feat: add password reset for usermanager (#2688)

* feat: add password reset for usermanager
- add a reset_key to account table
- add ?reset_key= GET arguments to index.html and show reset form if provided
- superuser can generate and copy reset url with key to share
future ideas:
- could add send forgot password email if user fill out email address
* feat: simplify reset key
* test: use reset key
* test: add more tests
* test: reset passwords do not match
* test: `reset_password_auth_threshold_expired`

---------

Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>

lnbits/core/views/user_api.py

@@ -1,3 +1,6 @@
+import base64
+import json
+import time
 from http import HTTPStatus
 from typing import List
 
@@ -23,7 +26,7 @@ from lnbits.core.models import (
 from lnbits.core.services import update_wallet_balance
 from lnbits.db import Filters, Page
 from lnbits.decorators import check_admin, check_super_user, parse_filters
-from lnbits.helpers import generate_filter_params_openapi
+from lnbits.helpers import encrypt_internal_message, generate_filter_params_openapi
 from lnbits.settings import EditableSettings, settings
 
 users_router = APIRouter(prefix="/users/api/v1", dependencies=[Depends(check_admin)])
@@ -75,6 +78,24 @@ async def api_users_delete_user(
         ) from exc
 
 
+@users_router.put(
+    "/user/{user_id}/reset_password", dependencies=[Depends(check_super_user)]
+)
+async def api_users_reset_password(user_id: str) -> str:
+    if user_id == settings.super_user:
+        raise HTTPException(
+            status_code=HTTPStatus.FORBIDDEN,
+            detail="Cannot change superuser password.",
+        )
+
+    reset_data = ["reset", user_id, int(time.time())]
+    reset_data_json = json.dumps(reset_data, separators=(",", ":"), ensure_ascii=False)
+    reset_key = encrypt_internal_message(reset_data_json)
+    assert reset_key, "Cannot generate reset key."
+    reset_key_b64 = base64.b64encode(reset_key.encode()).decode()
+    return f"reset_key_{reset_key_b64}"
+
+
 @users_router.get("/user/{user_id}/admin", dependencies=[Depends(check_super_user)])
 async def api_users_toggle_admin(user_id: str) -> None:
     try: