Add password reset through email

[hexpm]

Add password reset through email

[jcspencer]

Like in #21, we can simply generate a string reset_token and a date reset_last_requested. When it comes to the email itself, we can simply send a link to, for example, /reset/:token that will only work for, say, 30 minutes after reset_last_requested.

It would also be required that all current sessions are invalidated and that the user must log in with the new password after the reset, for security purposes.

[josevalim]

It would also be required that all current sessions are invalidated and that the user must log in with the new password after the reset, for security purposes.

Very good point. A common practice is to store the password salt in the session and compare it with the one in the database on every fetch. If the salt in the session differs from the DB, the session is invalid.

[jcspencer]

@josevalim 👍 This sounds like it would work nicely!

[ericmj]

We don't have sessions today so that won't be an issue.

I would also like to add the option to invalidate all the users API keys after the password has been reset.

[jcspencer]

Would this delete the key entirely, or set a flag on the key row?

[ericmj]

Just delete it.

[jcspencer]

Assigning myself to this one, working on it this weekend.