mirror of
https://github.com/langgenius/dify.git
synced 2026-05-28 12:53:23 +08:00
Cherry-pick of #36415. The two-phase token flow (T1 → /validity → T2 with phase="reset" → /resets) was broken because ForgotPasswordValidity type was missing the `token` field, so T2 was discarded and T1 (from URL) was re-sent to /resets. Backend rejects T1 at /resets because it requires phase="reset". Fix: add `token` to the type and use verifyTokenRes.token in handleChangePassword. Adds a test that asserts T2 (validity response token) is submitted, not T1 (URL token). Fixes ENG-423.