2 Commits (v0.9.55)

Author	SHA1	Message	Date
boban	217189598b	fix(security): constant-time password-reset (flatten account-enumeration timing) ... Queues the reset-link notification so sendResetLink returns in constant time regardless of account existence; resetPassword does equivalent dummy verify work for unknown/no-2FA users. Closes the timing side-channels flagged on the forgot-password review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 19:16:30 +02:00
boban	abaed12b0b	feat(auth): email reset-link path (gated on a configured mailer) ... ForgotPassword gains sendResetLink() + a ResetPassword component at /reset-password/{token} using Laravel's password broker. The email option is shown only when mail.default is a real mailer (hidden while MAIL_MAILER=log), so it activates automatically once SMTP is configured. Tested with Notification::fake. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 16:57:05 +02:00