{"id":"698681dac2d41cb5f452968f","title":"2026 02 06 Issue 157","path":"how-to/committee/release-notes/2026-02-06-issue-157","contentMarkdown":"# 06-Feb-2026 — move forgot password flow to backend and fix credential modals [ref: #157](https://github.com/nbarrett/ngx-ramblers/issues/157)\n\n## [build 469](https://github.com/nbarrett/ngx-ramblers/actions/runs/21770042279) — [commit 3e9cb24](https://github.com/nbarrett/ngx-ramblers/commit/3e9cb241d38476d89b9236f3e248df663c9c2413)\n\n_____\n\nThe forgot password feature was broken for users who were not logged in. This fix\nmoves the password reset email process entirely to the server so it works reliably\nfor all users regardless of login state.\n## Forgot password - new experience\n- When opening \"I've forgotten my password\", users are now presented with two ways\nto verify their identity via radio buttons\n- **\"I know my email address or username\"** (selected by default) — enter the email\naddress or username from your original welcome email\n- **\"I don't know my email or username\"** — enter your Ramblers membership number and\nhome postcode instead, so you can still reset your password without remembering\nyour login details\n- After submitting, a confirmation message is shown and the form becomes read-only\nto prevent duplicate requests\n- For security, the same message appears whether or not the details matched a member,\nso no one can use this form to discover who is or isn't a member\n- Postcodes are accepted in any format — with or without spaces, upper or lower case.\nFor example \"tn263hf\", \"TN26 3HF\", and \"tn26 3hf\" are all treated the same\n## Login and password reset - now more flexible\n- All login and password-related dialogs now accept either your **email address** or\n**username** wherever you see an identity field — you no longer need to remember which\none you registered with\n- Fields are labelled **\"Email address or username\"** to make this clear\n## Login on mobile - autofill fix\n- Previously, when your phone or browser auto-filled your saved username and password,\nthe Login button could remain greyed out even though the fields appeared filled in\n- This is now fixed — the Login button is always clickable and validates your\ncredentials when you tap it\n## Modal dialog behaviour\n- Login, forgot password, and reset password dialogs can now only be closed using the\nexplicit buttons (Close, Cancel, Start Over etc.) — clicking outside the dialog or\npressing Escape no longer dismisses them, preventing accidental loss of entered data\n- All credential dialogs have consistent, compact button layout that displays correctly\non both desktop and mobile without wrapping\n## Postcode normalisation\n- The shared `normalisePostcode` function now correctly handles postcodes entered\nwithout spaces by stripping all whitespace, matching the UK postcode pattern, and\nre-inserting the standard space before the last 3 characters\n- This benefits both the forgot password flow and the existing postcode lookup service\n## Technical changes\n- New server-side endpoint handles member lookup, password reset ID generation, and\nBrevo transactional email sending in a single request\n- Debug logging enabled on the forgot password endpoint for operational visibility\n- Removed legacy client-side forgot password controller, auth route, and unused\nservice methods\n- Reset password modal template and empty stylesheet inlined into the component\n- Disabled noisy aws-controllers debug logging","contentHtml":"<h1>06-Feb-2026 — move forgot password flow to backend and fix credential modals <a href=\"https://github.com/nbarrett/ngx-ramblers/issues/157\">ref: #157</a></h1>\n<h2><a href=\"https://github.com/nbarrett/ngx-ramblers/actions/runs/21770042279\">build 469</a> — <a href=\"https://github.com/nbarrett/ngx-ramblers/commit/3e9cb241d38476d89b9236f3e248df663c9c2413\">commit 3e9cb24</a></h2>\n<hr>\n<p>The forgot password feature was broken for users who were not logged in. This fix\nmoves the password reset email process entirely to the server so it works reliably\nfor all users regardless of login state.</p>\n<h2>Forgot password - new experience</h2>\n<ul>\n<li>When opening &quot;I&#39;ve forgotten my password&quot;, users are now presented with two ways\nto verify their identity via radio buttons</li>\n<li><strong>&quot;I know my email address or username&quot;</strong> (selected by default) — enter the email\naddress or username from your original welcome email</li>\n<li><strong>&quot;I don&#39;t know my email or username&quot;</strong> — enter your Ramblers membership number and\nhome postcode instead, so you can still reset your password without remembering\nyour login details</li>\n<li>After submitting, a confirmation message is shown and the form becomes read-only\nto prevent duplicate requests</li>\n<li>For security, the same message appears whether or not the details matched a member,\nso no one can use this form to discover who is or isn&#39;t a member</li>\n<li>Postcodes are accepted in any format — with or without spaces, upper or lower case.\nFor example &quot;tn263hf&quot;, &quot;TN26 3HF&quot;, and &quot;tn26 3hf&quot; are all treated the same</li>\n</ul>\n<h2>Login and password reset - now more flexible</h2>\n<ul>\n<li>All login and password-related dialogs now accept either your <strong>email address</strong> or\n<strong>username</strong> wherever you see an identity field — you no longer need to remember which\none you registered with</li>\n<li>Fields are labelled <strong>&quot;Email address or username&quot;</strong> to make this clear</li>\n</ul>\n<h2>Login on mobile - autofill fix</h2>\n<ul>\n<li>Previously, when your phone or browser auto-filled your saved username and password,\nthe Login button could remain greyed out even though the fields appeared filled in</li>\n<li>This is now fixed — the Login button is always clickable and validates your\ncredentials when you tap it</li>\n</ul>\n<h2>Modal dialog behaviour</h2>\n<ul>\n<li>Login, forgot password, and reset password dialogs can now only be closed using the\nexplicit buttons (Close, Cancel, Start Over etc.) — clicking outside the dialog or\npressing Escape no longer dismisses them, preventing accidental loss of entered data</li>\n<li>All credential dialogs have consistent, compact button layout that displays correctly\non both desktop and mobile without wrapping</li>\n</ul>\n<h2>Postcode normalisation</h2>\n<ul>\n<li>The shared <code>normalisePostcode</code> function now correctly handles postcodes entered\nwithout spaces by stripping all whitespace, matching the UK postcode pattern, and\nre-inserting the standard space before the last 3 characters</li>\n<li>This benefits both the forgot password flow and the existing postcode lookup service</li>\n</ul>\n<h2>Technical changes</h2>\n<ul>\n<li>New server-side endpoint handles member lookup, password reset ID generation, and\nBrevo transactional email sending in a single request</li>\n<li>Debug logging enabled on the forgot password endpoint for operational visibility</li>\n<li>Removed legacy client-side forgot password controller, auth route, and unused\nservice methods</li>\n<li>Reset password modal template and empty stylesheet inlined into the component</li>\n<li>Disabled noisy aws-controllers debug logging</li>\n</ul>\n"}