Password reset

[timwis]

Hey Max, this looks like it will be handy for folks using leveldb. I recently had to implement "forgot password" functionality from scratch in couchdb for enviar and it felt like reinventing the wheel. So I started to isolate the password reset functionality in hopes of making it a library that others could import so they wouldn't have to do what I did.

I got hung up on the API: I tried to modify it from the enviar implementation to make it unopinionated about what type of server, and also tried to make it more easily testable, but struggled a bit to find the right balance, and ultimately moved on to another project.

In the off chance that it's remotely relevant to this project, I pushed it up to couchdb-password-reset. If nothing else, I hope the whole "don't tell them no user was found" approach is helpful (recommended by this article).

Anyway good luck with the project.

[max-mapper]

@timwis hey just noticed this issue, sorry. very helpful feedback! I wanna implement this flow soon in this module, but if I dont get to it before someone else does I'm labelling it 'help wanted'

@sethvincent used require('postmark') to send emails, so whoever implements this should do that as well, check out the https://github.com/staticland/staticland-api for their implementation

also +1 on that privacy recommendation.

checklist:

• add reset pw flow tests
• figure out how to test postmark module (stubbing i guess, integration email tests seem overkill)
• ensure 'dont tell user their account wasnt found'
• implement reset pw link cache db
• implement reset pw rest route handler

[sethvincent]

I've started work on the password reset flow as I need it for staticland. There's now a township-email module which can act as a collection of default email templates and helper functions for sending email. Next I'll work through that checklist.