ebbe.bass/ping-mee-self-service-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add e-mail change with confirmation and undo

Browse Source 
Page at /email asks for the new address and the current password (shared failure counter with the password page, five requests per hour) and mails a one-hour confirmation link to the new address. Confirming writes the address and mails the old address a 24-hour undo link; undoing restores it, ends every session of the user and notifies the Admin (ADMIN_NOTIFY_EMAIL). Link pages show on GET and apply on POST; tokens are stored only as hashes, single use, and are blanked from every log line. New table owned by profile, German text, tests; review findings logged in the plan.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm
This commit is contained in:
Ebbe Baß
2026-10-19 10:05:41 +02:00
co-authored by Claude Sonnet 5.5
parent 3fd8f27127
commit 94c1d39c9d
35 changed files with 1792 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+4
View File
@@ -50,6 +50,10 @@ SMTP_USERNAME=
SMTP_PASSWORD=
MAIL_FROM=
# Optional. E-mail address of the Admin who is told when a user undoes an e-mail change.
# Empty: no notice is sent and an error is logged at each undo.
# ADMIN_NOTIFY_EMAIL=
# Optional. Directory for the database. Default /data (the container volume).
# DATA_DIR=/data