Add student account self-service security features and discoverability fixes; v2.1.0

Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/routes/admin-assets.js

@@ -19,8 +19,9 @@ import {
   normalizeStudySlug,
   isEnrollableStudySlug,
   makeUnsubUrl,
+  invalidateAllStudySessions,
 } from '../study-helpers.js'
-import { sendStudyReengagementEmail } from '../email.js'
+import { sendStudyReengagementEmail, sendStudyPasswordChangedEmail } from '../email.js'
 
 export function register(app) {
   app.get('/api/admin-assets', requireAdminAuth, async (_req, res) => {
@@ -237,9 +238,9 @@ export function register(app) {
         res.status(400).json({ message: 'Password must be 8–200 characters.' }); return
       }
       user.passwordHash = hashStudyPassword(newPassword)
-      for (const [token, session] of state.studySessions) {
-        if (session.userId === user.id) state.studySessions.delete(token)
-      }
+      invalidateAllStudySessions(user.id)
+      sendStudyPasswordChangedEmail(user.username, user.displayName || user.username)
+        .catch(err => console.error('[admin] password-changed email error:', err))
     }
 
     if (typeof addEnrollment === 'string' && addEnrollment.trim()) {
@@ -265,9 +266,7 @@ export function register(app) {
     const user = state.studyUsers.find(u => u.id === req.params.id)
     if (!user) { res.status(404).json({ message: 'User not found.' }); return }
 
-    for (const [token, session] of state.studySessions) {
-      if (session.userId === user.id) state.studySessions.delete(token)
-    }
+    invalidateAllStudySessions(user.id)
 
     state.studyUsers = state.studyUsers.filter(u => u.id !== user.id)
     queueStudyUsersWrite()

server/routes/study-account.js

@@ -3,8 +3,8 @@ import rateLimit from 'express-rate-limit'
 import { Document, Packer, Paragraph, HeadingLevel, TextRun } from 'docx'
 import { mkdir, unlink, writeFile } from 'node:fs/promises'
 import path from 'node:path'
-import { inferImageExtensionFromDataUrl, normalizeAssetBaseName, escapeHtml, buildAbsoluteUrl } from '../helpers.js'
-import { UPLOADS_DIR, EMAIL_CHANGE_TOKEN_TTL_MS } from '../config.js'
+import { inferImageExtensionFromDataUrl, normalizeAssetBaseName, escapeHtml, buildAbsoluteUrl, parseCookies } from '../helpers.js'
+import { UPLOADS_DIR, EMAIL_CHANGE_TOKEN_TTL_MS, MAX_STUDY_NOTES_PER_USER, MAX_STUDY_NOTE_LENGTH, STUDY_SESSION_COOKIE } from '../config.js'
 import { state } from '../state.js'
 import {
   queueStudyUsersWrite,
@@ -30,9 +30,11 @@ import {
   normalizeStudySlug,
   getStudyCatalog,
   clearStudySessionCookie,
+  invalidateAllStudySessions,
 } from '../study-helpers.js'
 import {
   sendStudyAccountDeletedEmail,
+  sendStudyPasswordChangedEmail,
   syncContactToResend,
   buildBrandedEmailHtml,
   getCanonicalBaseUrl,
@@ -187,6 +189,11 @@ export function register(app) {
     user.passwordHash = hashStudyPassword(newPassword)
     user.updatedAt = new Date().toISOString()
     queueStudyUsersWrite()
+    invalidateAllStudySessions(user.id, parseCookies(req.headers.cookie)[STUDY_SESSION_COOKIE])
+
+    sendStudyPasswordChangedEmail(user.username, user.displayName || user.username)
+      .catch(err => console.error('[study-account] password-changed email error:', err))
+
     res.json({ ok: true })
   })
 
@@ -213,6 +220,16 @@ export function register(app) {
       }
     })
 
+    const baseUrl = getCanonicalBaseUrl()
+    const certificates = state.studyCertificates
+      .filter(c => c.userId === user.id)
+      .map(c => ({
+        studySlug: c.studySlug,
+        studyTitle: c.studyTitle,
+        issuedAt: c.issuedAt,
+        url: buildAbsoluteUrl(baseUrl, `/study/certificate/${c.token}`),
+      }))
+
     res.json({
       profile: {
         username: user.username,
@@ -222,9 +239,12 @@ export function register(app) {
         reminderFrequency: user.reminderFrequency ?? 'immediate',
         remindersPausedUntil: user.remindersPausedUntil ?? null,
         avatarUrl: getStudyAvatarUrl(user),
+        emailVerified: user.emailVerified === true,
       },
       stats: {
         noteCount: Object.keys(notes).length,
+        noteLimit: MAX_STUDY_NOTES_PER_USER,
+        noteCharLimit: MAX_STUDY_NOTE_LENGTH,
         memberSince: user.createdAt,
         lastLoginAt: user.lastLoginAt,
         currentStreak: user.currentStreak ?? 0,
@@ -232,6 +252,7 @@ export function register(app) {
         lastStudiedDate: user.lastStudiedDate ?? null,
       },
       studies,
+      certificates,
     })
   })
 
@@ -478,9 +499,7 @@ export function register(app) {
     const deletedEmail = user.username
     const deletedDisplayName = user.displayName || user.username
 
-    for (const [token, session] of state.studySessions) {
-      if (session.userId === user.id) state.studySessions.delete(token)
-    }
+    invalidateAllStudySessions(user.id)
 
     state.studyUsers = state.studyUsers.filter(u => u.id !== user.id)
     queueStudyUsersWrite()

server/routes/study-auth.js

@@ -6,12 +6,13 @@ import {
   verifyTotpCode,
   generateRecoveryCodes,
 } from '../auth.js'
-import { parseCookies } from '../helpers.js'
-import { STUDY_SESSION_COOKIE, MAX_STUDY_USERS, MAX_CONTACT_SUBMISSIONS } from '../config.js'
+import { parseCookies, buildAbsoluteUrl } from '../helpers.js'
+import { STUDY_SESSION_COOKIE, MAX_STUDY_USERS, MAX_CONTACT_SUBMISSIONS, PASSWORD_RESET_TOKEN_TTL_MS, EMAIL_VERIFY_TOKEN_TTL_MS } from '../config.js'
 import { state } from '../state.js'
 import {
   queueStudyUsersWrite,
   queueContactSubmissionsWrite,
+  queueStudySessionsWrite,
   normalizeContactEmailStatus,
   normalizeMessageType,
 } from '../data.js'
@@ -19,12 +20,15 @@ import {
   normalizeStudyUsername,
   isValidStudyUsername,
   hashStudyPassword,
+  hashPasswordResetToken,
+  hashEmailVerifyToken,
   findStudyUserByUsername,
   getStudyAvatarUrl,
   createStudySession,
   setStudySessionCookie,
   clearStudySessionCookie,
   requireStudyAuth,
+  invalidateAllStudySessions,
   createStudyTotpPendingToken,
   consumeStudyTotpPendingToken,
   generateEmailOtp,
@@ -32,7 +36,15 @@ import {
   verifyEmailOtp,
   getStudyUserFromRequest,
 } from '../study-helpers.js'
-import { sendEmailOtp, sendStudyWelcomeEmail, syncContactToResend } from '../email.js'
+import {
+  sendEmailOtp,
+  sendStudyWelcomeEmail,
+  sendStudyVerifyEmail,
+  sendStudyPasswordResetEmail,
+  sendStudyPasswordChangedEmail,
+  syncContactToResend,
+  getCanonicalBaseUrl,
+} from '../email.js'
 
 const studyAuthRateLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
@@ -54,6 +66,7 @@ export function register(app) {
       studyRemindersEnabled: user?.studyRemindersEnabled === true,
       avatarUrl: user ? getStudyAvatarUrl(user) : '',
       enrolledStudySlugs: Array.isArray(user?.enrolledStudySlugs) ? user.enrolledStudySlugs : [],
+      emailVerified: user?.emailVerified === true,
       totpEnabled: Boolean(user && (user.twoFaMethod === 'app' || user.twoFaMethod === 'email') && (user.twoFaMethod === 'email' || (user.totpSecret && user.totpVerified))),
       twoFaMethod: user?.twoFaMethod ?? null,
       totpRecoveryCodesRemaining: user?.twoFaMethod === 'app' ? (user.totpRecoveryCodes?.length ?? 0) : 0,
@@ -87,6 +100,7 @@ export function register(app) {
     }
 
     const now = new Date().toISOString()
+    const rawVerifyToken = randomUUID()
     const user = {
       id: randomUUID(),
       username,
@@ -95,6 +109,11 @@ export function register(app) {
       subscribeNewsletter: subscribe,
       studyRemindersEnabled: false,
       pendingEmailChange: null,
+      emailVerified: false,
+      pendingEmailVerification: {
+        tokenHash: hashEmailVerifyToken(rawVerifyToken),
+        expiresAt: Date.now() + EMAIL_VERIFY_TOKEN_TTL_MS,
+      },
       enrolledStudySlugs: [],
       createdAt: now,
       updatedAt: now,
@@ -123,6 +142,8 @@ export function register(app) {
     }
 
     sendStudyWelcomeEmail(username, displayName || username).catch(err => console.error('[study-signup] welcome email error:', err))
+    const verifyUrl = buildAbsoluteUrl(getCanonicalBaseUrl(), `/study/verify-email?token=${encodeURIComponent(rawVerifyToken)}`)
+    sendStudyVerifyEmail(username, displayName || username, verifyUrl).catch(err => console.error('[study-signup] verify email error:', err))
 
     const sessionToken = createStudySession(user.id)
     setStudySessionCookie(res, sessionToken)
@@ -356,11 +377,145 @@ export function register(app) {
     const token = cookies[STUDY_SESSION_COOKIE]
     if (token) {
       state.studySessions.delete(token)
+      queueStudySessionsWrite()
     }
     clearStudySessionCookie(res)
     res.json({ ok: true })
   })
 
+  // Signs out every other active session for the current user (this device stays signed in).
+  app.post('/api/study-auth/logout-all', requireStudyAuth, (req, res) => {
+    const cookies = parseCookies(req.headers.cookie)
+    const currentToken = cookies[STUDY_SESSION_COOKIE]
+    invalidateAllStudySessions(req.studyUser.id, currentToken)
+    res.json({ ok: true })
+  })
+
+  // Request a password-reset email. Always responds ok to avoid leaking which emails have accounts.
+  app.post('/api/study-auth/forgot-password', studyAuthRateLimiter, async (req, res) => {
+    const username = normalizeStudyUsername(req.body?.username)
+    if (!isValidStudyUsername(username)) {
+      res.status(400).json({ message: 'Please enter a valid email address.' })
+      return
+    }
+
+    const user = findStudyUserByUsername(username)
+    if (user) {
+      const rawToken = randomUUID()
+      user.pendingPasswordReset = {
+        tokenHash: hashPasswordResetToken(rawToken),
+        expiresAt: Date.now() + PASSWORD_RESET_TOKEN_TTL_MS,
+      }
+      user.updatedAt = new Date().toISOString()
+      queueStudyUsersWrite()
+
+      const resetUrl = buildAbsoluteUrl(getCanonicalBaseUrl(), `/study/reset-password?token=${encodeURIComponent(rawToken)}`)
+      sendStudyPasswordResetEmail(user.username, user.displayName || user.username, resetUrl)
+        .catch(err => console.error('[study-forgot-password] send error:', err))
+    }
+
+    res.json({ ok: true, message: 'If that email has an account, a reset link is on its way.' })
+  })
+
+  app.post('/api/study-auth/reset-password', studyAuthRateLimiter, (req, res) => {
+    const token = typeof req.body?.token === 'string' ? req.body.token.trim() : ''
+    const newPassword = typeof req.body?.newPassword === 'string' ? req.body.newPassword : ''
+
+    if (!token) {
+      res.status(400).json({ message: 'Invalid or missing reset token.' })
+      return
+    }
+    if (newPassword.length < 8 || newPassword.length > 200) {
+      res.status(400).json({ message: 'New password must be 8–200 characters.' })
+      return
+    }
+
+    const tokenHash = hashPasswordResetToken(token)
+    const user = state.studyUsers.find(u => {
+      const pending = u.pendingPasswordReset
+      if (!pending?.tokenHash) return false
+      const a = Buffer.from(tokenHash, 'utf8')
+      const b = Buffer.from(pending.tokenHash, 'utf8')
+      return a.length === b.length && timingSafeEqual(a, b)
+    })
+
+    if (!user) {
+      res.status(400).json({ message: 'This reset link is invalid. Please request a new one.' })
+      return
+    }
+    if (user.pendingPasswordReset.expiresAt <= Date.now()) {
+      user.pendingPasswordReset = null
+      queueStudyUsersWrite()
+      res.status(400).json({ message: 'This reset link has expired. Please request a new one.' })
+      return
+    }
+
+    user.passwordHash = hashStudyPassword(newPassword)
+    user.pendingPasswordReset = null
+    user.updatedAt = new Date().toISOString()
+    queueStudyUsersWrite()
+    invalidateAllStudySessions(user.id)
+
+    sendStudyPasswordChangedEmail(user.username, user.displayName || user.username)
+      .catch(err => console.error('[study-reset-password] confirmation email error:', err))
+
+    res.json({ ok: true })
+  })
+
+  // Verify the email address used at signup. Not auth-gated so it works from any device/browser.
+  app.post('/api/study-auth/verify-email', studyAuthRateLimiter, (req, res) => {
+    const token = typeof req.body?.token === 'string' ? req.body.token.trim() : ''
+    if (!token) {
+      res.status(400).json({ message: 'Invalid or missing verification token.' })
+      return
+    }
+
+    const tokenHash = hashEmailVerifyToken(token)
+    const user = state.studyUsers.find(u => {
+      const pending = u.pendingEmailVerification
+      if (!pending?.tokenHash) return false
+      const a = Buffer.from(tokenHash, 'utf8')
+      const b = Buffer.from(pending.tokenHash, 'utf8')
+      return a.length === b.length && timingSafeEqual(a, b)
+    })
+
+    if (!user) {
+      res.status(400).json({ message: 'This verification link is invalid or has already been used.' })
+      return
+    }
+    if (user.pendingEmailVerification.expiresAt <= Date.now()) {
+      res.status(400).json({ message: 'This verification link has expired. Request a new one from My Account.' })
+      return
+    }
+
+    user.emailVerified = true
+    user.pendingEmailVerification = null
+    user.updatedAt = new Date().toISOString()
+    queueStudyUsersWrite()
+    res.json({ ok: true })
+  })
+
+  app.post('/api/study-auth/resend-verification', studyAuthRateLimiter, requireStudyAuth, (req, res) => {
+    const user = req.studyUser
+    if (user.emailVerified) {
+      res.json({ ok: true, alreadyVerified: true })
+      return
+    }
+    const rawToken = randomUUID()
+    user.pendingEmailVerification = {
+      tokenHash: hashEmailVerifyToken(rawToken),
+      expiresAt: Date.now() + EMAIL_VERIFY_TOKEN_TTL_MS,
+    }
+    user.updatedAt = new Date().toISOString()
+    queueStudyUsersWrite()
+
+    const verifyUrl = buildAbsoluteUrl(getCanonicalBaseUrl(), `/study/verify-email?token=${encodeURIComponent(rawToken)}`)
+    sendStudyVerifyEmail(user.username, user.displayName || user.username, verifyUrl)
+      .catch(err => console.error('[study-resend-verification] send error:', err))
+
+    res.json({ ok: true })
+  })
+
   // One-click unsubscribe from re-engagement emails (no login required)
   app.get('/api/study-auth/unsubscribe-reminders', (req, res) => {
     const { uid, token } = req.query ?? {}