Deeka's Devlog

Goauth

Document forgot/reset password integration for external app

1 min read

Summary

Explored the forgot-password and reset-password flow (handler, service, tokens, mailer, migrations, config) and wrote docs/forgot-reset-password-integration.md covering endpoints, request/response schemas, error matrix, token lifecycle, email link contract, and integration checklist for wiring another app to the API.

Decisions

  • Reset email links must point to the consuming frontend app’s /auth/reset-password page (which POSTs token + new_password to the API), not the raw API endpoint

Learnings

  • No CORS middleware exists in the codebase; cross-origin browser calls to /auth/forgot-password and /auth/reset-password need go-chi/cors added
  • forgot-password and reset-password have no rate limiting, unlike /auth/login and /auth/resend-verification