Forgot Password -> "Email reset link" could return a raw HTTP 500 instead of
sending the email / showing success (#5706). When SMTP is unconfigured (no
MAIL_URL / MAIL_FROM, or a bad mail server), Meteor's Email.sendAsync throws and
the exception propagated unhandled out of the forgotPassword method as an opaque
500.
Harden the reset-password / verify-email / enroll-account email-template builders
so they never throw (guarded user name/language lookups, safe fallback if
translation throws), and wrap Accounts.sendResetPasswordEmail so a send failure
surfaces as a clean Meteor.Error('email-fail', ...) instead of a 500. Logic
extracted to server/lib/resetPasswordEmail.js with positive + negative unit tests
in tests/unit/resetPasswordEmail.test.js (wired into the test:unit:node script).
Note: this makes the failure graceful; receiving reset emails still requires SMTP
to be configured.
Closes#5706
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Self-contained Node + assert test for oauth2AdminStatusFromGroups in
packages/wekan-oidc/loginHandler.js, covering unset/empty env, matching and
non-matching groups, comma+space parsing, object groups, and non-array input.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lauri OjansivuandClaude Opus 4.8