Email Auth Tests Need a Recovery Boundary

Email account recovery is often tested as a happy path: request a link, open the newest message, click it, and expect a new password form. That proves the feature works once. It does not prove that the link belongs to the right user, that an old token is rejected, or that two parallel runs cannot cross wires. Recovery deserves its own security... Weiterlesen: Email Auth Tests Need a Recovery Boundary