1 Commits

Author	SHA1	Message	Date
Claude	e95c732c6f	Let members get a password of their own ... Until now an admin created an account, the password appeared once on screen, and that was the only copy. Gitea's Forgot password answers "Account recovery is disabled because no email is set up", because this server has never been able to send mail. Every route a member had to a password of their own was closed, which made the members area unusable by anyone not standing next to the owner. Now: the admin enters a username and an email, the server creates the Gitea account with a random password nobody ever sees — the admin included — and the member is emailed a link to a Viena Latina page where they choose their own. The same mechanism gives "¿Olvidaste tu contraseña?" that works, replacing Gitea's dead page. Nobody leaves the site for either, which is possible because PATCH /admin/users/{username} accepts a password. A link is enough to take an account, so it is treated as a credential: single use, short-lived, stored only as a SHA-256, and invalidated when a newer one is issued so an older email stops working. SHA-256 rather than a password hash because these are 32 random bytes, not something a person chose — there is no dictionary to slow down. Recovery answers identically for a known and an unknown address, or the form becomes a way to enumerate members one address at a time, and stops after three tries so it cannot be used to mail-bomb somebody using this server's reputation. Rejecting a password deliberately does not spend the token. A typo must not lock somebody out of an account they have never reached. If the mail fails the admin is shown the link instead. The account exists either way, so the difference is between a delayed invitation and a person who simply never gets in. Found while testing: the rate limit did not work at all. created_at is written by SQLite as "2026-09-25 15:00:00" and I compared it against Python's "2026-09-25T15:00:00+00:00"; a space sorts before T, so every row looked older than any threshold and the limit silently never fired. It is now compared inside SQLite, where the format and the clock are the same one. Also drops two tabs from the sign-in page: OpenID, which nobody here will use, and Register, which contradicted DISABLE_REGISTRATION and invited people to try something the server then refused. Verified: 126 checks. Tokens are hashed at rest, work once, expire, die when reissued, and are refused for a suspended member; a short password and a Gitea rejection both leave the link usable; recovery is indistinguishable for known and unknown addresses and stops at three; creating a member emails them and shows no password; a failed send surfaces the link. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn	2026-09-25 17:49:39 +00:00