arch-atlas

Reset Password Use Case

domain/usecases

domain

Overview

Triggers a password-reset email for the given address. Does not log the user in — the reset itself happens via a deep link from the email.

User Flow

  1. Controller builds ResetParams(email).
  2. Use case validates email format.
  3. Repository.resetPassword(email) → POST /auth/reset.
  4. Backend always returns 200 (anti-enumeration) — surface a neutral confirmation either way.

Cases & Edge Cases

  • Unknown email — UI never reveals it; show 'If an account exists, an email was sent.'
  • Rate-limit (HTTP 429) → Left(AuthFailure.rateLimited).

Code References

  • lib/features/auth/domain/usecases/reset_password_usecase.dart

API Calls

Empty — fill this in later. Open the manifest and add content here.

Notes

Privacy: do not differentiate 'unknown email' from 'success' in the UI — that's how account-enumeration attacks work.