feat: Add forgot password page

[ZeroWave022]

Users can now reset their password, assuming they provide the correct email and OTP code that is sent to that email.

[michaelbrusegard]

Important thing for security. You must not inform when the Email is invalid to the person who enters the email in forgot password as it can be used to find out which emails are registered on the website. Also remember extra rate limiting if it is not already done

[ZeroWave022]

Hey @michaelbrusegard

If someone enters an email that doesn't have a user attached to it, no forgot password request will be made. The user gets sent to the page to write in a OTP code, but no code will ever be valid. See here - the code you get doesn't exist in the db. Therefore this will always fail with the "incorrect code" error, no matter what you type in.

Rate limiting is not implemented. In the auth router, I see you use the RefillingTokenBucket, Throttler and ExpiringTokenBucket classes. There's also some util functions in src/server/api/rate-limit/index.ts. Could you explain the purpose of these classes/utils or otherwise document them?

[michaelbrusegard]

I can explain it when I come visit Trondheim or on a call after work?

[ZeroWave022]

Yeah, I'll send you a message in the evening :)

[seandreassen]

I don't have the correct env variables for email or matrix, so I'll just assume they work. If emails aren't sent or the matrix password isn't updated, this should also be fixed.

[ZeroWave022]

I have sent you some more info on Matrix if you'd like to test this PR more in regards to email sending and such

[seandreassen]

I have also tested the emails now, and they do work.