Method RequestPasswordReset

backend/api/v1/auth_service.go:1500–1521

RequestPasswordReset sends a password reset email. Always returns success to avoid leaking email existence.

(ctx context.Context, req *connect.Request[v1pb.RequestPasswordResetRequest])

// RequestPasswordReset sends a password reset email. Always returns success to avoid leaking email existence.
func (s *AuthService) RequestPasswordReset(ctx context.Context, req *connect.Request[v1pb.RequestPasswordResetRequest]) (*connect.Response[emptypb.Empty], error) {
	email := strings.ToLower(strings.TrimSpace(req.Msg.Email))
	if email == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("email is required"))
	}

	// Send synchronously, but swallow errors to avoid email enumeration — a fast silent
	// "success" for unknown emails must be indistinguishable from an SMTP failure for
	// known ones. Errors are logged server-side for operator visibility.
	if err := s.sendEmailVerificationCode(
		ctx,
		req.Msg.Workspace,
		email,
		storepb.EmailVerificationCodePurpose_PASSWORD_RESET,
		"[Bytebase] Reset your password",
		"Hi,\n\nYour password reset code is: %s\n\nThis code expires in %d minutes. If you didn't request this, you can safely ignore this email.\n\n— Bytebase",
	); err != nil {
		slog.Warn("failed to send password reset email", slog.String("to", email), log.BBError(err))
	}

	return connect.NewResponse(&emptypb.Empty{}), nil
}

// ResetPassword verifies the 6-digit code and updates the user's password.
// Also revokes all refresh tokens to force re-login.