CopilotKit / CopilotKit/outpost
auth: no forgot-password / reset flow exists
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 7
- Forks
- 3
- Avg merge
- 7d 16h
- Merged PRs (30d)
- 15
Description
There is no password reset flow. No route, component, or handler matches forgot, resetPassword, or password-reset anywhere in apps/web/src.
Why it matters
A team member who forgets their password has no self-service path back in — recovery requires an admin editing the database directly. The invite flow (InviteToken) already establishes the token-email-expiry pattern this would reuse, so the building blocks exist.
Fix
/forgot-password request page → single-use expiring token (mirroring InviteToken) → email via the existing Postmark transport → /reset-password consume page. Tokens must be single-use and expiring, and the request endpoint must not disclose whether an address is registered.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by searching apps/web/src for the existing InviteToken implementation and Postmark transport, then trace the current route, component, and handler structure. Use that invite-token pattern to map the forgot-password request and reset pages, including single-use expiry and non-disclosing responses. Done means both pages and the email flow work without revealing whether an address is registered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, backend-api-design
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100