feat(auth): resend code for password reset

[FlyM1ss]

Adds a Resend code button to the password-reset modal.

Policy: 60 s between codes; one send + five resends per hour per address; then wait an hour; twelve a day. All three limits are visible (429 + Retry-After, counted down on the button), not silent skips.

Round 2 (f045576c) addresses the 15 findings of the 2026-09-03 review — see the comment below.

Backend (api/auth.py, users.py)

• New existence-blind AUTH_FORGOT_COOLDOWN (1 / 60 s) and AUTH_FORGOT_DAILY (12 / day) limiters. Gate order: the 503 first; daily/hourly/cooldown check()ed longest window first (a double refusal carries the longer wait); the client budget charged only after the address gates; caps allow()ed and cooldown record()ed only on accept — a refused click or a 503 spends nothing. Every 429 carries X-RateLimit-Scope: address|client (CORS-exposed). Hourly default reads RESET_CODE_MAX_REQUESTS_PER_HOUR (6); global send budget 30/h + 240/day.
• 200 body carries resend_after_seconds (config-shaped; the enumeration-blind test still compares bodies byte-for-byte).
• Durable backstops sit inside the visible gates by a 20 s skew (cooldown 40 s, hourly 1h−20s, daily 1d−20s). The row is stamped with the request's arrival time (requested_at, both store twins), so store or send latency can never push its window behind the gate's — no send deadline. One store read serves all three durable checks. Daily cap 5 → 12 so "wait an hour" is true. A startup WARNING names any AUTH_FORGOT_* override that sets a gate looser than its backstop.

Frontend (app.js, app.html, styles.css)

• Countdown from the server's number, and from Retry-After on a 429 (now surfaced by AuthAPI.request). Seconds under a minute, minutes under an hour, hours above — nearest unit.
• The address stage 1 submitted is locked in the field and used for resend and the final submit (closes the "editable stage-2 email" post-merge finding).
• A stage-1 resubmit refused on the address (reload, second tab, deep link) still opens the code step — the code already mailed is valid. A client-scoped 429 stays a plain error.
• A generation counter drops responses that land after "Back to sign in", so a slow reset request cannot lock the login email field. The email-change form gets the same guard, with Cancel disabled while a submit is in flight.

Tests: 18 new backend cases (existence-blind cooldown 429, gate ordering in every direction on an injected clock, arrival stamping, 503 spends nothing, visible daily cap, scope header, global daily budget, single store read, policy-coherence warning, defaults pin), a store-twin case, 9 source-shape guards, node-executed countdown tests incl. a monotonicity sweep. Cache-bust guards bumped to app.js?v=127. Full suite green (3997 passed); modal flow verified live in Playwright.

Rename: PASSWORD_RESET_* → RESET_CODE_* (five constants, both store twins, no behaviour change) — CodeQL classifies a clear-text-logging source by identifier name, and the new startup lines print these counts.

Docs: docs/source/lab/accounts.rst resend bullet updated in its own commit (2b14bd18, sphinx -n -E clean); spec amended in-tree; CLAUDE.md documents the AUTH_FORGOT_* knobs.

Related, not fixed here: the first prod reset attempt (2026-09-02 14:49 UTC) failed at the provider — Brevo answered 403 "SMTP account is not yet activated". That is an activation step on the Brevo account, not code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Tkaai4sur2oxnXd82EtrFm

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agentic-trading-lab	Ready	Preview	Sep 3, 2026 8:23am UTC

[FlyM1ss]

Round 2 (f045576c + 2b14bd18): the 15 findings from today's review, all addressed.

Correctness

• Global send budget 10/h could be exhausted by two honest users → 30/h + 240/day (AUTH_FORGOT_GLOBAL_DAILY).
• asyncio.wait_for could cancel a send Brevo had already accepted → deadline removed; the row is stamped with the request's arrival (requested_at, both twins), so send/store latency no longer matters to the windows.
• 20 s skew did not cover the un-deadlined store hops → moot under arrival stamping; the residual skew covers clock disagreement only.
• Any stage-1 429 opened the code step → 429s carry X-RateLimit-Scope; the step opens only on address.
• Cooldown checked before hourly (Retry-After 30 then 3239) → gates checked longest window first.
• Hourly allow() recorded before the 503 → 503 decided first; nothing charged on a refusal or an outage.
• Daily 12 had no visible gate → AUTH_FORGOT_DAILY limiter, durable twin skewed like the hourly.

Reuse / efficiency / cleanup

• Deadline at one of three send sites + duplicated 10.0 → gone with the deadline.
• initEmailChangeForm lacked the generation guard → added; Cancel disabled while a submit is in flight.
• Cooldown checked after the client budget was charged → client budget charged after the address gates.
• Cooldown/hourly/daily were three store reads → one read over the skewed day.
• Countdown label "2 min" → "60s" jump → nearest-unit rounding, hours above an hour.
• accounts.rst stale → updated in its own commit.
• _hourly_window_start duplicate → _window_start(window, at=…).
• resetStage derivable from resetEmail → removed.

Not touched (pre-existing, outside this PR): advance_email_change updates by id without checking cancelled_at, the server half of the email-change race.