ai_ml_operations/chat_android
2
0 Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

Password reset #4

New Issue
Open
opened 2026-10-23 03:31:27 -07:00 by westfarn · 0 comments
westfarn commented 2026-10-23 03:31:27 -07:00
Owner
Copy link
Copy source

Part of #1.

Web routes:

  • /password_reset/ request form
  • /password_reset_confirmation/ “check your email”
  • /set_password/?slug= set a new password from the email link (also used by company invites)

Sources: pages/PasswordReset/PasswordReset.tsx, pages/PasswordResetConfirmation/PasswordReset.tsx, components/SetPassword/SetPassword.tsx.

Screenshots

Reset password

Check your email

Phone-width captures. Analytics consent banner dismissed before capture.

  1. Reset request: https://hesychia.ai/password_reset/
  2. Confirmation: https://hesychia.ai/password_reset_confirmation/

The set-password screen is only valid with a real slug and was not captured.

Behavior

Request

  • Email field, required and must look like an email.
  • Invisible reCAPTCHA (size=invisible, dark theme) runs before submit.
  • Success always navigates to the confirmation screen.
  • Failure: “Unable to reset password. Please try again.”
  • Back to Sign In.

Confirmation

  • Title “Check Your Email”.
  • Copy: “If an account exists for that address, we sent a link to set a new password.”
  • No API. Back to Sign In.

Set password

  • Read slug from the query string. Missing or GET failure → Sign in.
  • While checking the link, show a loading state.
  • Two fields, password1 and password2. Rules: match, min length, at least one number, at least one special character.
  • Success → Sign in.

API

Unauthenticated client (web cleanAxiosInstance, no Bearer token).

Call Purpose
POST user/reset_password/ Body { email, recaptchaToken }.
GET user/set_password/{slug}/ Validate the email link.
POST user/set_password/{slug}/ Body { password1, password2 }.

Android

In-app screens or a Custom Tab are both acceptable. reCAPTCHA must run against a key that allows the Android origin; the headless capture hit an invalid-domain badge and that badge is not part of the product UI. Deep-link /set_password/?slug= from the email.

Part of #1. Web routes: - `/password_reset/` request form - `/password_reset_confirmation/` “check your email” - `/set_password/?slug=` set a new password from the email link (also used by company invites) Sources: `pages/PasswordReset/PasswordReset.tsx`, `pages/PasswordResetConfirmation/PasswordReset.tsx`, `components/SetPassword/SetPassword.tsx`. ## Screenshots ![Reset password](https://git.aimloperations.com/attachments/a32f0b30-7649-4262-9cbe-1e8f990468c0) ![Check your email](https://git.aimloperations.com/attachments/96df57da-efd2-4fa9-967a-de686e2860fe) Phone-width captures. Analytics consent banner dismissed before capture. 1. Reset request: https://hesychia.ai/password_reset/ 2. Confirmation: https://hesychia.ai/password_reset_confirmation/ The set-password screen is only valid with a real `slug` and was not captured. ## Behavior **Request** - Email field, required and must look like an email. - Invisible reCAPTCHA (`size=invisible`, dark theme) runs before submit. - Success always navigates to the confirmation screen. - Failure: “Unable to reset password. Please try again.” - Back to Sign In. **Confirmation** - Title “Check Your Email”. - Copy: “If an account exists for that address, we sent a link to set a new password.” - No API. Back to Sign In. **Set password** - Read `slug` from the query string. Missing or `GET` failure → Sign in. - While checking the link, show a loading state. - Two fields, `password1` and `password2`. Rules: match, min length, at least one number, at least one special character. - Success → Sign in. ## API Unauthenticated client (web `cleanAxiosInstance`, no Bearer token). | Call | Purpose | | --- | --- | | `POST user/reset_password/` | Body `{ email, recaptchaToken }`. | | `GET user/set_password/{slug}/` | Validate the email link. | | `POST user/set_password/{slug}/` | Body `{ password1, password2 }`. | ## Android In-app screens or a Custom Tab are both acceptable. reCAPTCHA must run against a key that allows the Android origin; the headless capture hit an invalid-domain badge and that badge is not part of the product UI. Deep-link `/set_password/?slug=` from the email.
password-reset.png
184 KiB
password-reset-confirmation.png
142 KiB
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/chat_android#4