The auth package includes password reset and email verification services and repositories. The mail package exposes helpers for verification and reset messages; the actual user-facing flow must be wired into your application and transport configuration.
Required flow properties#
- Generate unpredictable, short-lived, single-use verification/reset tokens using the package's supported flow.
- Store only the representation intended by the auth package; never log raw tokens or recovery codes.
- Return generic responses when an account may or may not exist to reduce account enumeration.
- Rate-limit token requests and verification attempts.
- Invalidate tokens after successful use and invalidate relevant sessions after password changes.
- Use HTTPS links and a verified sender address in production.
Mail helpers#
The mail package exports sendVerifyEmail(email, code), sendResetPassword(email, code), sendRecoveryCode(email, recoveryCode), and send2FACode(email, code). These helpers build localized plain-text messages and pass them to the configured mailer. They do not by themselves implement a complete recovery route or verify that a token is valid.
Customize delivery#
Configure a production transport and test end-to-end delivery, including expiry, invalid codes, replay, rate limiting, and mail failures. Do not expose raw reset tokens in analytics or logs.
