Use Django's built-in password reset confirm flow

[rtibbles]

Summary

• Reduce our custom code logic in a critical path and revert to Django internals as much as possible
• Simplifies our code and makes it more robust

References

Reviewer guidance

1. Run pnpm devserver, then request a reset for user@a.com at /accounts/#/forgot-password — the reset link prints in the server log.
2. Open the link's path on http://localhost:8080 — it lands on /accounts/#/reset-password?uidb64=… with no token in the URL.
3. Set a new password — "Password reset successfully".
4. Sign in with the new password — My channels loads.
5. Sign out and open the same link again — "Reset link expired".

Screenshot

password-reset-flow.webm

Server log for the recorded flow (steps 2, 3 and 5):

"GET /en/accounts/password/reset/confirm/Mg/dffe6l-c30a9dde5998b9c64507d56521befcd7/ HTTP/1.1" 302 0
"GET /en/accounts/password/reset/confirm/Mg/set-password/ HTTP/1.1" 302 0
"POST /en/accounts/password/reset/confirm/Mg/set-password/ HTTP/1.1" 302 0
"GET /en/accounts/password/reset/confirm/Mg/dffe6l-c30a9dde5998b9c64507d56521befcd7/ HTTP/1.1" 302 0

Server log for POSTs without a valid reset session:

"POST /en/accounts/password/reset/confirm/Mg/made-up-token/ HTTP/1.1" 403 0
"POST /en/accounts/password/reset/confirm/Mg/set-password/ HTTP/1.1" 403 0

AI usage

Used Claude Code to rework the reset confirm view onto Django's built-in flow and write the tests. Verified with the Django and Jest test suites, the pre-commit linters, and manual QA in a browser against a local devserver.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EZoTHtTrhSDCJsx4PA2AXu

[bjester]

LGTM