feat: add password recovery to both consoles

[victor-ferro]

What has been added

The forgot-password and reset-password screens for the partners and the customer console, both built on the AuthPageLayout from the previous PR.

ForgotPasswordView takes an email and always shows the same confirmation, whether or not the account exists. ResetPasswordView reads the token from the query string, validates the new password against the platform policy as you type, asks for confirmation, and shows a dedicated screen when the link has expired or was already used.

A captcha.service obtains a reCAPTCHA v3 token and sends it in the x-internxt-captcha header. validatePassword moves to a shared passwordPolicy module, which the change-password modal now reuses instead of its own copy.

Why

The password rules were written twice, once in the modal and once here, and the two would drift. The confirmation copy is deliberately identical in both outcomes so the screen cannot be used to find out which emails are registered.

Notes

• the site key comes from VITE_RECAPTCHA_V3_SITE_KEY. Without it the service sends no header, which is what keeps local development working, since the server skips reCAPTCHA outside production
• if the reCAPTCHA script fails to load, typically an ad blocker, the form says so instead of failing silently
• the screens follow the existing login design; there is no approved design for them yet
• the Gherkin scenarios live in the sub-account README and cover both consoles

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	object-storage-management-web	73effaa	Commit Preview URL Branch Preview URL	Aug 14 2026, 10:22 AM

[cloudflare-workers-and-pages]

Deploying object-storage-web with    Cloudflare Pages

Latest commit:	73effaa
Status:	✅  Deploy successful!
Preview URL:	https://d1a73061.object-storage-web.pages.dev
Branch Preview URL:	https://feat-pb-6703-password-recove.object-storage-web.pages.dev

View logs

[victor-ferro]

Switched from reCAPTCHA v3 to Cloudflare Turnstile

Frontend half of the change in internxt/object-storage-server#112. Two commits: the provider swap (1cb659c) and a follow-up on the missing-key path (73effaa).

• captcha.service.ts now uses Turnstile's explicit rendering: it creates its own container, renders the widget with execution: 'execute' and appearance: 'interaction-only', resolves through the callback, and cleans up on every path. getHeaders(action) keeps its signature, so partners-auth.service.ts and sub-account-auth.service.ts are untouched.
• The widget is invisible in the normal case. It only becomes visible if Cloudflare decides it needs to ask the user something, which is why the container is fixed and centred.
• The action is passed when requesting the token; the backend verifies it echoes back as ForgotPassword.
• .grecaptcha-badge { visibility: hidden } is gone from index.css — there is no badge to hide any more.
• A missing site key now throws instead of silently sending no header, which would have surfaced as an opaque 403 from the backend (73effaa).

Deployment

VITE_RECAPTCHA_V3_SITE_KEY → VITE_TURNSTILE_SITE_KEY. It has to be set where npm run build runs, not in the Worker's runtime variables: Vite inlines it into the bundle at build time. Its pair TURNSTILE_SECRET goes on the backend.

Note the previous reCAPTCHA site key was Drive's own key, which is no longer the case: Turnstile uses a widget that already covers cloud.internxt.com, os.partners.internxt.com and localhost.

Verified from localhost against the real widget

Genuine single-use tokens are issued, the x-internxt-captcha header reaches the backend and siteverify is called. Rejections return 403 and the view shows the error. The success path still needs the real TURNSTILE_SECRET.