[w3irdrobot]

Summary

• Password reset codes (both user and platform) go from 8 to 32 uppercase alphanumeric characters ([A-Z0-9]).
• generate_alphanumeric_code moves out of AppState into a free function, since it never used self, and gets a unit test for length and charset.
• In the Maple password-reset email, the code was shown at 34px with 9px letter spacing (.code-lg), so a 32-character code would overflow the email. It now renders at 18px monospace with word-break: break-all, and the unused .code-lg rules are gone.

Email verification codes are unchanged. They are already UUIDv4s (32 hex digits).

Rollout

• Depends on Accept 32-character password reset codes in Research #1550 (merged): the Research form accepts both 8- and 32-character codes. Deploy this only after Accept 32-character password reset codes in Research #1550 is live, or new codes will fail the form's pattern check.
• Codes issued before deploy (8 characters) keep validating. Lookup is by MAC/encrypted value, not by length.
• No SDK change needed: the TS and Rust SDKs pass the code through as a string, and the backend validates only min = 1.
• This is an enclave change, so it needs a new EIF build and PCR approval before it can deploy.

Validation

In services/opensecret (nix develop .#ci):

• cargo fmt --all -- --check: pass
• cargo clippy --locked --all-targets --all-features -- -D warnings: pass
• cargo test --locked --all-features -- alphanumeric_code email::: 12 passed (new length test plus email template tests)

Not run: the full backend test suite and DB integration tests, an end-to-end reset in a local stack, or rendering the email in a real mail client.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[w3irdrobot]

this builds on #1550. we should allow our frontends to be updated for a while before starting to dole our 32 character codes

[AnthonyRonning]

on hold for a few weeks at least