password-reset: a confirmed e-mail, then a link to reset the password

Agreed by the owner on 2026-10-13 ("the e-mail must be confirmed");
notifications to an unconfirmed address settled on 2026-10-17: "Без
подтверждения слать". Mockups 2f5f5b2, route guard b7bbb2c, panel guard
0774da2.

Migration 0013: users.email_confirmed_at ('' for every address saved
before it) and user_links - the SHA-256 of a link's token, its user,
purpose (confirm, reset), address, created and expiry. A changed address
loses its mark (keepConfirmed, in UpdateUser and SaveUser).

internal/web/auth/links.go. A link is 256 bits from crypto/rand, mailed as
https://SELFPOST_HOSTNAME/... - never the request's Host. Confirmation:
24 h, sent when an address is saved (Account, or the global role's user
form) and by Account's Send the link again; its page /confirm/<token> has
a button (a GET changes nothing) and confirms only for a session of its
own account. Reset: /login/reset asks for a username and answers the same
for every name (the sign-in page, "If that account has a confirmed e-mail,
the link is on its way"), mailing after the answer; only a confirmed
address gets one, none within ten minutes of the last, five links an hour
per account, five requests in 15 minutes per client address;
/login/reset/<token> (30 min) sets the password with the link taken in
the same transaction that checks the address again
(store.TakeResetLink), then ends every session. Changing the e-mail on
Account asks for the current password. A password set on Account or the
user form removes the reset links; a restore removes every link; the stop
waits for links being mailed (Server.Drain); a rejected request's log line
hides a link's token (loggedPath).

Reviewed for security before the commit (2026-10-17): no high; two
medium and five low, all fixed here - confirming needs the account's
session and the mail does not name the account (a mistyped address was a
takeover); a reset request neither replaces the links already sent nor
spends the account's quota inside ten minutes; take-and-set atomic; the
confirmation mail sent after the answer; the stop waits for mail; a
restore deletes the links; the token kept out of the log.

Tests: store TestUserLinks, TestUserLinkTakenOnce, TestEmailConfirmation,
TestTakeResetLink; auth TestResetSendsALinkOnlyToAConfirmedAddress,
TestResetLinkSetsThePasswordOnce, TestResetLinkDiesWithTheAddress,
TestResetRequestsAreLimited, TestResetRequestsAreSpaced, TestConfirmLink,
TestLinkPathsWithoutAToken; handlers TestAccountEmailIsConfirmedByItsLink,
TestUserFormSendsANewAddressItsLink; web TestLoggedPathHidesTokens; the
view's pages and fixtures; e2e password_reset_by_e_mail runs it through
the sink (and checks a link from before the restore is dead). go vet +
go test (26 packages) and make e2e on the test server for this tree.

Docs: guide § Account, security.md (the bullet and what ends sessions),
architecture (routes), schema-migrations (row 13, users, user_links),
help #account (word for word with the mockup), roadmap row done,
CHANGELOG [Unreleased].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/users.go

@@ -42,6 +42,9 @@ type User struct {
 	// Email is the user's own address — what the panel writes to, and what the
 	// button beside a domain's typed report address fills it with.
 	Email string
+	// EmailConfirmed is when Email was confirmed by its link, zero while it
+	// is not: only a confirmed address is sent a reset link (migration 0013).
+	EmailConfirmed time.Time
 	// AllDomains / AllInboundDomains widen a domain user's list to every
 	// domain of that direction, including those added later; the id lists
 	// are then ignored.
@@ -55,19 +58,20 @@ type User struct {
 	InboundDomainIDs []int64
 }
 
-const userColumns = "id, username, password_hash, role, email, all_domains, all_inbound_domains, notify, created_at"
+const userColumns = "id, username, password_hash, role, email, all_domains, all_inbound_domains, notify, created_at, email_confirmed_at"
 
 func scanUser(r scanRow) (User, error) {
 	var (
-		u         User
-		createdAt string
+		u                    User
+		createdAt, confirmed string
 	)
 	err := r.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.Email,
-		&u.AllDomains, &u.AllInboundDomains, &u.Notify, &createdAt)
+		&u.AllDomains, &u.AllInboundDomains, &u.Notify, &createdAt, &confirmed)
 	if err != nil {
 		return User{}, err
 	}
 	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	u.EmailConfirmed, _ = time.Parse(time.RFC3339, confirmed)
 	return u, nil
 }
 
@@ -316,8 +320,8 @@ func (s *Store) SaveUser(c UserChange) error {
 	// An empty hash keeps the stored one: the form read it when it was
 	// opened, and the user may have changed it on Account since.
 	res, err := tx.Exec(
-		"UPDATE users SET username = ?, password_hash = COALESCE(NULLIF(?, ''), password_hash), email = ?, role = ? WHERE id = ?",
-		c.Username, c.PasswordHash, c.Email, c.Role, c.ID,
+		"UPDATE users SET username = ?, password_hash = COALESCE(NULLIF(?, ''), password_hash), email = ?, role = ?, "+keepConfirmed+" WHERE id = ?",
+		c.Username, c.PasswordHash, c.Email, c.Role, c.Email, c.ID,
 	)
 	if err != nil {
 		if isUniqueViolation(err) {
@@ -366,11 +370,19 @@ func requireAGlobal(tx *sql.Tx) error {
 	return nil
 }
 
-// UpdateUser replaces a user's username, password hash and account e-mail.
+// keepConfirmed keeps the confirmation of an address that stays the same and
+// clears it for another; its placeholder takes the new address. SQLite
+// 3.53.4, https://sqlite.org/lang_update.html: every expression on the right
+// of SET sees the row as it was before the UPDATE, so email here is the old
+// address.
+const keepConfirmed = "email_confirmed_at = CASE WHEN email = ? THEN email_confirmed_at ELSE '' END"
+
+// UpdateUser replaces a user's username, password hash and account e-mail; a
+// new e-mail is unconfirmed.
 func (s *Store) UpdateUser(id int64, username, passwordHash, email string) error {
 	res, err := s.db.Exec(
-		"UPDATE users SET username = ?, password_hash = ?, email = ? WHERE id = ?",
-		username, passwordHash, email, id,
+		"UPDATE users SET username = ?, password_hash = ?, email = ?, "+keepConfirmed+" WHERE id = ?",
+		username, passwordHash, email, email, id,
 	)
 	if err != nil {
 		if isUniqueViolation(err) {