Contract-freeze · UX approval

Password Reset & Change — Approval Frames

Three flows: self-service reset for a locked-out person (request → the same "check your email" either way → token link → new password → done), signed-in change password, and set a password for a Google-only account that never had one. The "email sent" screen is a deliberate security property — it returns the same 202 whether or not the address has an account, so it never reveals who has an account. Rendered in fuse-seam tokens; no identity-vendor name ever appears.

Reset flow (unauthenticated)

route /reset → /reset/sent → /reset/confirm?token=… → /reset/done

Step 1 · /reset

Request a reset

Enter your email. Submitting always continues — no hint whether the account exists.

Step 2 · /reset/sent · 202

Check your email

Unconditional confirmation. Identical response either way (no enumeration).

Step 3 · /reset/confirm

Set a new password

From the emailed link. New password + strength. Valid-token happy path.

Step 4 · /reset/done

Password updated

Done. Sign in with the new password. Other sessions signed out.

Signed-in (change / set)

route /account/security/password

Signed-in · change & set

Change / set password

Change an existing password, or set a first one on a Google-only account (hasPassword:false).

States · fail-closed

States & errors

Submitting, expired/invalid token, password-policy rejection, and generic failure.

Build inventory — approving each flow approves its slice of this plan

Flows (per-flow approval)

resetPasswordResetFlow · /reset · approved: false

change-passwordChangePasswordFlow · /account/security/password · approved: false

set-passwordSetPasswordFlow · /account/security/password (social-only) · approved: false

React components

ResetRequestFormResetSentNotice NewPasswordFormPasswordStrengthMeter TokenInvalidNoticeResetDoneNotice ChangePasswordFormSetPasswordForm PasswordPolicyHints

npm packages

@fuzefront/account-security-ui

Design-system note

Composed from @fuzefront/design-system (fuse-seam) tokens only. Two primitives are not yet in the base and are named for frontend-engineer to add as a foundation PR: PasswordStrengthMeter (segmented strength bar + policy hints) and the shared StatusCallout (also named by the account-security frames). Drawn here from tokens only, never one-offed into feature code.

● Awaiting approval

Design system: @fuzefront/design-system (fuse-seam) · Contract: packages/security/openapi.yaml → @fuzefront/security-client · Endpoints: POST /v1/security/session/password/reset-request (202), POST /v1/security/session/password/reset-confirm, POST /v1/security/password (set).
Approve per flow by setting approved: true (+ approver + date) in manifest.json, or reply @claude approve / @claude reject: <reason>.