EPIC-02 auth shell

Recover access without weakening the record.

Password reset uses a single-use emailed link with a fifteen-minute lifetime. The token is prefilled from that link; local development can expose it only through the explicit loopback-only stub inspector.

Request reset token

The request uses the same-origin proxy, so local flows do not depend on cross-origin form posts.

Confirm reset

Resetting the account password also replaces its encrypted notebook key wrap. The saved phrase is therefore required, but never leaves this browser.

The phrase and derived keys stay in this browser. LeoLog receives only the new password for authentication and an encrypted key wrap.

API target: /api/auth

Local stub inbox

Fetch the local reset delivery by email.

The local stub inbox returns the latest verification and reset tokens only when the API dev inspector is explicitly enabled and the web request itself is served from localhost.