password-reset: a confirmed e-mail, then a link to reset the password

Agreed by the owner on 2026-10-13 ("the e-mail must be confirmed");
notifications to an unconfirmed address settled on 2026-10-17: "Без
подтверждения слать". Mockups 2f5f5b2, route guard b7bbb2c, panel guard
0774da2.

Migration 0013: users.email_confirmed_at ('' for every address saved
before it) and user_links - the SHA-256 of a link's token, its user,
purpose (confirm, reset), address, created and expiry. A changed address
loses its mark (keepConfirmed, in UpdateUser and SaveUser).

internal/web/auth/links.go. A link is 256 bits from crypto/rand, mailed as
https://SELFPOST_HOSTNAME/... - never the request's Host. Confirmation:
24 h, sent when an address is saved (Account, or the global role's user
form) and by Account's Send the link again; its page /confirm/<token> has
a button (a GET changes nothing) and confirms only for a session of its
own account. Reset: /login/reset asks for a username and answers the same
for every name (the sign-in page, "If that account has a confirmed e-mail,
the link is on its way"), mailing after the answer; only a confirmed
address gets one, none within ten minutes of the last, five links an hour
per account, five requests in 15 minutes per client address;
/login/reset/<token> (30 min) sets the password with the link taken in
the same transaction that checks the address again
(store.TakeResetLink), then ends every session. Changing the e-mail on
Account asks for the current password. A password set on Account or the
user form removes the reset links; a restore removes every link; the stop
waits for links being mailed (Server.Drain); a rejected request's log line
hides a link's token (loggedPath).

Reviewed for security before the commit (2026-10-17): no high; two
medium and five low, all fixed here - confirming needs the account's
session and the mail does not name the account (a mistyped address was a
takeover); a reset request neither replaces the links already sent nor
spends the account's quota inside ten minutes; take-and-set atomic; the
confirmation mail sent after the answer; the stop waits for mail; a
restore deletes the links; the token kept out of the log.

Tests: store TestUserLinks, TestUserLinkTakenOnce, TestEmailConfirmation,
TestTakeResetLink; auth TestResetSendsALinkOnlyToAConfirmedAddress,
TestResetLinkSetsThePasswordOnce, TestResetLinkDiesWithTheAddress,
TestResetRequestsAreLimited, TestResetRequestsAreSpaced, TestConfirmLink,
TestLinkPathsWithoutAToken; handlers TestAccountEmailIsConfirmedByItsLink,
TestUserFormSendsANewAddressItsLink; web TestLoggedPathHidesTokens; the
view's pages and fixtures; e2e password_reset_by_e_mail runs it through
the sink (and checks a link from before the restore is dead). go vet +
go test (26 packages) and make e2e on the test server for this tree.

Docs: guide § Account, security.md (the bullet and what ends sessions),
architecture (routes), schema-migrations (row 13, users, user_links),
help #account (word for word with the mockup), roadmap row done,
CHANGELOG [Unreleased].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/fixtures_test.go

@@ -21,13 +21,20 @@ import (
 // This file belongs to the implementation, not to the guards: the step that
 // restyles a page adds its fixture here in the same commit.
 var pageFixtures = map[string]func() any{
-	"components": func() any { return KitPage() },
-	"login":      func() any { return NewLogin("mail.example.org", "") },
-	"setup":      func() any { return NewSetup("0123456789abcdef", "") },
-	"overview":   func() any { return overviewFixture() },
-	"health":     func() any { return healthFixture(false) },
-	"account":    func() any { return accountFixture() },
-	"settings":   func() any { return settingsFixture() },
+	"components":  func() any { return KitPage() },
+	"login":       func() any { return NewLogin("mail.example.org", "") },
+	"setup":       func() any { return NewSetup("0123456789abcdef", "") },
+	"login-reset": func() any { return NewReset("mail.example.org", "") },
+	"login-reset-set": func() any {
+		return NewResetSet("mail.example.org", "admin", "0123456789abcdef", "")
+	},
+	"confirm-email": func() any {
+		return NewConfirm("mail.example.org", "admin", "mix@example.org", "0123456789abcdef")
+	},
+	"overview": func() any { return overviewFixture() },
+	"health":   func() any { return healthFixture(false) },
+	"account":  func() any { return accountFixture() },
+	"settings": func() any { return settingsFixture() },
 
 	"out-domains":         func() any { return outDomainsFixture() },
 	"out-domain":          func() any { return outDomainFixture() },
@@ -141,6 +148,8 @@ func healthFixture(refresh bool) *Health {
 func accountFixture() *Account {
 	a := NewAccount(admin(), "global")
 	a.Username, a.Email, a.Notify = "admin", "mix@example.org", true
+	// The mockup's address: not confirmed, its link sent at 14:02.
+	a.WithEmailState("mix@example.org", false, time.Date(2026, 10, 17, 14, 2, 0, 0, time.UTC))
 	return a
 }
 
@@ -438,7 +447,7 @@ func userFixture() *UserForm {
 		AllOut:     true,
 		OutDomains: []DomainChoice{{ID: 1, Name: "example.org"}, {ID: 2, Name: "shop.example.org"}, {ID: 3, Name: "notify.acme.io"}},
 		InDomains:  []DomainChoice{{ID: 1, Name: "lists.example.org"}, {ID: 2, Name: "acme.io", Checked: true}},
-	})
+	}).WithEmailState("ops@acme.io", true)
 }
 
 // userDeleteFixture is the mockup's confirmation: acme-ops, who has all