fix for security bug

internal/app/account/service.go

@@ -411,13 +411,47 @@ func (s *Service) RequestPasswordRecovery(ctx context.Context, userID int64) (st
 	if !settings.HasPassword || settings.RecoveryEmail == "" {
 		return "", domain.ErrPasswordRecoveryNA
 	}
-	settings.RecoveryCode = recoveryCode
-	settings.RecoveryCodeExpiresAt = time.Now().Unix() + recoveryCodeTTL
+	// A fixed recovery code was used here regardless of whether it was
+	// actually emailed anywhere, which let anyone reset 2FA on any account
+	// with a recovery email set. Recovery now requires a real sender and a
+	// freshly generated code delivered to it -- no sender, no recovery.
+	if s.loginEmailSender == nil {
+		return "", domain.ErrPasswordRecoveryNA
+	}
+	code, err := randomDigits(s.loginEmailCodeLength)
+	if err != nil {
+		return "", err
+	}
+	deliveryID, err := otpdelivery.NewDeliveryID()
+	if err != nil {
+		return "", err
+	}
+	expiresAtUnix := time.Now().Unix() + recoveryCodeTTL
+	expiresAt := time.Unix(expiresAtUnix, 0)
+	settings.RecoveryCode = code
+	settings.RecoveryCodeExpiresAt = expiresAtUnix
 	if s.passwords != nil {
 		if err := s.passwords.Save(ctx, userID, settings); err != nil {
 			return "", err
 		}
 	}
+	if err := deliverOTP(ctx, s.loginEmailSender, otpdelivery.Request{
+		DeliveryID: deliveryID,
+		Purpose:    otpdelivery.PurposePasswordRecovery,
+		Channel:    otpdelivery.ChannelEmail,
+		Recipient:  settings.RecoveryEmail,
+		Code:       code,
+		ExpiresAt:  expiresAt,
+	}); err != nil {
+		if s.passwords != nil {
+			cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 2*time.Second)
+			defer cancel()
+			settings.RecoveryCode = ""
+			settings.RecoveryCodeExpiresAt = 0
+			_ = s.passwords.Save(cleanupCtx, userID, settings)
+		}
+		return "", err
+	}
 	return emailPattern(settings.RecoveryEmail), nil
 }
 
@@ -535,10 +569,9 @@ func (s *Service) CancelPasswordEmail(ctx context.Context, userID int64) error {
 }
 
 func checkRecoveryCode(settings domain.PasswordSettings, code string) error {
+	// No standing fixed-code fallback: an unrequested (or already consumed)
+	// recovery must not be satisfiable by any code at all.
 	if settings.RecoveryCode == "" {
-		if code == recoveryCode {
-			return nil
-		}
 		return domain.ErrPasswordRecoveryNA
 	}
 	if settings.RecoveryCodeExpiresAt > 0 && time.Now().Unix() > settings.RecoveryCodeExpiresAt {

internal/app/account/service_test.go

@@ -69,7 +69,9 @@ func TestPasswordSRPRoundTrip(t *testing.T) {
 func TestRecoverPasswordClearsTwoFactorPassword(t *testing.T) {
 	ctx := context.Background()
 	const userID int64 = 1002
-	svc := NewService(memory.NewPasswordStore())
+	sender := &captureMailSender{}
+	svc := NewService(memory.NewPasswordStore(),
+		WithLoginEmailVerification(memory.NewCodeStore(), sender, time.Minute, 3, 6))
 
 	initial, err := svc.GetPassword(ctx, userID)
 	if err != nil {
@@ -93,7 +95,10 @@ func TestRecoverPasswordClearsTwoFactorPassword(t *testing.T) {
 	if pattern != "b***b@example.com" {
 		t.Fatalf("recovery pattern = %q, want masked email", pattern)
 	}
-	if err := svc.RecoverPassword(ctx, userID, recoveryCode, nil); err != nil {
+	if sender.to != "bob@example.com" || sender.code == "" {
+		t.Fatalf("sender = %+v, want delivered code to bob@example.com", sender)
+	}
+	if err := svc.RecoverPassword(ctx, userID, sender.code, nil); err != nil {
 		t.Fatalf("RecoverPassword clear: %v", err)
 	}
 	cleared, err := svc.GetPassword(ctx, userID)

internal/app/account/srp.go

@@ -12,7 +12,6 @@ import (
 
 const (
 	passwordHashSize = 256
-	recoveryCode     = "12345"
 	recoveryCodeTTL  = 15 * 60
 )