password-reset: a confirmed e-mail, then a link to reset the password

Agreed by the owner on 2026-10-13 ("the e-mail must be confirmed");
notifications to an unconfirmed address settled on 2026-10-17: "Без
подтверждения слать". Mockups 2f5f5b2, route guard b7bbb2c, panel guard
0774da2.

Migration 0013: users.email_confirmed_at ('' for every address saved
before it) and user_links - the SHA-256 of a link's token, its user,
purpose (confirm, reset), address, created and expiry. A changed address
loses its mark (keepConfirmed, in UpdateUser and SaveUser).

internal/web/auth/links.go. A link is 256 bits from crypto/rand, mailed as
https://SELFPOST_HOSTNAME/... - never the request's Host. Confirmation:
24 h, sent when an address is saved (Account, or the global role's user
form) and by Account's Send the link again; its page /confirm/<token> has
a button (a GET changes nothing) and confirms only for a session of its
own account. Reset: /login/reset asks for a username and answers the same
for every name (the sign-in page, "If that account has a confirmed e-mail,
the link is on its way"), mailing after the answer; only a confirmed
address gets one, none within ten minutes of the last, five links an hour
per account, five requests in 15 minutes per client address;
/login/reset/<token> (30 min) sets the password with the link taken in
the same transaction that checks the address again
(store.TakeResetLink), then ends every session. Changing the e-mail on
Account asks for the current password. A password set on Account or the
user form removes the reset links; a restore removes every link; the stop
waits for links being mailed (Server.Drain); a rejected request's log line
hides a link's token (loggedPath).

Reviewed for security before the commit (2026-10-17): no high; two
medium and five low, all fixed here - confirming needs the account's
session and the mail does not name the account (a mistyped address was a
takeover); a reset request neither replaces the links already sent nor
spends the account's quota inside ten minutes; take-and-set atomic; the
confirmation mail sent after the answer; the stop waits for mail; a
restore deletes the links; the token kept out of the log.

Tests: store TestUserLinks, TestUserLinkTakenOnce, TestEmailConfirmation,
TestTakeResetLink; auth TestResetSendsALinkOnlyToAConfirmedAddress,
TestResetLinkSetsThePasswordOnce, TestResetLinkDiesWithTheAddress,
TestResetRequestsAreLimited, TestResetRequestsAreSpaced, TestConfirmLink,
TestLinkPathsWithoutAToken; handlers TestAccountEmailIsConfirmedByItsLink,
TestUserFormSendsANewAddressItsLink; web TestLoggedPathHidesTokens; the
view's pages and fixtures; e2e password_reset_by_e_mail runs it through
the sink (and checks a link from before the restore is dead). go vet +
go test (26 packages) and make e2e on the test server for this tree.

Docs: guide § Account, security.md (the bullet and what ends sessions),
architecture (routes), schema-migrations (row 13, users, user_links),
help #account (word for word with the mockup), roadmap row done,
CHANGELOG [Unreleased].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/web.go

@@ -4,6 +4,7 @@
 package web
 
 import (
+	"context"
 	"log"
 	"net"
 	"net/http"
@@ -17,6 +18,7 @@ import (
 	"github.com/mixeme/selfpost/internal/health"
 	"github.com/mixeme/selfpost/internal/inbound"
 	"github.com/mixeme/selfpost/internal/legal"
+	"github.com/mixeme/selfpost/internal/notify"
 	"github.com/mixeme/selfpost/internal/postfix"
 	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/auth"
@@ -141,6 +143,7 @@ func New(st *store.Store, domains *domain.Service, apps *app.Service, inboundSvc
 		SessionIdleDays:   cfg.SessionIdleDays,
 		TrustedProxyCIDRs: cfg.TrustedProxyCIDRs,
 	}, v, setupTokenPath)
+	a.SetMailer(notify.NewMailer(cfg.Hostname))
 	h := handlers.New(st, domains, apps, inboundSvc, lists, dmarcSvc, handlers.Config{
 		Hostname:                   cfg.Hostname,
 		SubmissionEnabled:          cfg.SubmissionEnabled,
@@ -179,6 +182,13 @@ func (s *Server) Start() error {
 	return s.auth.Bootstrap()
 }
 
+// Drain waits, until ctx ends, for what the panel still does after its
+// answers - the links of password-reset being mailed - so the database is not
+// closed under them.
+func (s *Server) Drain(ctx context.Context) {
+	s.auth.Wait(ctx)
+}
+
 // Handler returns the panel's HTTP handler (router).
 func (s *Server) Handler() http.Handler {
 	mux, authed := s.muxes()
@@ -200,6 +210,10 @@ func (s *Server) muxes() (public, authed *http.ServeMux) {
 	mux.Handle("/static/", view.StaticHandler())
 	mux.HandleFunc("/setup/", s.auth.HandleSetup)
 	mux.HandleFunc("/login", s.auth.HandleLogin)
+	// The links of password-reset, opened from a mail, signed in or not.
+	mux.HandleFunc("/login/reset", s.auth.HandleReset)
+	mux.HandleFunc("/login/reset/", s.auth.HandleResetLink)
+	mux.HandleFunc("/confirm/", s.auth.HandleConfirm)
 	mux.HandleFunc("/logout", s.auth.HandleLogout)
 
 	authed = http.NewServeMux()
@@ -213,6 +227,7 @@ func (s *Server) muxes() (public, authed *http.ServeMux) {
 	authed.HandleFunc("GET /account", h.HandleAccount)
 	authed.HandleFunc("POST /account/profile", h.HandleAccountProfile)
 	authed.HandleFunc("POST /account/password", h.HandleAccountPassword)
+	authed.HandleFunc("POST /account/email/confirm", h.HandleAccountConfirmLink)
 
 	// Overview. Its handler checks the role itself: the page is global-only
 	// but does not live under /server/.