#815 makes the mail tell the two cases apart: an account with no usable password gets "Set a password" wording, because resetPassword creates the credential account rather than replacing anything. The page that link opens still speaks only one of them.
src/routes/[[lang]]/(auth)/reset-password/+page.svelte renders auth.reset_password.title ("Reset password"), auth.reset_password.description ("Enter your new password"), auth.reset_password.button_submit ("Reset password"), auth.reset_password.button_loading ("Resetting...") and, on success, auth.messages.password_reset_success. A user who followed the set-password mail reads that their password was reset when they had none.
The page cannot currently know which case it is in. It is unauthenticated and holds only the token, so telling the two apart needs an endpoint that reports the password state for a given reset token. That is new unauthenticated surface with its own enumeration and token-probing questions, which is why it is not in #815.
See also: #815
#815 makes the mail tell the two cases apart: an account with no usable password gets "Set a password" wording, because
resetPasswordcreates the credential account rather than replacing anything. The page that link opens still speaks only one of them.src/routes/[[lang]]/(auth)/reset-password/+page.svelterendersauth.reset_password.title("Reset password"),auth.reset_password.description("Enter your new password"),auth.reset_password.button_submit("Reset password"),auth.reset_password.button_loading("Resetting...") and, on success,auth.messages.password_reset_success. A user who followed the set-password mail reads that their password was reset when they had none.The page cannot currently know which case it is in. It is unauthenticated and holds only the token, so telling the two apart needs an endpoint that reports the password state for a given reset token. That is new unauthenticated surface with its own enumeration and token-probing questions, which is why it is not in #815.
See also: #815