vigiloauth/vigilo

Validating user email after account lockout

Open

#113 opened on Nov 22, 2024

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Go (9 forks)auto 404
good first issuepriority: medium

Repository metrics

Stars
 (100 stars)
PR merge metrics
 (PR metrics pending)

Description

Description

As a system, I want to validate that a user-provided email exists in the database so that I can ensure password reset requests are legitimate.

Acceptance Criteria

  • The system checks if the provided email is associated with an existing account.
  • If the email is not found, the system returns a generic message to avoid exposing account existence.
  • Validation attempts are logged for auditing purposes.

Contributor guide

Research direction
Examine the password reset flow and user repository to understand where email validation should be added. Look for existing account lookup functions and implement the check after lockout.
Tech stack
go
Domain
authenticationauthorizationsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Go
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70