sirius-press/plugins/sirius-press-auth/includes/class-spa-recovery.php

<?php
/**
 * What happens when someone clicks "Lost your password?".
 *
 * On stock WordPress that link starts a mail round-trip: the server sends a
 * reset token to an address it has on file, and whoever reads that mailbox
 * gets the account. There is no equivalent here, and pretending otherwise
 * would be the worst thing this plugin could do.
 *
 * So the page is honest. It explains that the site cannot reset anything,
 * because it never held anything to reset — no mailbox, no password, no
 * recovery key. What it *can* do is help: if the visitor still has their
 * recovery phrase, the in-page wallet derives the address and they can sign
 * straight back in. If they do not, the account is gone, and saying so
 * plainly is better than a reset form that quietly does nothing.
 *
 * The one recovery route that does exist is social, not technical: an
 * administrator can change the address on an account from the user editor.
 * That is deliberate — it means account recovery on a Sirius Press site is a
 * decision a human makes, not a capability an attacker can trigger by
 * compromising a mailbox.
 *
 * @package SiriusPress
 */

defined( 'ABSPATH' ) || exit;

final class SPA_Recovery {

	public static function hooks() {
		add_action( 'login_form_lostpassword', array( __CLASS__, 'render' ) );
		add_action( 'login_form_retrievepassword', array( __CLASS__, 'render' ) );
		// `resetpass` / `rp` only ever arrive from a link this site can no
		// longer send; treat them as the dead ends they are.
		add_action( 'login_form_resetpass', array( __CLASS__, 'render' ) );
		add_action( 'login_form_rp', array( __CLASS__, 'render' ) );
		add_filter( 'lostpassword_url', array( __CLASS__, 'url' ), 10, 0 );
		add_filter( 'allow_password_reset', '__return_false' );
	}

	public static function url() {
		return add_query_arg( 'action', 'lostpassword', wp_login_url() );
	}

	public static function render() {
		if ( SPA_Login::passwords_allowed() && ! empty( $_GET['sirius_force'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return;
		}

		login_header( __( 'Recovering an account', 'sirius-press' ) );
		SPA_Login::print_config();
		?>
		<div class="sirius-recovery">
			<p class="message">
				<?php esc_html_e( 'This site cannot reset your account, and that is on purpose.', 'sirius-press' ); ?>
			</p>

			<p>
				<?php esc_html_e( 'There is no password on file to replace and no email address to send a link to. Your account is a wallet — whoever can sign with its key is the account holder, and this site has never been able to sign on your behalf.', 'sirius-press' ); ?>
			</p>

			<h2><?php esc_html_e( 'If you still have your recovery phrase', 'sirius-press' ); ?></h2>
			<p>
				<?php
				printf(
					/* translators: %s: sign-in URL. */
					wp_kses_post( __( 'You are not locked out at all. Go to <a href="%s">the sign-in page</a>, enter your phrase there, and sign the challenge. Nothing needs recovering.', 'sirius-press' ) ),
					esc_url( wp_login_url() )
				);
				?>
			</p>

			<h2><?php esc_html_e( 'If you have lost the phrase', 'sirius-press' ); ?></h2>
			<p>
				<?php esc_html_e( 'Then the key is gone, and so is the account — no part of this site can bring it back. The only route left is to ask an administrator to point your account at a new wallet address, which is a decision they make about a person they recognise, not something a form can do.', 'sirius-press' ); ?>
			</p>
			<p>
				<?php esc_html_e( 'If you can still sign in with a different wallet, create a new account and ask an administrator to move your content across.', 'sirius-press' ); ?>
			</p>

			<h2><?php esc_html_e( 'Checking which address a phrase belongs to', 'sirius-press' ); ?></h2>
			<p class="sirius-hint">
				<?php esc_html_e( 'If you have several phrases and are not sure which one this account uses, work it out here. The phrase is not sent anywhere — the address is computed in this page.', 'sirius-press' ); ?>
			</p>
			<div class="sirius-derive">
				<label for="sirius_derive_phrase"><?php esc_html_e( 'Recovery phrase', 'sirius-press' ); ?></label>
				<textarea id="sirius_derive_phrase" rows="3" autocomplete="off" spellcheck="false"></textarea>
				<p>
					<button type="button" class="button" id="sirius_derive_go">
						<?php esc_html_e( 'Show the address', 'sirius-press' ); ?>
					</button>
				</p>
				<p class="sirius-derive__out" role="status" aria-live="polite"></p>
			</div>
		</div>

		<p id="nav">
			<a href="<?php echo esc_url( wp_login_url() ); ?>"><?php esc_html_e( '← Sign in', 'sirius-press' ); ?></a>
		</p>
		<?php
		login_footer();
		exit;
	}
}