[
  {
    "id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e10",
    "user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
    "title": "Add a \"Forgot password?\" link to the sign-in form",
    "description": "Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state.",
    "status": "backlog",
    "priority": "medium",
    "labels": [
      "ui",
      "auth"
    ],
    "dependencies": [],
    "created_at": "2026-09-25T14:02:00.000Z",
    "updated_at": "2026-09-25T14:02:00.000Z"
  },
  {
    "id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e11",
    "user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
    "title": "Create POST /auth/password-reset endpoint",
    "description": "Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts.",
    "status": "todo",
    "priority": "high",
    "labels": [
      "backend",
      "api",
      "security"
    ],
    "dependencies": [],
    "created_at": "2026-09-25T14:02:00.000Z",
    "updated_at": "2026-09-25T14:02:00.000Z"
  },
  {
    "id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e12",
    "user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
    "title": "Generate single-use reset tokens with a 30-minute expiry",
    "description": "Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one.",
    "status": "todo",
    "priority": "high",
    "labels": [
      "backend",
      "security"
    ],
    "dependencies": [
      "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e11"
    ],
    "created_at": "2026-09-25T14:02:00.000Z",
    "updated_at": "2026-09-25T14:02:00.000Z"
  },
  {
    "id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e13",
    "user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
    "title": "Send the reset email through the transactional provider",
    "description": "One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support.",
    "status": "in_progress",
    "priority": "high",
    "labels": [
      "backend",
      "email"
    ],
    "dependencies": [
      "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e12"
    ],
    "created_at": "2026-09-25T14:02:00.000Z",
    "updated_at": "2026-09-25T14:02:00.000Z"
  },
  {
    "id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e14",
    "user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
    "title": "Build the reset form with the password rules",
    "description": "Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link.",
    "status": "review",
    "priority": "medium",
    "labels": [
      "ui",
      "forms"
    ],
    "dependencies": [],
    "created_at": "2026-09-25T14:02:00.000Z",
    "updated_at": "2026-09-25T14:02:00.000Z"
  },
  {
    "id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e15",
    "user_story_id": "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e04",
    "title": "Document the reset flow in the API reference",
    "description": "The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists.",
    "status": "done",
    "priority": "low",
    "labels": [
      "docs"
    ],
    "dependencies": [
      "0193a1f2-6c7d-7b3e-9a41-2f8b7c5d1e11"
    ],
    "created_at": "2026-09-25T14:02:00.000Z",
    "updated_at": "2026-09-25T14:02:00.000Z"
  }
]

# Tasks Export

## As a registered user, I want to reset my password, so that I can get back into my account.

- **Add a "Forgot password?" link to the sign-in form** — Place the link under the password field and route it to the reset request page. Keep it out of the tab order when the form is in its error state. #ui #auth
- **Create POST /auth/password-reset endpoint** — Accept an email, answer 202 and queue the work. Answer the same body whether or not the email exists, so the endpoint cannot be used to enumerate accounts. #backend #api #security
- **Generate single-use reset tokens with a 30-minute expiry** — Store only the token hash. A token is consumed on first use, and requesting a new one invalidates the previous one. #backend #security → Create POST /auth/password-reset endpoint
- **Send the reset email through the transactional provider** — One template with the reset link, plus a plain-text fallback. Log the provider message id next to the request id for support. #backend #email → Generate single-use reset tokens with a 30-minute expiry
- **Build the reset form with the password rules** — Two fields with a live match check, the same rules the sign-up form enforces, and an expired-token state that offers to send a new link. #ui #forms
- **Document the reset flow in the API reference** — The endpoint, its 202 response and the token lifetime, with a note on why the response does not reveal whether the account exists. #docs → Create POST /auth/password-reset endpoint