From b7bbb2ca14d1edd59752a1f68b1d70c3f7e1235f Mon Sep 17 00:00:00 2001 From: Mix Date: Sat, 17 Oct 2026 11:02:34 +0300 Subject: [PATCH] guard: routes - the reset link, the confirmation link, Send the link again MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit password-reset, agreed 2026-10-13 ("the e-mail must be confirmed") and settled 2026-10-17 ("Без подтверждения слать": notifications go to an unconfirmed address, a reset link only to a confirmed one); mockups 2f5f5b2. Public, as /setup/ is: /login/reset (the form that asks for a link), /login/reset/ (the new password from the link), /confirm/ (the address confirmed from its link) - each link is opened from a mail, signed in or not. Behind a session: POST /account/email/confirm, Send the link again on Account. Co-Authored-By: Claude Opus 5.5 --- internal/web/guard_routes_test.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/internal/web/guard_routes_test.go b/internal/web/guard_routes_test.go index d35883b..5de0628 100644 --- a/internal/web/guard_routes_test.go +++ b/internal/web/guard_routes_test.go @@ -47,7 +47,7 @@ var routes = struct{ always, inbound, dmarc []string }{ "GET /server/users/{uid}/delete", "POST /server/users/{uid}/delete", "GET /server/settings", "POST /server/settings", "POST /server/settings/dns-recheck", "GET /server/components", - "GET /account", "POST /account/profile", "POST /account/password", + "GET /account", "POST /account/profile", "POST /account/password", "POST /account/email/confirm", "GET /help", }, inbound: []string{ @@ -163,7 +163,8 @@ func TestRoutesFollowNavigation(t *testing.T) { } // What stays as it was. - for _, p := range []string{"/healthz", "/license", "/static/panel.css", "/setup/token", "/login", "/logout"} { + for _, p := range []string{"/healthz", "/license", "/static/panel.css", "/setup/token", "/login", "/logout", + "/login/reset", "/login/reset/token", "/confirm/token"} { if got := answers(public, http.MethodGet, p); got == "" || got == "/" { t.Errorf("GET %s is no longer a public route", p) }