/assets/panel-redesign/panel/src/login-reset-set.html @@ -0,0 +1,26 @@ + + diff --git a/docs/assets/panel-redesign/panel/src/login-reset.html b/docs/assets/panel-redesign/panel/src/login-reset.html new file mode 100644 index 0000000..b79bd11 --- /dev/null +++ b/docs/assets/panel-redesign/panel/src/login-reset.html @@ -0,0 +1,23 @@ + + diff --git a/docs/assets/panel-redesign/panel/src/login.html b/docs/assets/panel-redesign/panel/src/login.html index 2fa58a3..a73c490 100644 --- a/docs/assets/panel-redesign/panel/src/login.html +++ b/docs/assets/panel-redesign/panel/src/login.html @@ -19,6 +19,7 @@
+

Forgot your password?

Copyright © 2026 Mikhail Yenuchenko · License (AGPL-3.0) · Source · No warranty

diff --git a/docs/assets/panel-redesign/panel/src/user.html b/docs/assets/panel-redesign/panel/src/user.html index 98e98ff..e9f0444 100644 --- a/docs/assets/panel-redesign/panel/src/user.html +++ b/docs/assets/panel-redesign/panel/src/user.html @@ -3,7 +3,6 @@

Users /

acme-ops

-

The same form, empty, creates a new user.

Delete user @@ -15,8 +14,8 @@
01

Account

-
-

The user's own address. They can change it under Account.

+
+

The user's own address. They can change it under Account. A new one is sent a link to confirm it; until it is confirmed no reset link goes to it.

Leave empty to keep the current one.

diff --git a/docs/assets/panel-redesign/panel/user.html b/docs/assets/panel-redesign/panel/user.html index 75acc39..35afa5f 100644 --- a/docs/assets/panel-redesign/panel/user.html +++ b/docs/assets/panel-redesign/panel/user.html @@ -69,7 +69,6 @@

Users /

acme-ops

-

The same form, empty, creates a new user.

Delete user
@@ -81,8 +80,8 @@
01

Account

-
-

The user's own address. They can change it under Account.

+
+

The user's own address. They can change it under Account. A new one is sent a link to confirm it; until it is confirmed no reset link goes to it.

Leave empty to keep the current one.