Phase 3+4

web/src/app/AccountApi.js

@@ -6,6 +6,8 @@ import {
   accountEmailVerifyUrl,
   accountEmailPrimaryUrl,
   accountEmailResendUrl,
+  accountPasswordResetRequestUrl,
+  accountPasswordResetUrl,
   accountPasswordUrl,
   accountPhoneUrl,
   accountPhoneVerifyUrl,
@@ -397,6 +399,32 @@ class AccountApi {
     });
   }
 
+  // requestPasswordReset starts the (unauthenticated) reset flow. The identifier is a username or
+  // primary email. The server always responds uniformly, regardless of whether an account matched.
+  async requestPasswordReset(identifier) {
+    const url = accountPasswordResetRequestUrl(config.base_url);
+    console.log(`[AccountApi] Requesting password reset ${url}`);
+    await fetchOrThrow(url, {
+      method: "POST",
+      body: JSON.stringify({
+        identifier,
+      }),
+    });
+  }
+
+  // resetPassword performs the (unauthenticated) reset from the set-new-password landing page.
+  async resetPassword(token, password) {
+    const url = accountPasswordResetUrl(config.base_url);
+    console.log(`[AccountApi] Resetting password ${url}`);
+    await fetchOrThrow(url, {
+      method: "POST",
+      body: JSON.stringify({
+        token,
+        password,
+      }),
+    });
+  }
+
   async deleteEmail(email) {
     const url = accountEmailUrl(config.base_url);
     console.log(`[AccountApi] Deleting email ${url}`);

web/src/app/utils.js

@@ -37,6 +37,8 @@ export const accountEmailUrl = (baseUrl) => `${baseUrl}/v1/account/email`;
 export const accountEmailVerifyUrl = (baseUrl) => `${baseUrl}/v1/account/email/verify`;
 export const accountEmailPrimaryUrl = (baseUrl) => `${baseUrl}/v1/account/email/primary`;
 export const accountEmailResendUrl = (baseUrl) => `${baseUrl}/v1/account/email/resend`;
+export const accountPasswordResetRequestUrl = (baseUrl) => `${baseUrl}/v1/account/password/reset/request`;
+export const accountPasswordResetUrl = (baseUrl) => `${baseUrl}/v1/account/password/reset`;
 
 export const validUrl = (url) => url.match(/^https?:\/\/.+/);