Password reset — one-time link

Click a message, participant, or fragment chip to focus it · a • after a label means that message carries details · ← → move between messages · Ctrl + scroll or pinch to zoom · Esc clears focus · − on a card folds away the services only it uses

1. Account holder to Web App (sync): Requests a reset
2. Web App to Auth Service (sync): Ask for a reset link [HTTPS]
3. Auth Service to Token Store (sync): SET token, ttl 15m [RESP]
4. Auth Service to Email Provider (async): Send reset link [SMTP]
5. Auth Service to Web App (reply): 202 Accepted
6. Account holder to Web App (sync): Opens the emailed link
7. Web App to Auth Service (sync): POST /reset-confirmations [HTTPS]
8. Auth Service to Token Store (sync): GETDEL token [RESP]
9. Auth Service to Auth Service (sync, self-message): Hashes the new password
10. Auth Service to Token Store (async): Revoke every session
11. Auth Service to Web App (reply): 200 OK
12. Web App to Account holder (sync): Signed in with the new password
13. Auth Service to Web App (reply): 410 Gone
14. Web App to Account holder (sync): Asks for a fresh reset