RenewCMS/docs/design/screens/forgot-password.md

Forgot password

• Route: /register/reset/request
• API: POST /v1/auth/password-reset
• Visual reference: source/RenewCMS Screens Auth.dc.html, group "Forgot password" (open it in a browser; each state is drawn at desktop and mobile, with a light/dark toggle).

The sent state reads the same whether or not the email exists, so the page doesn't reveal which emails have accounts.

States

Default

Trigger: From "Forgot password?" on log in.

• Heading: Reset your password
• Description: "Enter the email for your account and we'll send you a link to choose a new password."
• Field Email: placeholder "you@example.com"
• Submit button: "Send reset link"
• Below the card: [Back to log in]

Validation error

Trigger: Invalid email on submit. Nothing is sent.

• Heading: Reset your password
• Description: "Enter the email for your account and we'll send you a link to choose a new password."
• Field Email: placeholder "you@example.com"; value "marta@renew"; error "Enter a full email address, like name@example.com."
• Submit button: "Send reset link"
• Below the card: [Back to log in]

Submitting

Trigger: Request in flight.

• Heading: Reset your password
• Description: "Enter the email for your account and we'll send you a link to choose a new password."
• Field Email: placeholder "you@example.com"; value "marta@renew.example"
• Submit button: "Sending…", loading
• Below the card: [Back to log in]

Sent

Trigger: Any 200, whether or not the account exists.

• ResultPanel (success, mail-check): Check your email; text "If an account exists for that email, a password reset link has been sent."; note "The link expires in 1 hour."; actions "Back to log in" (secondary)

Too many attempts (429)

Trigger: Rate limit with Retry-After.

• Relied on an API marked pending in the design; that API now exists.
• Alert (info, timer): Too many requests "Wait a moment before asking for another link."
• Heading: Reset your password
• Description: "Enter the email for your account and we'll send you a link to choose a new password."
• Field Email: placeholder "you@example.com"; value "marta@renew.example"
• Submit button: "Try again in 0:58", disabled
• Below the card: [Back to log in]

Server error

Trigger: 500 or no response.

• Alert (error, circle-x): Couldn't send the link "Check your connection and try again."
• Heading: Reset your password
• Description: "Enter the email for your account and we'll send you a link to choose a new password."
• Field Email: placeholder "you@example.com"; value "marta@renew.example"
• Submit button: "Send reset link"
• Below the card: [Back to log in]