{% extends "admin/_base.html" %}
{% block sidebar %}{% endblock %}
{% block extra_head %}
{% if correlation_id %}<meta name="rio-correlation-id" content="{{ correlation_id }}">{% endif %}
{% endblock %}
{% block content %}
<div class="rio-login">
{% if invalid %}
<h1 class="rio-login-title">This reset link has expired</h1>
<p class="rio-login-intro">
Reset links stay active for 1 hour after they're sent and become
invalid after the first use. Request a new link to continue.
</p>
<p class="rio-login-footer">
<a class="rio-button rio-button--primary" href="/admin/forgot-password">Request a new link</a>
</p>
<aside class="rio-login-aside" aria-labelledby="rio-recovery-info">
<h2 id="rio-recovery-info" class="rio-login-aside__title">Why links expire</h2>
<ul class="rio-login-aside__list">
<li>Time-bounded links limit the window a stolen email can be used.</li>
<li>Single-use semantics prevent replay if a link is shared by accident.</li>
<li>Each request creates a fresh, fully isolated token.</li>
</ul>
</aside>
{% else %}
<h1 class="rio-login-title">Set a new password</h1>
<p class="rio-login-intro">
Choose a new password. Once you save, every existing session on this
account is revoked — you'll need to sign in again with the new
password.
</p>
{% if errors %}
<div class="rio-flash rio-flash--error" role="alert">
<ul>{% for e in errors %}<li>{{ e }}</li>{% endfor %}</ul>
</div>
{% endif %}
<form method="post" action="/admin/reset-password/{{ token }}" class="rio-form rio-form--login" autocomplete="off">
<input type="hidden" name="_csrf" value="{{ csrf_token }}">
{% for section in sections %}
{% for field in section.fields %}{% include "admin/includes/_form_field.html" %}{% endfor %}
{% endfor %}
<button type="submit" class="rio-button rio-button--primary">Save new password</button>
</form>
<aside class="rio-login-aside" aria-labelledby="rio-recovery-info">
<h2 id="rio-recovery-info" class="rio-login-aside__title">Secure account recovery</h2>
<ul class="rio-login-aside__list">
<li>This link can only be used once — saving consumes it.</li>
<li>All existing sessions on this account are revoked on save.</li>
<li>Passwords are stored hashed with Argon2id; the plaintext is never persisted.</li>
<li>This reset is recorded in the audit log alongside the actor and time.</li>
</ul>
</aside>
{% endif %}
</div>
{% endblock %}