v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/services/password-reset-service.ts

@@ -1,6 +1,8 @@
 /**
- * Password resets by email: sending a reset link, and setting the new
- * password with it.
+ * Emails password reset links and sets the new password when one is used. The
+ * users routes call it for `POST /api/users/request-password-reset` and
+ * `POST /api/users/reset-password`; the link opens the client's
+ * `/reset-password` page.
  *
  * @module
  */
@@ -20,16 +22,20 @@ import { VALIDATION } from "../../shared/validation.ts";
 import { marked } from "marked";
 import { type RateLimit, takeToken } from "../lib/rate-limit.ts";
 
-/** How long a reset link works. */
+/** Must match the `1h` that `createPasswordResetToken` signs into the token. */
 const RESET_TOKEN_TTL_HOURS = 1;
 
-/** Per address: enough to retry a lost email, not enough to flood an inbox. */
+/**
+ * Applies per address. It allows a retry after a lost email, but not enough
+ * requests to flood an inbox.
+ */
 const RESET_REQUEST_LIMIT: RateLimit = { capacity: 3, refill: 1 / 600 };
 
 /**
- * Looks up the user by email, creates a signed reset token, persists it, and
- * sends the reset link. Always resolves without throwing so callers can return
- * 200 unconditionally (no user enumeration).
+ * Emails a reset link to the account with address `email`, if there is one and
+ * email is configured. It says nothing of what it did, so that the route
+ * answers the same whether the address has an account or not. It sends at
+ * most 3 links in a row per address, then one every 10 minutes.
  */
 export async function requestPasswordReset(email: string): Promise<void> {
   if (!takeToken(`reset:${email.toLowerCase()}`, RESET_REQUEST_LIMIT)) return;
@@ -66,8 +72,8 @@ export async function requestPasswordReset(email: string): Promise<void> {
 }
 
 /**
- * Verifies the token (JWT signature + expiry + DB record + not used), updates
- * the password, and marks the token consumed.
+ * Sets `newPassword` for the user of a reset token and marks the token used.
+ * Through `updateUser`, this ends the user's other sessions.
  *
  * @throws {APIException} 400 when the password's length is out of bounds or
  * the token is invalid or expired, 404 when the token isn't on record or its
@@ -109,8 +115,8 @@ export async function resetPassword(
     );
   }
 
-  // Consume the link before the (async) password hash: checking used_at and
-  // marking it later would let parallel submissions all pass the check.
+  // Claim the link before the async hash: checking `used_at` first and
+  // marking it after would let parallel submissions all pass.
   const claimed = db.prepare(
     `UPDATE password_reset_tokens SET used_at = ? WHERE token = ? AND used_at IS NULL;`,
   ).run(new Date().toISOString(), token);
@@ -125,6 +131,7 @@ export async function resetPassword(
   try {
     await updateUser(payload.userId, { password: newPassword });
   } catch (err) {
+    // The password didn't change, so the link must keep working.
     db.prepare(
       `UPDATE password_reset_tokens SET used_at = NULL WHERE token = ?;`,
     )