Product changelog

Appearance

July 17, 2026 — Frontend ​

Release date: Friday, 2026-07-17

Summary ​

This week adds self-service password recovery to BMS: users can request a reset email from login, open a secure link, set a new password, and sign in again—without auto-login after reset. The portfolio dashboard toolbar also gets a time-of-day greeting helper.

Shipped ​

  • Forgot password — /forgot-password collects email; always shows a neutral success message (no “email not found”); handles validation and rate-limit errors.
  • Reset password — /reset-password?token=… validates the token, strips it from the URL, then lets the user set a new password (match + min length 8); success toast and redirect to login.
  • Login entry — “Forgot password?” link on the sign-in page.
  • Portfolio greeting — time-based greeting helper used by the dashboard toolbar.

Engineering (commit recap) ​

Frontend — week of July 11 – July 17, 2026 ​

Window: after 2026-07-11, before 2026-07-18 (--no-merges).

Summary ​

One primary BMS commit: public password-reset flow (passwordResetApi, forgot/reset pages, routes, login link) plus a small portfolio dashboard greeting utility. Cookie-free publicRequest calls; no OpenAPI contract regen yet for the new auth endpoints.

Themes ​

  • Password recovery API helpers: requestPasswordReset, validatePasswordResetToken, confirmPasswordReset via publicRequest; path constants; Vitest coverage for 204 / 400 / 429.
  • Public auth screens: ForgotPasswordPage and ResetPasswordPage match login chrome; token kept in memory and removed from the address bar before validate/confirm.
  • Routing: /forgot-password and /reset-password registered outside the authenticated App shell.
  • Portfolio greeting: portfolioDashboardGreeting (+ spec) wired into PortfolioDashboardToolbar.

Notable fixes or risks (if any) ​

  • OpenAPI: password-reset paths are not in the pinned contract yet—helpers use path constants until the next contract pull/regen.
  • No auto-login after reset by design; sessions revoked server-side on confirm.
  • Token in URL: stripped after load to reduce referrer/analytics leakage; do not put the raw token in outbound links or telemetry.