From a user story to Kanban tasks
A simulation of Storico: the story types itself and the tasks come from a prepared catalog. Nothing here calls an LLM or a backend.
As a registered user, I want to reset my password, so that I can get back into my account.
Actor / Role
registered user
Feature / Action
reset my password
Benefit
I can get back into my account
Tasks
No tasks yet. Extract tasks from this user story.
Extracting tasks...
Add a "Forgot password?" link to the sign-in form
Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state.
Create POST /auth/password-reset endpoint
Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts.
Generate single-use reset tokens with a 30-minute expiry
Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one.
Send the reset email through the transactional provider
One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support.
Build the reset form with the password rules
Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link.
Document the reset flow in the API reference
The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists.
No tasks in this workspace yet
Extract tasks from a user story to see them here.
Kanban Board
6 tasksInvalid Move
Backlog
1Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state.
To Do
2Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts.
Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one.
In Progress
1One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support.
Review
1Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link.
Done
1The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists.
Export Tasks
Export all workspace tasks in JSON or Markdown format.
[
{
"id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e10",
"user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
"title": "Add a \"Forgot password?\" link to the sign-in form",
"description": "Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state.",
"status": "backlog",
"priority": "medium",
"labels": [
"ui",
"auth"
],
"dependencies": [],
"created_at": "2026-09-25T14:02:00.000Z",
"updated_at": "2026-09-25T14:02:00.000Z"
},
{
"id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e11",
"user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
"title": "Create POST /auth/password-reset endpoint",
"description": "Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts.",
"status": "todo",
"priority": "high",
"labels": [
"backend",
"api",
"security"
],
"dependencies": [],
"created_at": "2026-09-25T14:02:00.000Z",
"updated_at": "2026-09-25T14:02:00.000Z"
},
{
"id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e12",
"user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
"title": "Generate single-use reset tokens with a 30-minute expiry",
"description": "Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one.",
"status": "todo",
"priority": "high",
"labels": [
"backend",
"security"
],
"dependencies": [
"0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e11"
],
"created_at": "2026-09-25T14:02:00.000Z",
"updated_at": "2026-09-25T14:02:00.000Z"
},
{
"id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e13",
"user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
"title": "Send the reset email through the transactional provider",
"description": "One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support.",
"status": "in_progress",
"priority": "high",
"labels": [
"backend",
"email"
],
"dependencies": [
"0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e12"
],
"created_at": "2026-09-25T14:02:00.000Z",
"updated_at": "2026-09-25T14:02:00.000Z"
},
{
"id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e14",
"user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
"title": "Build the reset form with the password rules",
"description": "Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link.",
"status": "review",
"priority": "medium",
"labels": [
"ui",
"forms"
],
"dependencies": [],
"created_at": "2026-09-25T14:02:00.000Z",
"updated_at": "2026-09-25T14:02:00.000Z"
},
{
"id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e15",
"user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
"title": "Document the reset flow in the API reference",
"description": "The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists.",
"status": "done",
"priority": "low",
"labels": [
"docs"
],
"dependencies": [
"0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e11"
],
"created_at": "2026-09-25T14:02:00.000Z",
"updated_at": "2026-09-25T14:02:00.000Z"
}
]# Tasks Export
## As a registered user, I want to reset my password, so that I can get back into my account.
- **Add a "Forgot password?" link to the sign-in form** — Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state. #ui #auth
- **Create POST /auth/password-reset endpoint** — Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts. #backend #api #security
- **Generate single-use reset tokens with a 30-minute expiry** — Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one. #backend #security → Create POST /auth/password-reset endpoint
- **Send the reset email through the transactional provider** — One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support. #backend #email → Generate single-use reset tokens with a 30-minute expiry
- **Build the reset form with the password rules** — Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link. #ui #forms
- **Document the reset flow in the API reference** — The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists. #docs → Create POST /auth/password-reset endpoint
Task
This is the task the extraction produced. Move it with the status field.
Title
Add a "Forgot password?" link to the sign-in form
Description
Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state.
Labels
Task
This is the task the extraction produced. Move it with the status field.
Title
Create POST /auth/password-reset endpoint
Description
Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts.
Labels
Task
This is the task the extraction produced. Move it with the status field.
Title
Generate single-use reset tokens with a 30-minute expiry
Description
Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one.
Labels
Dependencies
- → Create POST /auth/password-reset endpoint
Task
This is the task the extraction produced. Move it with the status field.
Title
Send the reset email through the transactional provider
Description
One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support.
Labels
Dependencies
- → Generate single-use reset tokens with a 30-minute expiry
Task
This is the task the extraction produced. Move it with the status field.
Title
Build the reset form with the password rules
Description
Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link.
Labels
Task
This is the task the extraction produced. Move it with the status field.
Title
Document the reset flow in the API reference
Description
The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists.
Labels
Dependencies
- → Create POST /auth/password-reset endpoint
Demo data, prepared for this exercise. No request leaves your browser.