fad2c8792c5d72dcc3f8f0520456e9fe9cd75da1
Map PUT /auth/reset-password and PUT /auth/recovery-password failures into LegacyRecoverPasswordErrorEvent. Reset-password now treats 404 (email not found) as success and surfaces a generic sent-if-exists flow, closing an account enumeration vector. Recovery-password differentiates 401 (tokenExpired), 404 (tokenNotFound), 403+Property (invalidField) from 403 without Property (weakPassword). The view state splits validation vs API errors with a displayErrorKey extension for the inline error text.
SF-APP-PLATFORM
Description
Languages
Dart
95.9%
CMake
2.1%
C++
1.3%
HTML
0.3%
C
0.2%
Other
0.2%