Account and Owner Recovery

Recovery has three layers, from least to most privileged.

1. Password reset

Available to any account. POST /api/v1/public/password-reset/request emails a single-use link valid for one hour. It needs email configured; without it the request succeeds but the link is only logged.

2. Recovery codes

For “forgot my password and lost my email.” The Owner generates ten single-use codes ahead of time (Profile → Security, with the password re-entered), stores them safely, and can redeem one at POST /api/v1/public/recovery/redeem. Codes are shown once and stored only as hashes.

3. Owner recovery

For an Owner with neither password nor recovery code. Two independent mechanisms operate directly on the database, not through normal sign-in.

CLI (preferred)

For when you have Cloudflare access through Wrangler:

pnpm --filter @kenresoft-cms/api recover-owner:remote

Use recover-owner:local for local development. It looks up the Owner through wrangler d1 execute, prompts for a new password interactively (never as an argument, so it stays out of shell history) and signs that account out everywhere. Pass --email if there is more than one Owner. It needs no standing secret.

Break-glass endpoint

POST /api/v1/system/recover-owner with { "secret", "email", "newPassword" }.

• Disabled by default. It returns 404, indistinguishable from a route that does not exist, until you set the secret: wrangler secret put OWNER_RECOVERY_SECRET.
• With the secret set, a wrong secret returns 403. It is rate limited (3 per 60 seconds), and the secret comparison is constant-time.
• On success it replaces the Owner’s password, deletes all of that account’s sessions, and records owner.recovered in the audit log.

Danger

While OWNER_RECOVERY_SECRET is set, it is a standing master key. It bypasses the account entirely: no session and no re-authentication, so whoever holds it can reset the Owner’s password. It is not a normal sign-in or recovery flow.

Set it only when needed and remove it afterwards: wrangler secret delete OWNER_RECOVERY_SECRET. If you keep it set, rotate it like any credential and watch the audit log for owner.recovered.

Kenresoft holds no secret or back door into any deployment. Every recovery path exists only inside your own deployment.