agentmail-clone-v1 0.1.0

package/src/server.js

@@ -0,0 +1,79 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Fastify from 'fastify';
+import fastifyFormbody from '@fastify/formbody';
+import fastifyMultipart from '@fastify/multipart';
+import fastifyView from '@fastify/view';
+import fastifyRawBody from 'fastify-raw-body';
+import ejs from 'ejs';
+
+import { config } from './config.js';
+import { pool } from './db.js';
+import { authPlugin } from './lib/auth.js';
+import { apiAuthPlugin } from './lib/api-auth.js';
+import { authRoutes } from './routes/auth.js';
+import { appRoutes } from './routes/app.js';
+import { apiRoutes } from './routes/api.js';
+import { webhookRoutes } from './routes/webhooks.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const fastify = Fastify({
+  logger: true,
+  trustProxy: config.nodeEnv === 'production'
+});
+
+await fastify.register(fastifyFormbody);
+await fastify.register(fastifyMultipart, {
+  attachFieldsToBody: true
+});
+await fastify.register(fastifyRawBody, {
+  field: 'rawBody',
+  global: false,
+  encoding: 'utf8',
+  runFirst: true
+});
+await fastify.register(fastifyView, {
+  engine: { ejs },
+  root: path.join(__dirname, 'views'),
+  includeViewExtension: true
+});
+
+await fastify.register(authPlugin);
+await fastify.register(apiAuthPlugin);
+await fastify.register(authRoutes);
+await fastify.register(appRoutes);
+await fastify.register(apiRoutes);
+await fastify.register(webhookRoutes);
+
+fastify.get('/healthz', async () => ({ ok: true }));
+
+fastify.setErrorHandler((err, req, reply) => {
+  req.log.error({ err }, 'Unhandled error');
+  if (!reply.sent) {
+    reply.code(500).send('Internal Server Error');
+  }
+});
+
+async function start() {
+  try {
+    await fastify.listen({ port: config.port, host: '0.0.0.0' });
+    fastify.log.info(`Server running at ${config.appBaseUrl}`);
+  } catch (err) {
+    fastify.log.error(err);
+    process.exit(1);
+  }
+}
+
+async function shutdown(signal) {
+  fastify.log.info({ signal }, 'Shutting down');
+  await fastify.close();
+  await pool.end();
+  process.exit(0);
+}
+
+process.on('SIGINT', () => shutdown('SIGINT'));
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+
+start();

package/src/views/pages/admin.ejs

@@ -0,0 +1,58 @@
+<%- include('../partials/top', { pageTitle, user, org }) %>
+<%- include('../partials/flash', { flash }) %>
+
+<div class="grid three-col">
+  <div class="card">
+    <h3 style="margin-top:0;">Total Inboxes Created</h3>
+    <p><strong><%= globalMetrics.totalInboxesCreated %></strong></p>
+  </div>
+  <div class="card">
+    <h3 style="margin-top:0;">Total Domains Created</h3>
+    <p><strong><%= globalMetrics.totalDomainsCreated %></strong></p>
+  </div>
+  <div class="card">
+    <h3 style="margin-top:0;">Total API Keys Created</h3>
+    <p><strong><%= globalMetrics.totalApiKeysCreated %></strong></p>
+  </div>
+</div>
+
+<div class="card stack" style="margin-top:16px;">
+  <h2 style="margin:0;">Plan Limits</h2>
+  <p class="muted">Use this to experiment with free and paid limits.</p>
+
+  <% ['free', 'paid'].forEach((planName) => { const limits = planLimits[planName]; %>
+    <div class="card stack" style="padding:12px;">
+      <h3 style="margin:0;text-transform:capitalize;"><%= planName %> plan</h3>
+      <form method="post" action="/app/admin/plan-limits" class="stack" hx-post="/app/admin/plan-limits">
+        <%- include('../partials/csrf-field') %>
+        <input type="hidden" name="plan" value="<%= planName %>" />
+
+        <div class="row">
+          <div>
+            <label>Max inboxes</label>
+            <input name="maxInboxes" type="number" min="0" value="<%= limits.maxInboxes %>" required />
+          </div>
+          <div>
+            <label>Max custom domains</label>
+            <input name="maxCustomDomains" type="number" min="0" value="<%= limits.maxCustomDomains %>" required />
+          </div>
+        </div>
+
+        <div class="row">
+          <div>
+            <label>Max API keys</label>
+            <input name="maxApiKeys" type="number" min="0" value="<%= limits.maxApiKeys %>" required />
+          </div>
+          <div>
+            <label>Monthly outbound email limit</label>
+            <input name="monthlyEmails" type="number" min="0" value="<%= limits.monthlyEmails %>" required />
+          </div>
+        </div>
+
+        <button type="submit" style="max-width:220px;">Save <%= planName %> limits</button>
+      </form>
+    </div>
+  <% }) %>
+</div>
+
+<%- include('../partials/bottom') %>

package/src/views/pages/api-keys.ejs

@@ -0,0 +1,56 @@
+<%- include('../partials/top', { pageTitle, user, org }) %>
+<%- include('../partials/flash', { flash }) %>
+
+<div class="grid two-col">
+  <div class="card stack">
+    <h2 style="margin:0;">Create API Key</h2>
+    <form method="post" action="/app/api-keys" hx-post="/app/api-keys" class="stack">
+        <%- include('../partials/csrf-field') %>
+      <label>Name</label>
+      <input name="name" placeholder="openclaw-agent" required />
+      <label>Scopes (comma-separated)</label>
+      <input name="scopes" placeholder="inboxes:read,inboxes:write,emails:send,domains:read,domains:write,metrics:read" />
+      <button type="submit">Create Key</button>
+    </form>
+    <p class="muted">Use <code>*</code> for full access.</p>
+    <p class="muted">Active keys: <%= activeKeyCount %> / <%= limits.maxApiKeys %></p>
+  </div>
+
+  <div class="card stack">
+    <h2 style="margin:0;">Existing Keys</h2>
+    <% if (!apiKeys.length) { %>
+      <p class="muted">No API keys yet.</p>
+    <% } else { %>
+      <table>
+        <thead><tr><th>Name</th><th>Prefix</th><th>Scopes</th><th>Created</th><th>Status</th><th>Actions</th></tr></thead>
+        <tbody>
+          <% apiKeys.forEach((key) => { %>
+            <tr>
+              <td><%= key.name %></td>
+              <td><code><%= key.key_prefix %>...</code></td>
+              <td><%= (key.scopes || []).join(', ') %></td>
+              <td><%= new Date(key.created_at).toLocaleString() %></td>
+              <td><%= key.revoked_at ? 'revoked' : 'active' %></td>
+              <td>
+                <% if (!key.revoked_at) { %>
+                <div class="inline">
+                  <form method="post" action="/app/api-keys/<%= key.id %>/rotate" hx-post="/app/api-keys/<%= key.id %>/rotate" onsubmit="return confirm('Rotate this API key?')">
+        <%- include('../partials/csrf-field') %>
+                    <button class="secondary" type="submit">Rotate</button>
+                  </form>
+                  <form method="post" action="/app/api-keys/<%= key.id %>/revoke" hx-post="/app/api-keys/<%= key.id %>/revoke" onsubmit="return confirm('Revoke this API key?')">
+        <%- include('../partials/csrf-field') %>
+                    <button class="danger" type="submit">Revoke</button>
+                  </form>
+                </div>
+                <% } %>
+              </td>
+            </tr>
+          <% }) %>
+        </tbody>
+      </table>
+    <% } %>
+  </div>
+</div>
+
+<%- include('../partials/bottom') %>

package/src/views/pages/billing.ejs

@@ -0,0 +1,71 @@
+<%- include('../partials/top', { pageTitle, user, org }) %>
+<%- include('../partials/flash', { flash }) %>
+
+<div class="card stack">
+  <h2 style="margin:0;">Plans</h2>
+  <p class="muted">Simple pricing: free for testing, paid for production usage.</p>
+
+  <table>
+    <thead>
+      <tr>
+        <th>Feature</th>
+        <th>Free</th>
+        <th>Paid</th>
+      </tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td>Price</td>
+        <td>$0 / month</td>
+        <td><strong>$10 / month</strong></td>
+      </tr>
+      <tr>
+        <td>Inboxes</td>
+        <td><%= freeLimits.maxInboxes %></td>
+        <td><%= paidLimits.maxInboxes %></td>
+      </tr>
+      <tr>
+        <td>Custom domains</td>
+        <td><%= freeLimits.maxCustomDomains %></td>
+        <td><%= paidLimits.maxCustomDomains %></td>
+      </tr>
+      <tr>
+        <td>API keys</td>
+        <td><%= freeLimits.maxApiKeys %></td>
+        <td><%= paidLimits.maxApiKeys %></td>
+      </tr>
+      <tr>
+        <td>Monthly outbound emails</td>
+        <td><%= freeLimits.monthlyEmails %></td>
+        <td><%= paidLimits.monthlyEmails %></td>
+      </tr>
+      <tr>
+        <td>Inbox UI, Domains UI, API Keys, Metrics</td>
+        <td>Included</td>
+        <td>Included</td>
+      </tr>
+      <tr>
+        <td>Agent API access</td>
+        <td>Included</td>
+        <td>Included</td>
+      </tr>
+    </tbody>
+  </table>
+</div>
+
+<div class="card stack" style="margin-top:16px;">
+  <h3 style="margin:0;">Upgrade</h3>
+  <% if (org.plan === 'paid') { %>
+    <div class="flash success" style="margin:0;">Your organization is already on the paid plan.</div>
+  <% } else if (!dodoConfigured) { %>
+    <div class="flash error" style="margin:0;">Dodo Payments is not configured. Set server env vars to enable checkout.</div>
+  <% } else { %>
+    <p class="muted">Upgrade now to unlock custom domains and higher limits.</p>
+    <form method="post" action="/app/billing/checkout" hx-post="/app/billing/checkout" style="max-width:280px;">
+        <%- include('../partials/csrf-field') %>
+      <button type="submit">Upgrade to Paid ($10/mo)</button>
+    </form>
+  <% } %>
+</div>
+
+<%- include('../partials/bottom') %>

package/src/views/pages/domains.ejs

@@ -0,0 +1,106 @@
+<%- include('../partials/top', { pageTitle, user, org }) %>
+<%- include('../partials/flash', { flash }) %>
+
+<div class="grid two-col">
+  <div class="card stack">
+    <h2 style="margin:0;">Add Domain</h2>
+    <% if (limits.maxCustomDomains < 1) { %>
+      <div class="flash error">Free plan cannot create custom domains.</div>
+    <% } %>
+    <form method="post" action="/app/domains" hx-post="/app/domains" class="stack">
+        <%- include('../partials/csrf-field') %>
+      <label>Domain Name</label>
+      <input name="name" placeholder="mail.yourcompany.com" required <%= limits.maxCustomDomains < 1 ? 'disabled' : '' %> />
+      <button type="submit" <%= limits.maxCustomDomains < 1 ? 'disabled' : '' %>>Create Domain</button>
+    </form>
+    <div class="muted">Limit: <%= limits.maxCustomDomains %> custom domain(s).</div>
+  </div>
+
+  <div class="card stack">
+    <h2 style="margin:0;">Inbound Forwarding</h2>
+    <p class="muted">After DNS verification, Mailgun routes inbound mail to this endpoint automatically.</p>
+    <div class="inline" style="align-items:flex-start;">
+      <code style="word-break:break-all;"><%= inboundForwardUrl %></code>
+      <button type="button" class="secondary copy-btn" style="width:auto;" data-copy="<%= inboundForwardUrl %>">Copy</button>
+    </div>
+  </div>
+</div>
+
+<div class="card stack" style="margin-top:16px;">
+  <h2 style="margin:0;">Your Domains</h2>
+  <% if (!domains.length) { %>
+    <p class="muted">No custom domains configured.</p>
+  <% } else { %>
+    <% domains.forEach((domain) => { %>
+      <div class="card stack" style="padding:12px;">
+        <div class="inline">
+          <strong><%= domain.name %></strong>
+          <span class="pill">Status: <%= domain.status %></span>
+          <span class="pill">Inbound route: <%= domain.provider_route_id ? 'configured' : 'pending' %></span>
+        </div>
+
+        <div>
+          <strong>DNS records</strong>
+          <% if (!(domain.dns_records_json || []).length) { %>
+            <p class="muted">No DNS records available yet. Click Verify DNS to refresh records.</p>
+          <% } else { %>
+            <table>
+              <thead>
+                <tr><th>Type</th><th>Host</th><th>Value</th><th>Priority</th><th>Copy</th></tr>
+              </thead>
+              <tbody>
+                <% (domain.dns_records_json || []).forEach((record) => { 
+                     const type = record.record_type || record.type || '';
+                     const host = record.name || '';
+                     const value = record.value || record.valid || '';
+                     const priority = record.priority || '';
+                %>
+                  <tr>
+                    <td><%= type %></td>
+                    <td><code><%= host %></code></td>
+                    <td><code style="word-break:break-all;"><%= value %></code></td>
+                    <td><%= priority %></td>
+                    <td>
+                      <button type="button" class="secondary copy-btn" style="width:auto;" data-copy="<%= value %>">Copy</button>
+                    </td>
+                  </tr>
+                <% }) %>
+              </tbody>
+            </table>
+          <% } %>
+        </div>
+
+        <div class="inline">
+          <form method="post" action="/app/domains/<%= domain.id %>/verify" hx-post="/app/domains/<%= domain.id %>/verify">
+        <%- include('../partials/csrf-field') %>
+            <button class="secondary" type="submit">Verify DNS</button>
+          </form>
+          <form method="post" action="/app/domains/<%= domain.id %>/delete" hx-post="/app/domains/<%= domain.id %>/delete" onsubmit="return confirm('Delete this domain?')">
+        <%- include('../partials/csrf-field') %>
+            <button class="danger" type="submit">Delete</button>
+          </form>
+        </div>
+      </div>
+    <% }) %>
+  <% } %>
+</div>
+
+<script>
+  document.querySelectorAll('.copy-btn').forEach((btn) => {
+    btn.addEventListener('click', async () => {
+      const value = btn.dataset.copy || '';
+      try {
+        await navigator.clipboard.writeText(value);
+        const old = btn.textContent;
+        btn.textContent = 'Copied';
+        setTimeout(() => {
+          btn.textContent = old;
+        }, 1200);
+      } catch (_) {
+        alert('Copy failed. Please copy manually.');
+      }
+    });
+  });
+</script>
+
+<%- include('../partials/bottom') %>

package/src/views/pages/inboxes.ejs

@@ -0,0 +1,127 @@
+<%- include('../partials/top', { pageTitle, user, org }) %>
+<%- include('../partials/flash', { flash }) %>
+
+<div class="grid two-col">
+  <div class="card stack">
+    <h2 style="margin:0;">Create Inbox</h2>
+    <form method="post" action="/app/inboxes" hx-post="/app/inboxes">
+        <%- include('../partials/csrf-field') %>
+      <div class="stack">
+        <label>Local Part</label>
+        <input name="localPart" placeholder="agent-1" required />
+        <label>Display Name</label>
+        <input name="displayName" placeholder="Sales Agent" />
+        <label>Domain</label>
+        <select name="domainName">
+          <option value="<%= sharedDomain %>"><%= sharedDomain %> (shared)</option>
+          <% customDomains.forEach((domain) => { %>
+            <option value="<%= domain.name %>"><%= domain.name %> (custom)</option>
+          <% }) %>
+        </select>
+        <button type="submit">Create Inbox</button>
+      </div>
+    </form>
+    <div class="muted">Limit: <%= limits.maxInboxes %> inbox(es). Current: <%= inboxes.length %>.</div>
+  </div>
+
+  <div class="card stack">
+    <h2 style="margin:0;">Inboxes</h2>
+    <% if (!inboxes.length) { %>
+      <p class="muted">No inboxes yet.</p>
+    <% } else { %>
+      <table>
+        <thead>
+          <tr><th>Email</th><th>Display Name</th><th>Actions</th></tr>
+        </thead>
+        <tbody>
+          <% inboxes.forEach((inbox) => { %>
+            <tr>
+              <td>
+                <a href="/app/inboxes?inboxId=<%= inbox.id %>"><%= inbox.email_address %></a>
+              </td>
+              <td>
+                <form method="post" action="/app/inboxes/<%= inbox.id %>/update" hx-post="/app/inboxes/<%= inbox.id %>/update" class="row">
+        <%- include('../partials/csrf-field') %>
+                  <input name="displayName" value="<%= inbox.display_name || '' %>" placeholder="Optional" />
+                  <button class="secondary" type="submit">Save</button>
+                </form>
+              </td>
+              <td>
+                <form method="post" action="/app/inboxes/<%= inbox.id %>/delete" hx-post="/app/inboxes/<%= inbox.id %>/delete" onsubmit="return confirm('Delete this inbox?')">
+        <%- include('../partials/csrf-field') %>
+                  <button class="danger" type="submit">Delete</button>
+                </form>
+              </td>
+            </tr>
+          <% }) %>
+        </tbody>
+      </table>
+    <% } %>
+  </div>
+</div>
+
+<div class="grid two-col" style="margin-top:16px;">
+  <div class="card stack">
+    <h2 style="margin:0;">Compose</h2>
+    <% if (!selectedInbox) { %>
+      <p class="muted">Select or create an inbox to compose.</p>
+    <% } else { %>
+      <p class="muted">From: <strong><%= selectedInbox.email_address %></strong></p>
+      <form method="post" action="/app/emails/send" hx-post="/app/emails/send" class="stack">
+        <%- include('../partials/csrf-field') %>
+        <input type="hidden" name="inboxId" value="<%= selectedInbox.id %>" />
+        <label>To (comma-separated)</label>
+        <input name="to" placeholder="a@example.com,b@example.com" required />
+        <label>Subject</label>
+        <input name="subject" />
+        <label>Body</label>
+        <textarea name="text" rows="6"></textarea>
+        <button type="submit">Send Email</button>
+      </form>
+      <div class="muted">Monthly sends: <%= usage.sent_count %> / <%= limits.monthlyEmails %></div>
+    <% } %>
+  </div>
+
+  <div class="card stack">
+    <h2 style="margin:0;">Messages <%= selectedInbox ? `for ${selectedInbox.email_address}` : '' %></h2>
+    <% if (!selectedInbox) { %>
+      <p class="muted">Choose an inbox to view messages.</p>
+    <% } else if (!emails.length) { %>
+      <p class="muted">No messages yet.</p>
+    <% } else { %>
+      <table>
+        <thead>
+          <tr><th>Dir</th><th>Subject</th><th>From</th><th>To</th><th>Time</th><th>Actions</th></tr>
+        </thead>
+        <tbody>
+          <% emails.forEach((email) => { %>
+            <tr style="opacity:<%= email.is_read ? 0.7 : 1 %>">
+              <td><%= email.direction %></td>
+              <td><%= email.subject || '(no subject)' %></td>
+              <td><%= email.from_address %></td>
+              <td><%= (email.to_addresses || []).join(', ') %></td>
+              <td><%= new Date(email.created_at).toLocaleString() %></td>
+              <td>
+                <div class="inline">
+                  <form method="post" action="/app/emails/<%= email.id %>/read" hx-post="/app/emails/<%= email.id %>/read">
+        <%- include('../partials/csrf-field') %>
+                    <input type="hidden" name="inboxId" value="<%= selectedInbox.id %>" />
+                    <input type="hidden" name="mark" value="<%= email.is_read ? 'unread' : 'read' %>" />
+                    <button class="secondary" type="submit"><%= email.is_read ? 'Unread' : 'Read' %></button>
+                  </form>
+                  <form method="post" action="/app/emails/<%= email.id %>/delete" hx-post="/app/emails/<%= email.id %>/delete" onsubmit="return confirm('Delete this message?')">
+        <%- include('../partials/csrf-field') %>
+                    <input type="hidden" name="inboxId" value="<%= selectedInbox.id %>" />
+                    <button class="danger" type="submit">Delete</button>
+                  </form>
+                </div>
+              </td>
+            </tr>
+          <% }) %>
+        </tbody>
+      </table>
+    <% } %>
+  </div>
+</div>
+
+<%- include('../partials/bottom') %>

package/src/views/pages/login.ejs

@@ -0,0 +1,57 @@
+<%- include('../partials/top', { pageTitle: 'Login', user: null, org: null }) %>
+<div class="card" style="max-width:900px;margin:40px auto;">
+  <h1 style="margin-top:0;">Agent Inbox SaaS</h1>
+  <p class="muted">Create inboxes, custom domains, API keys, and usage metrics for agent workflows.</p>
+  <%- include('../partials/flash', { flash }) %>
+
+  <div class="grid two-col">
+    <div class="card stack">
+      <h2 style="margin:0;">Sign Up</h2>
+      <form method="post" action="/auth/register" class="stack">
+        <%- include('../partials/csrf-field') %>
+        <label>Name</label>
+        <input name="fullName" placeholder="Jane Doe" required />
+        <label>Email</label>
+        <input name="email" type="email" placeholder="jane@example.com" value="<%= prefillEmail %>" required />
+        <label>Password</label>
+        <input name="password" type="password" placeholder="At least 8 characters" minlength="8" required />
+        <button type="submit">Create Account</button>
+      </form>
+    </div>
+
+    <div class="card stack">
+      <h2 style="margin:0;">Log In</h2>
+      <form method="post" action="/auth/login" class="stack">
+        <%- include('../partials/csrf-field') %>
+        <label>Email</label>
+        <input name="email" type="email" placeholder="jane@example.com" value="<%= prefillEmail %>" required />
+        <label>Password</label>
+        <input name="password" type="password" required />
+        <button type="submit">Log In</button>
+      </form>
+    </div>
+  </div>
+
+  <div class="grid two-col" style="margin-top:16px;">
+    <div class="card stack">
+      <h3 style="margin:0;">Resend Verification Email</h3>
+      <form method="post" action="/auth/resend-verification" class="stack">
+        <%- include('../partials/csrf-field') %>
+        <label>Email</label>
+        <input name="email" type="email" placeholder="jane@example.com" value="<%= prefillEmail %>" required />
+        <button class="secondary" type="submit">Resend Verification</button>
+      </form>
+    </div>
+
+    <div class="card stack">
+      <h3 style="margin:0;">Forgot Password</h3>
+      <form method="post" action="/auth/forgot-password" class="stack">
+        <%- include('../partials/csrf-field') %>
+        <label>Email</label>
+        <input name="email" type="email" placeholder="jane@example.com" value="<%= prefillEmail %>" required />
+        <button class="secondary" type="submit">Send Reset Link</button>
+      </form>
+    </div>
+  </div>
+</div>
+<%- include('../partials/bottom') %>

package/src/views/pages/metrics.ejs

@@ -0,0 +1,34 @@
+<%- include('../partials/top', { pageTitle, user, org }) %>
+<%- include('../partials/flash', { flash }) %>
+
+<div class="grid three-col">
+  <div class="card">
+    <h3 style="margin-top:0;">Plan</h3>
+    <p><strong><%= org.plan %></strong></p>
+  </div>
+  <div class="card">
+    <h3 style="margin-top:0;">Monthly Outbound</h3>
+    <p><strong><%= snapshot.sentCount %></strong> / <%= limits.monthlyEmails %></p>
+  </div>
+  <div class="card">
+    <h3 style="margin-top:0;">Monthly Inbound</h3>
+    <p><strong><%= snapshot.inboundCount %></strong></p>
+  </div>
+</div>
+
+<div class="grid three-col" style="margin-top:16px;">
+  <div class="card">
+    <h3 style="margin-top:0;">Inboxes</h3>
+    <p><strong><%= snapshot.inboxCount %></strong> / <%= limits.maxInboxes %></p>
+  </div>
+  <div class="card">
+    <h3 style="margin-top:0;">Custom Domains</h3>
+    <p><strong><%= snapshot.customDomainCount %></strong> / <%= limits.maxCustomDomains %></p>
+  </div>
+  <div class="card">
+    <h3 style="margin-top:0;">API Keys</h3>
+    <p><strong><%= snapshot.apiKeyCount %></strong> / <%= limits.maxApiKeys %></p>
+  </div>
+</div>
+
+<%- include('../partials/bottom') %>

package/src/views/pages/reset-password.ejs

@@ -0,0 +1,19 @@
+<%- include('../partials/top', { pageTitle: 'Reset Password', user: null, org: null }) %>
+<div class="card" style="max-width:520px;margin:40px auto;">
+  <h1 style="margin-top:0;">Reset Password</h1>
+  <p class="muted">Set a new password for your EmailAgent account.</p>
+  <%- include('../partials/flash', { flash }) %>
+
+  <form method="post" action="/auth/reset-password" class="stack">
+    <%- include('../partials/csrf-field') %>
+    <input type="hidden" name="token" value="<%= token %>" />
+    <label>New Password</label>
+    <input name="password" type="password" placeholder="At least 8 characters" minlength="8" required />
+    <button type="submit">Update Password</button>
+  </form>
+
+  <p style="margin-top:12px;">
+    <a class="muted" href="/">Back to login</a>
+  </p>
+</div>
+<%- include('../partials/bottom') %>

package/src/views/partials/bottom.ejs

@@ -0,0 +1,3 @@
+    </div>
+  </body>
+</html>

package/src/views/partials/csrf-field.ejs

@@ -0,0 +1,3 @@
+<% if (typeof csrfToken === 'string' && csrfToken) { %>
+  <input type="hidden" name="_csrf" value="<%= csrfToken %>" />
+<% } %>

package/src/views/partials/flash.ejs

@@ -0,0 +1,3 @@
+<% if (flash) { %>
+  <div class="flash <%= flash.type %>"><%= flash.message %></div>
+<% } %>