richiexec/amber-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Say why the direct password field is there, accurately

Browse source 
The note justified it with "reset silently fails when somebody types a capital
letter". That stopped being true: both the login form and the reset form on the
site lowercase the address before sending, the app does the same in
normalizeEmail, and all nine stored addresses are lowercase already. A dashboard
that states a fixed bug as current makes the owner distrust a working feature.

What is still true, and is the actually useful thing to know while standing at
this table, is that the endpoint answers "sent" whether or not the address
matched, on purpose, so a failed reset is undiagnosable from the outside.

The second note is today's lesson, which cost an hour: a reset the owner sends
to his own address is delivered by Proton as his own outgoing mail, so it sits
in All Mail and never appears in the inbox. He is the only person this affects,
because he is the only recipient who is also the sender.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude 2026-09-05 19:56:14 +02:00
parent 0fdbd86bad
commit 2d6782780a
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
pb_public/status.html
View file

@ -764,10 +764,13 @@ function viewAdmin(users, tpls){
'<section class="wide"><h2>Účty</h2><table class="accts">' +
"<tr><th>e-mail</th><th>strop</th><th>vznik</th><th>heslo</th></tr>" +
(rows || "<tr><td colspan=4 class='note'>nic</td></tr>") + "</table>" +
'<p class="note">Heslo nastavíš rovnou, bez e-mailu. Reset přes e-mail ' +
"selhává tiše, když si adresu někdo napíše s velkým písmenem, protože " +
"PocketBase hledá účty přesně na znak a stejně vždycky odpoví „odesláno“, " +
"aby přes něj nešlo zjišťovat, které adresy existují.</p>" +
'<p class="note">Heslo nastavíš rovnou, bez e-mailu. Hodí se to, když reset ' +
"nedorazí, protože z odpovědi serveru to stejně nepoznáš: PocketBase odpoví " +
"„odesláno“ i na adresu, ke které žádný účet není, aby přes něj nešlo " +
"zjišťovat, kdo je zaregistrovaný.</p>" +
'<p class="note">Když si reset posíláš na svoji vlastní adresu, hledej ho ve ' +
"Všechna pošta. Odesílatel sedí na stejném Proton účtu, takže se uloží mezi " +
"odeslané a do Doručené se nedostane.</p>" +
'<p class="note">Varianta rozhoduje, jaký build dostane přes automatickou ' +
"aktualizaci. Server ji vybírá podle tohohle příznaku, klient si ji nemůže " +
"vyžádat.</p></section>";