# Reset password

Route: `/register/reset/validate?c=CODE&email=EMAIL`. API: POST /v1/auth/password-reset/confirm.

Opened from the reset email. The email comes from the URL and is read-only. The confirm field is checked only in the browser.

Visual reference: `RenewCMS Screens Auth.dc.html`, groups "Reset password". Frames: `AppFrame.dc.html` (shell, sidebar, topbar, drawer) plus the screen frame where listed in components.md.

## Copy per state (generated from the board source, pass 2)

Every state below is drawn in light and dark (theme switch on the board), at 1440×900 and 390×844 (both frames sit side by side). Board: `RenewCMS Screens Auth.dc.html`. Copy is exact; where a cell is empty the state reuses the fixed copy.

### Base copy
- Choose a new password
- Pick something you haven't used here before. You'll log in with it next.
- Change password

### Choose a new password (group "Reset password", 7 states)

Route: `/register/reset/validate?c=CODE&email=EMAIL`. API: POST /v1/auth/password-reset/confirm.

Opened from the reset email. The email comes from the URL and is read-only. The confirm field is checked only in the browser.

| # | State | Trigger | Copy |
|---|---|---|---|
| 1 | Default | Both parameters are present. |  |
| 2 | Too short | On submit, with fewer than 8 characters. |  |
| 3 | Mismatch | On blur of the confirm field, or on submit. | "The passwords don't match." |
| 4 | Submitting | Request in flight. | "Changing password…" |
| 5 | Success | 200 → /login?reason=password-changed. | "Password changed" / "Log in with your new password." |
| 6 | Invalid or expired (403) | The code is wrong, used, or older than 1 hour. |  |
| 7 | Missing parameters | The link has no c or no email. No request is made. | "This link is incomplete" / "Part of the reset link is missing. Open it from your email again, or request a new one." / "Request a new link" |