Backlog: H12 done (oxygenhub#9) 370c7584e299
- Author
- Andy McCall @andymccall <[email protected]>
- When
- · 2026-09-28 13:03 UTC
- Signature
- ✔ signed by Andy McCall
- Hash
370c7584e299782cd582c6eda3d4af080002527722007f49855c3a2be28a1e7f- Depends on
- 75036530b621 d14d78326300
- Depended on by
- 227dde3b2387 86394a7503b4
- In bookmarks
- agents-in-readme bare-hashes carried-not-removed carry-identical doctor-trust identical-sides keyless-tags main merge-remote-bookmark only-help-103 paths-for-resolutions-and-amend push-notes show-stat subrepo-pin-state switch-says
- In tags
- v0.1.0 v0.10.0 v0.11.0 v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.4.1 v0.4.2 v0.4.3 v0.4.4 v0.4.5 v0.4.6 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
- Edits
- 3 atoms, 0 tree operations, 1 file
Browse the tree at this change
modified docs/backlog-overnight-2.md +10 −1
| … | 19 unchanged lines |
||
| 20 | 20 | - [x] H9 File view: file tree sidebar, `y` for a permalink to the state, line range copy, blame age shading and "blame the state before this change". |
|
| 21 | 21 | - [x] H10 Compare page with bookmark and tag pickers and a "propose this" button. |
|
| 22 | 22 | - [x] H11 Help pages: getting started (install oxy, clone, push, tokens, CA, delegating to the hub), keyboard shortcuts, glossary for people coming from GitHub. |
|
| 23 | - | - [ ] H12 Password reset and email verification (email when SMTP is set; admin-issued reset link otherwise). |
|
| 23 | + | - [x] H12 Password reset and email verification (email when SMTP is set; admin-issued reset link otherwise). |
|
| 24 | 24 | - [ ] H13 Notifications: per-thread mark read, filter by kind and repository, "participating" versus "watching". |
|
| 25 | 25 | - [ ] H14 Accessibility and mobile pass: focus styles, skip link, landmarks, responsive tables and tabs, contrast in both themes. |
|
| 26 | 26 | - [ ] H15 Organisation webhooks page; admin storage and repository maintenance page (sizes, oxy gc). |
|
| … | 89 unchanged lines |
||
| 116 | 116 | - Every command carries this hub's address, remote name and certificate step. |
|
| 117 | 117 | - It is linked from the band, the footer and the `?` sheet. |
|
| 118 | 118 | - Browse test; hub spec §6.3. Deployed. |
|
| 119 | + | - 2026-09-28 H12 done (oxygenhub#9, closed by the change). Spec §5.1.1 first. |
|
| 120 | + | - **Account links.** 32 random bytes, stored as a BLAKE3 hash, single use and expiring. Migration 0012. |
|
| 121 | + | - **Verification.** Sent on registration and on every address change (48 h). It only verifies the address it was sent to. Settings shows the status and can resend: one every 2 minutes per address, 10 an hour per account. |
|
| 122 | + | - **Reset by email.** By username or verified email (1 h, one every 2 minutes). The answer is identical whether or not anything matched, and mail goes out in the background so timing leaks nothing. |
|
| 123 | + | - **Reset by an administrator.** From /admin (24 h, shown once, audited). |
|
| 124 | + | - **Using a reset link.** It rotates the session salt (every session ends) and voids other links. TOTP stays on; banned accounts are refused. |
|
| 125 | + | - **Mail.** A shared `mail` module with `file://` for development. Notification mail only goes to verified addresses. |
|
| 126 | + | - **Tests.** tests/recovery.rs covers the whole flow through a file mailbox. |
|
| 127 | + | - **Earth.** Earth has no SMTP, so resets there go through the admin link. Existing addresses count as unverified until verified. |