Merge pull request #10 from vernonkeenan/feat/credential-lifecycle-contract

feat: propagate Members credential contract

api/members/members_client/credentials/change_password_parameters.go

@@ -0,0 +1,181 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewChangePasswordParams creates a new ChangePasswordParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewChangePasswordParams() *ChangePasswordParams {
+	return NewChangePasswordParamsWithTimeout(cr.DefaultTimeout)
+}
+
+// NewChangePasswordParamsWithTimeout creates a new ChangePasswordParams object
+// with the ability to set a timeout on a request.
+func NewChangePasswordParamsWithTimeout(timeout time.Duration) *ChangePasswordParams {
+	return &ChangePasswordParams{
+		inner: innerParams{
+			timeout: timeout,
+		},
+	}
+}
+
+// NewChangePasswordParamsWithContext creates a new ChangePasswordParams object
+// with the ability to set a context for a request.
+//
+// Deprecated: use the operation call with context to pass the context instead of [ChangePasswordParams].
+func NewChangePasswordParamsWithContext(ctx context.Context) *ChangePasswordParams {
+	return &ChangePasswordParams{
+		inner: innerParams{
+			ctx: ctx,
+		},
+	}
+}
+
+// NewChangePasswordParamsWithHTTPClient creates a new ChangePasswordParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewChangePasswordParamsWithHTTPClient(client *http.Client) *ChangePasswordParams {
+	return &ChangePasswordParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+ChangePasswordParams contains all the parameters to send to the API endpoint
+
+	for the change password operation.
+
+	Typically these are written to a http.Request.
+*/
+type ChangePasswordParams struct {
+
+	// XRequestID.
+	//
+	// Optional bounded correlation identifier stored with membership audit events.
+	XRequestID *string
+
+	// PasswordChangeRequest.
+	PasswordChangeRequest *members_models.PasswordChangeRequest
+
+	HTTPClient *http.Client
+
+	inner innerParams
+}
+
+// WithDefaults hydrates default values in the change password params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ChangePasswordParams) WithDefaults() *ChangePasswordParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the change password params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ChangePasswordParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the change password params.
+func (o *ChangePasswordParams) WithTimeout(timeout time.Duration) *ChangePasswordParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the change password params.
+func (o *ChangePasswordParams) SetTimeout(timeout time.Duration) {
+	o.inner.timeout = timeout
+}
+
+// WithContext adds the context to the change password params.
+//
+// Deprecated: use the operation call with context to pass the context instead of [ChangePasswordParams].
+func (o *ChangePasswordParams) WithContext(ctx context.Context) *ChangePasswordParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the change password params.
+//
+// Deprecated: use the operation call with context to pass the context instead of [ChangePasswordParams].
+func (o *ChangePasswordParams) SetContext(ctx context.Context) {
+	o.inner.ctx = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the change password params.
+func (o *ChangePasswordParams) WithHTTPClient(client *http.Client) *ChangePasswordParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the change password params.
+func (o *ChangePasswordParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithXRequestID adds the xRequestID to the change password params.
+func (o *ChangePasswordParams) WithXRequestID(xRequestID *string) *ChangePasswordParams {
+	o.SetXRequestID(xRequestID)
+	return o
+}
+
+// SetXRequestID adds the xRequestId to the change password params.
+func (o *ChangePasswordParams) SetXRequestID(xRequestID *string) {
+	o.XRequestID = xRequestID
+}
+
+// WithPasswordChangeRequest adds the passwordChangeRequest to the change password params.
+func (o *ChangePasswordParams) WithPasswordChangeRequest(passwordChangeRequest *members_models.PasswordChangeRequest) *ChangePasswordParams {
+	o.SetPasswordChangeRequest(passwordChangeRequest)
+	return o
+}
+
+// SetPasswordChangeRequest adds the passwordChangeRequest to the change password params.
+func (o *ChangePasswordParams) SetPasswordChangeRequest(passwordChangeRequest *members_models.PasswordChangeRequest) {
+	o.PasswordChangeRequest = passwordChangeRequest
+}
+
+// WriteToRequest writes these params to a [runtime.ClientRequest].
+func (o *ChangePasswordParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+	if err := r.SetTimeout(o.inner.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if o.XRequestID != nil {
+
+		// header param X-Request-ID
+		if err := r.SetHeaderParam("X-Request-ID", *o.XRequestID); err != nil {
+			return err
+		}
+	}
+	if o.PasswordChangeRequest != nil {
+		if err := r.SetBodyParam(o.PasswordChangeRequest); err != nil {
+			return err
+		}
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

api/members/members_client/credentials/change_password_responses.go

@@ -0,0 +1,313 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"encoding/json"
+	stderrors "errors"
+	"fmt"
+	"io"
+
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+)
+
+// ChangePasswordReader is a Reader for the ChangePassword structure.
+type ChangePasswordReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ChangePasswordReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (any, error) {
+	switch response.Code() {
+	case 204:
+		result := NewChangePasswordNoContent()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewChangePasswordUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 422:
+		result := NewChangePasswordUnprocessableEntity()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewChangePasswordInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /credentials/password/change] changePassword", response, response.Code())
+	}
+}
+
+// NewChangePasswordNoContent creates a ChangePasswordNoContent with default headers values
+func NewChangePasswordNoContent() *ChangePasswordNoContent {
+	return &ChangePasswordNoContent{}
+}
+
+// ChangePasswordNoContent describes a response with status code 204, with default header values.
+//
+// Password changed; all sessions revoked and fresh login required.
+type ChangePasswordNoContent struct {
+}
+
+// IsSuccess returns true when this change password no content response has a 2xx status code
+func (o *ChangePasswordNoContent) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this change password no content response has a 3xx status code
+func (o *ChangePasswordNoContent) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this change password no content response has a 4xx status code
+func (o *ChangePasswordNoContent) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this change password no content response has a 5xx status code
+func (o *ChangePasswordNoContent) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this change password no content response a status code equal to that given
+func (o *ChangePasswordNoContent) IsCode(code int) bool {
+	return code == 204
+}
+
+// Code gets the status code for the change password no content response
+func (o *ChangePasswordNoContent) Code() int {
+	return 204
+}
+
+func (o *ChangePasswordNoContent) Error() string {
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordNoContent", 204)
+}
+
+func (o *ChangePasswordNoContent) String() string {
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordNoContent", 204)
+}
+
+func (o *ChangePasswordNoContent) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewChangePasswordUnauthorized creates a ChangePasswordUnauthorized with default headers values
+func NewChangePasswordUnauthorized() *ChangePasswordUnauthorized {
+	return &ChangePasswordUnauthorized{}
+}
+
+// ChangePasswordUnauthorized describes a response with status code 401, with default header values.
+//
+// Access Unauthorized, invalid API-KEY was used
+type ChangePasswordUnauthorized struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this change password unauthorized response has a 2xx status code
+func (o *ChangePasswordUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this change password unauthorized response has a 3xx status code
+func (o *ChangePasswordUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this change password unauthorized response has a 4xx status code
+func (o *ChangePasswordUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this change password unauthorized response has a 5xx status code
+func (o *ChangePasswordUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this change password unauthorized response a status code equal to that given
+func (o *ChangePasswordUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the change password unauthorized response
+func (o *ChangePasswordUnauthorized) Code() int {
+	return 401
+}
+
+func (o *ChangePasswordUnauthorized) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordUnauthorized %s", 401, payload)
+}
+
+func (o *ChangePasswordUnauthorized) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordUnauthorized %s", 401, payload)
+}
+
+func (o *ChangePasswordUnauthorized) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *ChangePasswordUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}
+
+// NewChangePasswordUnprocessableEntity creates a ChangePasswordUnprocessableEntity with default headers values
+func NewChangePasswordUnprocessableEntity() *ChangePasswordUnprocessableEntity {
+	return &ChangePasswordUnprocessableEntity{}
+}
+
+// ChangePasswordUnprocessableEntity describes a response with status code 422, with default header values.
+//
+// Unprocessable Entity, likely a bad parameter
+type ChangePasswordUnprocessableEntity struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this change password unprocessable entity response has a 2xx status code
+func (o *ChangePasswordUnprocessableEntity) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this change password unprocessable entity response has a 3xx status code
+func (o *ChangePasswordUnprocessableEntity) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this change password unprocessable entity response has a 4xx status code
+func (o *ChangePasswordUnprocessableEntity) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this change password unprocessable entity response has a 5xx status code
+func (o *ChangePasswordUnprocessableEntity) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this change password unprocessable entity response a status code equal to that given
+func (o *ChangePasswordUnprocessableEntity) IsCode(code int) bool {
+	return code == 422
+}
+
+// Code gets the status code for the change password unprocessable entity response
+func (o *ChangePasswordUnprocessableEntity) Code() int {
+	return 422
+}
+
+func (o *ChangePasswordUnprocessableEntity) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordUnprocessableEntity %s", 422, payload)
+}
+
+func (o *ChangePasswordUnprocessableEntity) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordUnprocessableEntity %s", 422, payload)
+}
+
+func (o *ChangePasswordUnprocessableEntity) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *ChangePasswordUnprocessableEntity) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}
+
+// NewChangePasswordInternalServerError creates a ChangePasswordInternalServerError with default headers values
+func NewChangePasswordInternalServerError() *ChangePasswordInternalServerError {
+	return &ChangePasswordInternalServerError{}
+}
+
+// ChangePasswordInternalServerError describes a response with status code 500, with default header values.
+//
+// Server Internal Error
+type ChangePasswordInternalServerError struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this change password internal server error response has a 2xx status code
+func (o *ChangePasswordInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this change password internal server error response has a 3xx status code
+func (o *ChangePasswordInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this change password internal server error response has a 4xx status code
+func (o *ChangePasswordInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this change password internal server error response has a 5xx status code
+func (o *ChangePasswordInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this change password internal server error response a status code equal to that given
+func (o *ChangePasswordInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the change password internal server error response
+func (o *ChangePasswordInternalServerError) Code() int {
+	return 500
+}
+
+func (o *ChangePasswordInternalServerError) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordInternalServerError %s", 500, payload)
+}
+
+func (o *ChangePasswordInternalServerError) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/change][%d] changePasswordInternalServerError %s", 500, payload)
+}
+
+func (o *ChangePasswordInternalServerError) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *ChangePasswordInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}

api/members/members_client/credentials/complete_password_recovery_parameters.go

@@ -0,0 +1,181 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewCompletePasswordRecoveryParams creates a new CompletePasswordRecoveryParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewCompletePasswordRecoveryParams() *CompletePasswordRecoveryParams {
+	return NewCompletePasswordRecoveryParamsWithTimeout(cr.DefaultTimeout)
+}
+
+// NewCompletePasswordRecoveryParamsWithTimeout creates a new CompletePasswordRecoveryParams object
+// with the ability to set a timeout on a request.
+func NewCompletePasswordRecoveryParamsWithTimeout(timeout time.Duration) *CompletePasswordRecoveryParams {
+	return &CompletePasswordRecoveryParams{
+		inner: innerParams{
+			timeout: timeout,
+		},
+	}
+}
+
+// NewCompletePasswordRecoveryParamsWithContext creates a new CompletePasswordRecoveryParams object
+// with the ability to set a context for a request.
+//
+// Deprecated: use the operation call with context to pass the context instead of [CompletePasswordRecoveryParams].
+func NewCompletePasswordRecoveryParamsWithContext(ctx context.Context) *CompletePasswordRecoveryParams {
+	return &CompletePasswordRecoveryParams{
+		inner: innerParams{
+			ctx: ctx,
+		},
+	}
+}
+
+// NewCompletePasswordRecoveryParamsWithHTTPClient creates a new CompletePasswordRecoveryParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewCompletePasswordRecoveryParamsWithHTTPClient(client *http.Client) *CompletePasswordRecoveryParams {
+	return &CompletePasswordRecoveryParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+CompletePasswordRecoveryParams contains all the parameters to send to the API endpoint
+
+	for the complete password recovery operation.
+
+	Typically these are written to a http.Request.
+*/
+type CompletePasswordRecoveryParams struct {
+
+	// XRequestID.
+	//
+	// Optional bounded correlation identifier stored with membership audit events.
+	XRequestID *string
+
+	// PasswordRecoveryCompletion.
+	PasswordRecoveryCompletion *members_models.PasswordRecoveryCompletion
+
+	HTTPClient *http.Client
+
+	inner innerParams
+}
+
+// WithDefaults hydrates default values in the complete password recovery params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *CompletePasswordRecoveryParams) WithDefaults() *CompletePasswordRecoveryParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the complete password recovery params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *CompletePasswordRecoveryParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) WithTimeout(timeout time.Duration) *CompletePasswordRecoveryParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) SetTimeout(timeout time.Duration) {
+	o.inner.timeout = timeout
+}
+
+// WithContext adds the context to the complete password recovery params.
+//
+// Deprecated: use the operation call with context to pass the context instead of [CompletePasswordRecoveryParams].
+func (o *CompletePasswordRecoveryParams) WithContext(ctx context.Context) *CompletePasswordRecoveryParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the complete password recovery params.
+//
+// Deprecated: use the operation call with context to pass the context instead of [CompletePasswordRecoveryParams].
+func (o *CompletePasswordRecoveryParams) SetContext(ctx context.Context) {
+	o.inner.ctx = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) WithHTTPClient(client *http.Client) *CompletePasswordRecoveryParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithXRequestID adds the xRequestID to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) WithXRequestID(xRequestID *string) *CompletePasswordRecoveryParams {
+	o.SetXRequestID(xRequestID)
+	return o
+}
+
+// SetXRequestID adds the xRequestId to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) SetXRequestID(xRequestID *string) {
+	o.XRequestID = xRequestID
+}
+
+// WithPasswordRecoveryCompletion adds the passwordRecoveryCompletion to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) WithPasswordRecoveryCompletion(passwordRecoveryCompletion *members_models.PasswordRecoveryCompletion) *CompletePasswordRecoveryParams {
+	o.SetPasswordRecoveryCompletion(passwordRecoveryCompletion)
+	return o
+}
+
+// SetPasswordRecoveryCompletion adds the passwordRecoveryCompletion to the complete password recovery params.
+func (o *CompletePasswordRecoveryParams) SetPasswordRecoveryCompletion(passwordRecoveryCompletion *members_models.PasswordRecoveryCompletion) {
+	o.PasswordRecoveryCompletion = passwordRecoveryCompletion
+}
+
+// WriteToRequest writes these params to a [runtime.ClientRequest].
+func (o *CompletePasswordRecoveryParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+	if err := r.SetTimeout(o.inner.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if o.XRequestID != nil {
+
+		// header param X-Request-ID
+		if err := r.SetHeaderParam("X-Request-ID", *o.XRequestID); err != nil {
+			return err
+		}
+	}
+	if o.PasswordRecoveryCompletion != nil {
+		if err := r.SetBodyParam(o.PasswordRecoveryCompletion); err != nil {
+			return err
+		}
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

api/members/members_client/credentials/complete_password_recovery_responses.go

@@ -0,0 +1,313 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"encoding/json"
+	stderrors "errors"
+	"fmt"
+	"io"
+
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+)
+
+// CompletePasswordRecoveryReader is a Reader for the CompletePasswordRecovery structure.
+type CompletePasswordRecoveryReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *CompletePasswordRecoveryReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (any, error) {
+	switch response.Code() {
+	case 204:
+		result := NewCompletePasswordRecoveryNoContent()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewCompletePasswordRecoveryUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 422:
+		result := NewCompletePasswordRecoveryUnprocessableEntity()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewCompletePasswordRecoveryInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /credentials/password/recovery-completions] completePasswordRecovery", response, response.Code())
+	}
+}
+
+// NewCompletePasswordRecoveryNoContent creates a CompletePasswordRecoveryNoContent with default headers values
+func NewCompletePasswordRecoveryNoContent() *CompletePasswordRecoveryNoContent {
+	return &CompletePasswordRecoveryNoContent{}
+}
+
+// CompletePasswordRecoveryNoContent describes a response with status code 204, with default header values.
+//
+// Password reset; all sessions revoked and fresh login required.
+type CompletePasswordRecoveryNoContent struct {
+}
+
+// IsSuccess returns true when this complete password recovery no content response has a 2xx status code
+func (o *CompletePasswordRecoveryNoContent) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this complete password recovery no content response has a 3xx status code
+func (o *CompletePasswordRecoveryNoContent) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this complete password recovery no content response has a 4xx status code
+func (o *CompletePasswordRecoveryNoContent) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this complete password recovery no content response has a 5xx status code
+func (o *CompletePasswordRecoveryNoContent) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this complete password recovery no content response a status code equal to that given
+func (o *CompletePasswordRecoveryNoContent) IsCode(code int) bool {
+	return code == 204
+}
+
+// Code gets the status code for the complete password recovery no content response
+func (o *CompletePasswordRecoveryNoContent) Code() int {
+	return 204
+}
+
+func (o *CompletePasswordRecoveryNoContent) Error() string {
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryNoContent", 204)
+}
+
+func (o *CompletePasswordRecoveryNoContent) String() string {
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryNoContent", 204)
+}
+
+func (o *CompletePasswordRecoveryNoContent) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewCompletePasswordRecoveryUnauthorized creates a CompletePasswordRecoveryUnauthorized with default headers values
+func NewCompletePasswordRecoveryUnauthorized() *CompletePasswordRecoveryUnauthorized {
+	return &CompletePasswordRecoveryUnauthorized{}
+}
+
+// CompletePasswordRecoveryUnauthorized describes a response with status code 401, with default header values.
+//
+// Access Unauthorized, invalid API-KEY was used
+type CompletePasswordRecoveryUnauthorized struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this complete password recovery unauthorized response has a 2xx status code
+func (o *CompletePasswordRecoveryUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this complete password recovery unauthorized response has a 3xx status code
+func (o *CompletePasswordRecoveryUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this complete password recovery unauthorized response has a 4xx status code
+func (o *CompletePasswordRecoveryUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this complete password recovery unauthorized response has a 5xx status code
+func (o *CompletePasswordRecoveryUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this complete password recovery unauthorized response a status code equal to that given
+func (o *CompletePasswordRecoveryUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the complete password recovery unauthorized response
+func (o *CompletePasswordRecoveryUnauthorized) Code() int {
+	return 401
+}
+
+func (o *CompletePasswordRecoveryUnauthorized) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryUnauthorized %s", 401, payload)
+}
+
+func (o *CompletePasswordRecoveryUnauthorized) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryUnauthorized %s", 401, payload)
+}
+
+func (o *CompletePasswordRecoveryUnauthorized) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *CompletePasswordRecoveryUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}
+
+// NewCompletePasswordRecoveryUnprocessableEntity creates a CompletePasswordRecoveryUnprocessableEntity with default headers values
+func NewCompletePasswordRecoveryUnprocessableEntity() *CompletePasswordRecoveryUnprocessableEntity {
+	return &CompletePasswordRecoveryUnprocessableEntity{}
+}
+
+// CompletePasswordRecoveryUnprocessableEntity describes a response with status code 422, with default header values.
+//
+// Invalid, expired, revoked, or consumed token, or invalid password.
+type CompletePasswordRecoveryUnprocessableEntity struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this complete password recovery unprocessable entity response has a 2xx status code
+func (o *CompletePasswordRecoveryUnprocessableEntity) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this complete password recovery unprocessable entity response has a 3xx status code
+func (o *CompletePasswordRecoveryUnprocessableEntity) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this complete password recovery unprocessable entity response has a 4xx status code
+func (o *CompletePasswordRecoveryUnprocessableEntity) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this complete password recovery unprocessable entity response has a 5xx status code
+func (o *CompletePasswordRecoveryUnprocessableEntity) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this complete password recovery unprocessable entity response a status code equal to that given
+func (o *CompletePasswordRecoveryUnprocessableEntity) IsCode(code int) bool {
+	return code == 422
+}
+
+// Code gets the status code for the complete password recovery unprocessable entity response
+func (o *CompletePasswordRecoveryUnprocessableEntity) Code() int {
+	return 422
+}
+
+func (o *CompletePasswordRecoveryUnprocessableEntity) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryUnprocessableEntity %s", 422, payload)
+}
+
+func (o *CompletePasswordRecoveryUnprocessableEntity) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryUnprocessableEntity %s", 422, payload)
+}
+
+func (o *CompletePasswordRecoveryUnprocessableEntity) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *CompletePasswordRecoveryUnprocessableEntity) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}
+
+// NewCompletePasswordRecoveryInternalServerError creates a CompletePasswordRecoveryInternalServerError with default headers values
+func NewCompletePasswordRecoveryInternalServerError() *CompletePasswordRecoveryInternalServerError {
+	return &CompletePasswordRecoveryInternalServerError{}
+}
+
+// CompletePasswordRecoveryInternalServerError describes a response with status code 500, with default header values.
+//
+// Server Internal Error
+type CompletePasswordRecoveryInternalServerError struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this complete password recovery internal server error response has a 2xx status code
+func (o *CompletePasswordRecoveryInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this complete password recovery internal server error response has a 3xx status code
+func (o *CompletePasswordRecoveryInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this complete password recovery internal server error response has a 4xx status code
+func (o *CompletePasswordRecoveryInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this complete password recovery internal server error response has a 5xx status code
+func (o *CompletePasswordRecoveryInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this complete password recovery internal server error response a status code equal to that given
+func (o *CompletePasswordRecoveryInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the complete password recovery internal server error response
+func (o *CompletePasswordRecoveryInternalServerError) Code() int {
+	return 500
+}
+
+func (o *CompletePasswordRecoveryInternalServerError) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryInternalServerError %s", 500, payload)
+}
+
+func (o *CompletePasswordRecoveryInternalServerError) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-completions][%d] completePasswordRecoveryInternalServerError %s", 500, payload)
+}
+
+func (o *CompletePasswordRecoveryInternalServerError) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *CompletePasswordRecoveryInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}

api/members/members_client/credentials/credentials_client.go

@@ -0,0 +1,284 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/go-openapi/runtime"
+	httptransport "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// New creates a new credentials API client.
+func New(transport runtime.ContextualTransport, formats strfmt.Registry) ClientService {
+	return &Client{transport: transport, formats: formats}
+}
+
+// New creates a new credentials API client with basic auth credentials.
+//
+// It takes the following parameters:
+// - host: http host (github.com).
+// - basePath: any base path for the API client ("/v1", "/v3").
+// - scheme: http scheme ("http", "https").
+// - user: user for basic authentication header.
+// - password: password for basic authentication header.
+func NewClientWithBasicAuth(host, basePath, scheme, user, password string) ClientService {
+	transport := httptransport.New(host, basePath, []string{scheme})
+	transport.DefaultAuthentication = httptransport.BasicAuth(user, password)
+	return &Client{transport: transport, formats: strfmt.Default}
+}
+
+// New creates a new credentials API client with a bearer token for authentication.
+//
+// It takes the following parameters:
+// - host: http host (github.com).
+// - basePath: any base path for the API client ("/v1", "/v3").
+// - scheme: http scheme ("http", "https").
+// - bearerToken: bearer token for Bearer authentication header.
+func NewClientWithBearerToken(host, basePath, scheme, bearerToken string) ClientService {
+	transport := httptransport.New(host, basePath, []string{scheme})
+	transport.DefaultAuthentication = httptransport.BearerToken(bearerToken)
+	return &Client{transport: transport, formats: strfmt.Default}
+}
+
+// Client for credentials API.
+type Client struct {
+	transport runtime.ContextualTransport
+	formats   strfmt.Registry
+}
+
+// ClientOption may be used to customize the behavior of Client methods.
+type ClientOption func(*runtime.ClientOperation)
+
+// ClientService is the interface for Client methods.
+type ClientService interface {
+
+	// ChangePassword change the current user s password and revoke every session.
+	ChangePassword(params *ChangePasswordParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ChangePasswordNoContent, error)
+
+	// ChangePasswordContext change the current user s password and revoke every session.
+	ChangePasswordContext(ctx context.Context, params *ChangePasswordParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ChangePasswordNoContent, error)
+
+	// CompletePasswordRecovery consume a single use recovery token and revoke every session.
+	CompletePasswordRecovery(params *CompletePasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CompletePasswordRecoveryNoContent, error)
+
+	// CompletePasswordRecoveryContext consume a single use recovery token and revoke every session.
+	CompletePasswordRecoveryContext(ctx context.Context, params *CompletePasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CompletePasswordRecoveryNoContent, error)
+
+	// RequestPasswordRecovery request password recovery without disclosing account state.
+	RequestPasswordRecovery(params *RequestPasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RequestPasswordRecoveryAccepted, error)
+
+	// RequestPasswordRecoveryContext request password recovery without disclosing account state.
+	RequestPasswordRecoveryContext(ctx context.Context, params *RequestPasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RequestPasswordRecoveryAccepted, error)
+
+	SetTransport(transport runtime.ContextualTransport)
+}
+
+// ChangePassword changes the current user s password and revoke every session.
+//
+// This method does not support injected context.
+// However, timeout and opentracing contexts are honored whenever enabled.
+//
+// If you need to pass a specific context, use [Client.ChangePasswordContext] instead.
+func (a *Client) ChangePassword(params *ChangePasswordParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ChangePasswordNoContent, error) {
+	var ctx context.Context
+	if params.inner.ctx != nil {
+		ctx = params.inner.ctx
+	} else {
+		ctx = context.Background()
+	}
+
+	return a.ChangePasswordContext(ctx, params, authInfo, opts...)
+}
+
+// ChangePasswordContext changes the current user s password and revoke every session.
+//
+// Do not use the deprecated [ChangePasswordParams.Context] with this method: it would be ignored.
+func (a *Client) ChangePasswordContext(ctx context.Context, params *ChangePasswordParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ChangePasswordNoContent, error) {
+	// NOTE: parameters are not validated before sending
+	if params == nil {
+		params = NewChangePasswordParams()
+	}
+
+	op := &runtime.ClientOperation{
+		ID:                 "changePassword",
+		Method:             "POST",
+		PathPattern:        "/credentials/password/change",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &ChangePasswordReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Client:             params.HTTPClient,
+	}
+
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.SubmitContext(ctx, op)
+	if err != nil {
+		return nil, err
+	}
+
+	// only one success response has to be checked
+	success, ok := result.(*ChangePasswordNoContent)
+	if ok {
+		return success, nil
+	}
+
+	// unexpected success response.
+
+	// no default response is defined.
+	//
+	// safeguard: normally, in the absence of a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for changePassword: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+// CompletePasswordRecovery consumes a single use recovery token and revoke every session.
+//
+// This method does not support injected context.
+// However, timeout and opentracing contexts are honored whenever enabled.
+//
+// If you need to pass a specific context, use [Client.CompletePasswordRecoveryContext] instead.
+func (a *Client) CompletePasswordRecovery(params *CompletePasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CompletePasswordRecoveryNoContent, error) {
+	var ctx context.Context
+	if params.inner.ctx != nil {
+		ctx = params.inner.ctx
+	} else {
+		ctx = context.Background()
+	}
+
+	return a.CompletePasswordRecoveryContext(ctx, params, authInfo, opts...)
+}
+
+// CompletePasswordRecoveryContext consumes a single use recovery token and revoke every session.
+//
+// Do not use the deprecated [CompletePasswordRecoveryParams.Context] with this method: it would be ignored.
+func (a *Client) CompletePasswordRecoveryContext(ctx context.Context, params *CompletePasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CompletePasswordRecoveryNoContent, error) {
+	// NOTE: parameters are not validated before sending
+	if params == nil {
+		params = NewCompletePasswordRecoveryParams()
+	}
+
+	op := &runtime.ClientOperation{
+		ID:                 "completePasswordRecovery",
+		Method:             "POST",
+		PathPattern:        "/credentials/password/recovery-completions",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &CompletePasswordRecoveryReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Client:             params.HTTPClient,
+	}
+
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.SubmitContext(ctx, op)
+	if err != nil {
+		return nil, err
+	}
+
+	// only one success response has to be checked
+	success, ok := result.(*CompletePasswordRecoveryNoContent)
+	if ok {
+		return success, nil
+	}
+
+	// unexpected success response.
+
+	// no default response is defined.
+	//
+	// safeguard: normally, in the absence of a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for completePasswordRecovery: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+// RequestPasswordRecovery requests password recovery without disclosing account state.
+//
+// This method does not support injected context.
+// However, timeout and opentracing contexts are honored whenever enabled.
+//
+// If you need to pass a specific context, use [Client.RequestPasswordRecoveryContext] instead.
+func (a *Client) RequestPasswordRecovery(params *RequestPasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RequestPasswordRecoveryAccepted, error) {
+	var ctx context.Context
+	if params.inner.ctx != nil {
+		ctx = params.inner.ctx
+	} else {
+		ctx = context.Background()
+	}
+
+	return a.RequestPasswordRecoveryContext(ctx, params, authInfo, opts...)
+}
+
+// RequestPasswordRecoveryContext requests password recovery without disclosing account state.
+//
+// Do not use the deprecated [RequestPasswordRecoveryParams.Context] with this method: it would be ignored.
+func (a *Client) RequestPasswordRecoveryContext(ctx context.Context, params *RequestPasswordRecoveryParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RequestPasswordRecoveryAccepted, error) {
+	// NOTE: parameters are not validated before sending
+	if params == nil {
+		params = NewRequestPasswordRecoveryParams()
+	}
+
+	op := &runtime.ClientOperation{
+		ID:                 "requestPasswordRecovery",
+		Method:             "POST",
+		PathPattern:        "/credentials/password/recovery-requests",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &RequestPasswordRecoveryReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Client:             params.HTTPClient,
+	}
+
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.SubmitContext(ctx, op)
+	if err != nil {
+		return nil, err
+	}
+
+	// only one success response has to be checked
+	success, ok := result.(*RequestPasswordRecoveryAccepted)
+	if ok {
+		return success, nil
+	}
+
+	// unexpected success response.
+
+	// no default response is defined.
+	//
+	// safeguard: normally, in the absence of a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for requestPasswordRecovery: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+// SetTransport changes the transport on the client
+func (a *Client) SetTransport(transport runtime.ContextualTransport) {
+	a.transport = transport
+}
+
+// innerParams captures internal fields so they don't conflict with user-supplied parameters.
+type innerParams struct {
+	timeout time.Duration
+
+	// Deprecated: use the operation call with context to pass the context instead of [CredentialsParams].
+	ctx context.Context
+}

api/members/members_client/credentials/request_password_recovery_parameters.go

@@ -0,0 +1,205 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewRequestPasswordRecoveryParams creates a new RequestPasswordRecoveryParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewRequestPasswordRecoveryParams() *RequestPasswordRecoveryParams {
+	return NewRequestPasswordRecoveryParamsWithTimeout(cr.DefaultTimeout)
+}
+
+// NewRequestPasswordRecoveryParamsWithTimeout creates a new RequestPasswordRecoveryParams object
+// with the ability to set a timeout on a request.
+func NewRequestPasswordRecoveryParamsWithTimeout(timeout time.Duration) *RequestPasswordRecoveryParams {
+	return &RequestPasswordRecoveryParams{
+		inner: innerParams{
+			timeout: timeout,
+		},
+	}
+}
+
+// NewRequestPasswordRecoveryParamsWithContext creates a new RequestPasswordRecoveryParams object
+// with the ability to set a context for a request.
+//
+// Deprecated: use the operation call with context to pass the context instead of [RequestPasswordRecoveryParams].
+func NewRequestPasswordRecoveryParamsWithContext(ctx context.Context) *RequestPasswordRecoveryParams {
+	return &RequestPasswordRecoveryParams{
+		inner: innerParams{
+			ctx: ctx,
+		},
+	}
+}
+
+// NewRequestPasswordRecoveryParamsWithHTTPClient creates a new RequestPasswordRecoveryParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewRequestPasswordRecoveryParamsWithHTTPClient(client *http.Client) *RequestPasswordRecoveryParams {
+	return &RequestPasswordRecoveryParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+RequestPasswordRecoveryParams contains all the parameters to send to the API endpoint
+
+	for the request password recovery operation.
+
+	Typically these are written to a http.Request.
+*/
+type RequestPasswordRecoveryParams struct {
+
+	// XKVClientIP.
+	//
+	// Original network client IP asserted by the authenticated KV ID server; used only to derive a keyed throttle bucket and never stored raw.
+	XKVClientIP *string
+
+	// XRequestID.
+	//
+	// Optional bounded correlation identifier stored with membership audit events.
+	XRequestID *string
+
+	// PasswordRecoveryRequest.
+	PasswordRecoveryRequest *members_models.PasswordRecoveryRequest
+
+	HTTPClient *http.Client
+
+	inner innerParams
+}
+
+// WithDefaults hydrates default values in the request password recovery params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *RequestPasswordRecoveryParams) WithDefaults() *RequestPasswordRecoveryParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the request password recovery params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *RequestPasswordRecoveryParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) WithTimeout(timeout time.Duration) *RequestPasswordRecoveryParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) SetTimeout(timeout time.Duration) {
+	o.inner.timeout = timeout
+}
+
+// WithContext adds the context to the request password recovery params.
+//
+// Deprecated: use the operation call with context to pass the context instead of [RequestPasswordRecoveryParams].
+func (o *RequestPasswordRecoveryParams) WithContext(ctx context.Context) *RequestPasswordRecoveryParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the request password recovery params.
+//
+// Deprecated: use the operation call with context to pass the context instead of [RequestPasswordRecoveryParams].
+func (o *RequestPasswordRecoveryParams) SetContext(ctx context.Context) {
+	o.inner.ctx = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) WithHTTPClient(client *http.Client) *RequestPasswordRecoveryParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithXKVClientIP adds the xKVClientIP to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) WithXKVClientIP(xKVClientIP *string) *RequestPasswordRecoveryParams {
+	o.SetXKVClientIP(xKVClientIP)
+	return o
+}
+
+// SetXKVClientIP adds the xKVClientIp to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) SetXKVClientIP(xKVClientIP *string) {
+	o.XKVClientIP = xKVClientIP
+}
+
+// WithXRequestID adds the xRequestID to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) WithXRequestID(xRequestID *string) *RequestPasswordRecoveryParams {
+	o.SetXRequestID(xRequestID)
+	return o
+}
+
+// SetXRequestID adds the xRequestId to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) SetXRequestID(xRequestID *string) {
+	o.XRequestID = xRequestID
+}
+
+// WithPasswordRecoveryRequest adds the passwordRecoveryRequest to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) WithPasswordRecoveryRequest(passwordRecoveryRequest *members_models.PasswordRecoveryRequest) *RequestPasswordRecoveryParams {
+	o.SetPasswordRecoveryRequest(passwordRecoveryRequest)
+	return o
+}
+
+// SetPasswordRecoveryRequest adds the passwordRecoveryRequest to the request password recovery params.
+func (o *RequestPasswordRecoveryParams) SetPasswordRecoveryRequest(passwordRecoveryRequest *members_models.PasswordRecoveryRequest) {
+	o.PasswordRecoveryRequest = passwordRecoveryRequest
+}
+
+// WriteToRequest writes these params to a [runtime.ClientRequest].
+func (o *RequestPasswordRecoveryParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+	if err := r.SetTimeout(o.inner.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if o.XKVClientIP != nil {
+
+		// header param X-KV-Client-IP
+		if err := r.SetHeaderParam("X-KV-Client-IP", *o.XKVClientIP); err != nil {
+			return err
+		}
+	}
+
+	if o.XRequestID != nil {
+
+		// header param X-Request-ID
+		if err := r.SetHeaderParam("X-Request-ID", *o.XRequestID); err != nil {
+			return err
+		}
+	}
+	if o.PasswordRecoveryRequest != nil {
+		if err := r.SetBodyParam(o.PasswordRecoveryRequest); err != nil {
+			return err
+		}
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

api/members/members_client/credentials/request_password_recovery_responses.go

@@ -0,0 +1,253 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package credentials
+
+import (
+	"encoding/json"
+	stderrors "errors"
+	"fmt"
+	"io"
+
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+)
+
+// RequestPasswordRecoveryReader is a Reader for the RequestPasswordRecovery structure.
+type RequestPasswordRecoveryReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *RequestPasswordRecoveryReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (any, error) {
+	switch response.Code() {
+	case 202:
+		result := NewRequestPasswordRecoveryAccepted()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewRequestPasswordRecoveryUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewRequestPasswordRecoveryInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /credentials/password/recovery-requests] requestPasswordRecovery", response, response.Code())
+	}
+}
+
+// NewRequestPasswordRecoveryAccepted creates a RequestPasswordRecoveryAccepted with default headers values
+func NewRequestPasswordRecoveryAccepted() *RequestPasswordRecoveryAccepted {
+	return &RequestPasswordRecoveryAccepted{}
+}
+
+// RequestPasswordRecoveryAccepted describes a response with status code 202, with default header values.
+//
+// Uniform accepted response for every account state.
+type RequestPasswordRecoveryAccepted struct {
+	Payload *members_models.PasswordRecoveryAccepted
+}
+
+// IsSuccess returns true when this request password recovery accepted response has a 2xx status code
+func (o *RequestPasswordRecoveryAccepted) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this request password recovery accepted response has a 3xx status code
+func (o *RequestPasswordRecoveryAccepted) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this request password recovery accepted response has a 4xx status code
+func (o *RequestPasswordRecoveryAccepted) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this request password recovery accepted response has a 5xx status code
+func (o *RequestPasswordRecoveryAccepted) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this request password recovery accepted response a status code equal to that given
+func (o *RequestPasswordRecoveryAccepted) IsCode(code int) bool {
+	return code == 202
+}
+
+// Code gets the status code for the request password recovery accepted response
+func (o *RequestPasswordRecoveryAccepted) Code() int {
+	return 202
+}
+
+func (o *RequestPasswordRecoveryAccepted) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-requests][%d] requestPasswordRecoveryAccepted %s", 202, payload)
+}
+
+func (o *RequestPasswordRecoveryAccepted) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-requests][%d] requestPasswordRecoveryAccepted %s", 202, payload)
+}
+
+func (o *RequestPasswordRecoveryAccepted) GetPayload() *members_models.PasswordRecoveryAccepted {
+	return o.Payload
+}
+
+func (o *RequestPasswordRecoveryAccepted) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.PasswordRecoveryAccepted)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}
+
+// NewRequestPasswordRecoveryUnauthorized creates a RequestPasswordRecoveryUnauthorized with default headers values
+func NewRequestPasswordRecoveryUnauthorized() *RequestPasswordRecoveryUnauthorized {
+	return &RequestPasswordRecoveryUnauthorized{}
+}
+
+// RequestPasswordRecoveryUnauthorized describes a response with status code 401, with default header values.
+//
+// Access Unauthorized, invalid API-KEY was used
+type RequestPasswordRecoveryUnauthorized struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this request password recovery unauthorized response has a 2xx status code
+func (o *RequestPasswordRecoveryUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this request password recovery unauthorized response has a 3xx status code
+func (o *RequestPasswordRecoveryUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this request password recovery unauthorized response has a 4xx status code
+func (o *RequestPasswordRecoveryUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this request password recovery unauthorized response has a 5xx status code
+func (o *RequestPasswordRecoveryUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this request password recovery unauthorized response a status code equal to that given
+func (o *RequestPasswordRecoveryUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the request password recovery unauthorized response
+func (o *RequestPasswordRecoveryUnauthorized) Code() int {
+	return 401
+}
+
+func (o *RequestPasswordRecoveryUnauthorized) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-requests][%d] requestPasswordRecoveryUnauthorized %s", 401, payload)
+}
+
+func (o *RequestPasswordRecoveryUnauthorized) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-requests][%d] requestPasswordRecoveryUnauthorized %s", 401, payload)
+}
+
+func (o *RequestPasswordRecoveryUnauthorized) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *RequestPasswordRecoveryUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}
+
+// NewRequestPasswordRecoveryInternalServerError creates a RequestPasswordRecoveryInternalServerError with default headers values
+func NewRequestPasswordRecoveryInternalServerError() *RequestPasswordRecoveryInternalServerError {
+	return &RequestPasswordRecoveryInternalServerError{}
+}
+
+// RequestPasswordRecoveryInternalServerError describes a response with status code 500, with default header values.
+//
+// Server Internal Error
+type RequestPasswordRecoveryInternalServerError struct {
+	Payload *members_models.Error
+}
+
+// IsSuccess returns true when this request password recovery internal server error response has a 2xx status code
+func (o *RequestPasswordRecoveryInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this request password recovery internal server error response has a 3xx status code
+func (o *RequestPasswordRecoveryInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this request password recovery internal server error response has a 4xx status code
+func (o *RequestPasswordRecoveryInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this request password recovery internal server error response has a 5xx status code
+func (o *RequestPasswordRecoveryInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this request password recovery internal server error response a status code equal to that given
+func (o *RequestPasswordRecoveryInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the request password recovery internal server error response
+func (o *RequestPasswordRecoveryInternalServerError) Code() int {
+	return 500
+}
+
+func (o *RequestPasswordRecoveryInternalServerError) Error() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-requests][%d] requestPasswordRecoveryInternalServerError %s", 500, payload)
+}
+
+func (o *RequestPasswordRecoveryInternalServerError) String() string {
+	payload, _ := json.Marshal(o.Payload)
+	return fmt.Sprintf("[POST /credentials/password/recovery-requests][%d] requestPasswordRecoveryInternalServerError %s", 500, payload)
+}
+
+func (o *RequestPasswordRecoveryInternalServerError) GetPayload() *members_models.Error {
+	return o.Payload
+}
+
+func (o *RequestPasswordRecoveryInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(members_models.Error)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+
+	return nil
+}

api/members/members_client/members_client.go

@@ -13,6 +13,7 @@ import (
 	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/certificates"
 	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/clusters"
 	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/courses"
+	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/credentials"
 	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/databases"
 	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/documents"
 	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/emails"
@@ -89,6 +90,7 @@ func New(transport runtime.ContextualTransport, formats strfmt.Registry) *Member
 	cli.Certificates = certificates.New(transport, formats)
 	cli.Clusters = clusters.New(transport, formats)
 	cli.Courses = courses.New(transport, formats)
+	cli.Credentials = credentials.New(transport, formats)
 	cli.Databases = databases.New(transport, formats)
 	cli.Documents = documents.New(transport, formats)
 	cli.Emails = emails.New(transport, formats)
@@ -180,6 +182,8 @@ type Members struct {
 
 	Courses courses.ClientService
 
+	Credentials credentials.ClientService
+
 	Databases databases.ClientService
 
 	Documents documents.ClientService
@@ -238,6 +242,7 @@ func (c *Members) SetTransport(transport runtime.ContextualTransport) {
 	c.Certificates.SetTransport(transport)
 	c.Clusters.SetTransport(transport)
 	c.Courses.SetTransport(transport)
+	c.Credentials.SetTransport(transport)
 	c.Databases.SetTransport(transport)
 	c.Documents.SetTransport(transport)
 	c.Emails.SetTransport(transport)

api/members/members_client/users/get_users_parameters.go

@@ -69,7 +69,7 @@ type GetUsersParams struct {
 
 	// Auth0UserID.
 	//
-	// External Auth0 User ID
+	// Deprecated external identity subject lookup. Password-verifier-shaped values are always rejected.
 	Auth0UserID *string
 
 	// ContactID.
@@ -82,6 +82,16 @@ type GetUsersParams struct {
 	// Email address
 	Email *string
 
+	// IdentityProvider.
+	//
+	// Normalized external identity provider used together with identitySubject.
+	IdentityProvider *string
+
+	// IdentitySubject.
+	//
+	// External provider subject used together with identityProvider.
+	IdentitySubject *string
+
 	// Limit.
 	//
 	// How many objects to return at one time
@@ -191,6 +201,28 @@ func (o *GetUsersParams) SetEmail(email *string) {
 	o.Email = email
 }
 
+// WithIdentityProvider adds the identityProvider to the get users params.
+func (o *GetUsersParams) WithIdentityProvider(identityProvider *string) *GetUsersParams {
+	o.SetIdentityProvider(identityProvider)
+	return o
+}
+
+// SetIdentityProvider adds the identityProvider to the get users params.
+func (o *GetUsersParams) SetIdentityProvider(identityProvider *string) {
+	o.IdentityProvider = identityProvider
+}
+
+// WithIdentitySubject adds the identitySubject to the get users params.
+func (o *GetUsersParams) WithIdentitySubject(identitySubject *string) *GetUsersParams {
+	o.SetIdentitySubject(identitySubject)
+	return o
+}
+
+// SetIdentitySubject adds the identitySubject to the get users params.
+func (o *GetUsersParams) SetIdentitySubject(identitySubject *string) {
+	o.IdentitySubject = identitySubject
+}
+
 // WithLimit adds the limit to the get users params.
 func (o *GetUsersParams) WithLimit(limit *int64) *GetUsersParams {
 	o.SetLimit(limit)
@@ -282,6 +314,40 @@ func (o *GetUsersParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Regi
 		}
 	}
 
+	if o.IdentityProvider != nil {
+
+		// query param identityProvider
+		var qrIdentityProvider string
+
+		if o.IdentityProvider != nil {
+			qrIdentityProvider = *o.IdentityProvider
+		}
+		qIdentityProvider := qrIdentityProvider
+		if qIdentityProvider != "" {
+
+			if err := r.SetQueryParam("identityProvider", qIdentityProvider); err != nil {
+				return err
+			}
+		}
+	}
+
+	if o.IdentitySubject != nil {
+
+		// query param identitySubject
+		var qrIdentitySubject string
+
+		if o.IdentitySubject != nil {
+			qrIdentitySubject = *o.IdentitySubject
+		}
+		qIdentitySubject := qrIdentitySubject
+		if qIdentitySubject != "" {
+
+			if err := r.SetQueryParam("identitySubject", qIdentitySubject); err != nil {
+				return err
+			}
+		}
+	}
+
 	if o.Limit != nil {
 
 		// query param limit

api/members/members_models/onboard_request.go

@@ -34,9 +34,8 @@ type OnboardRequest struct {
 	// Last name
 	LastName string `json:"lastName,omitempty"`
 
-	// Plaintext password; hashed server-side as bcrypt(password+pepper)
+	// Plaintext password; Members enforces 12-64 valid UTF-8 bytes before hashing.
 	// Required: true
-	// Min Length: 12
 	// Format: password
 	Password *strfmt.Password `json:"password"`
 }
@@ -78,10 +77,6 @@ func (m *OnboardRequest) validatePassword(formats strfmt.Registry) error {
 		return err
 	}
 
-	if err := validate.MinLength("password", "body", m.Password.String(), 12); err != nil {
-		return err
-	}
-
 	if err := validate.FormatOf("password", "body", "password", m.Password.String(), formats); err != nil {
 		return err
 	}

api/members/members_models/password_change_request.go

@@ -0,0 +1,99 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package members_models
+
+import (
+	"context"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag/jsonutils"
+	"github.com/go-openapi/validate"
+)
+
+// PasswordChangeRequest Secret-bearing request. Values are never logged, stored raw, echoed, or generated into response models.
+//
+// swagger:model PasswordChangeRequest
+type PasswordChangeRequest struct {
+
+	// Plaintext current password; verified only in memory and never logged.
+	// Required: true
+	// Format: password
+	CurrentPassword *strfmt.Password `json:"currentPassword"`
+
+	// Plaintext new password; Members enforces 12-64 valid UTF-8 bytes.
+	// Required: true
+	// Format: password
+	NewPassword *strfmt.Password `json:"newPassword"`
+}
+
+// Validate validates this password change request
+func (m *PasswordChangeRequest) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateCurrentPassword(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateNewPassword(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *PasswordChangeRequest) validateCurrentPassword(formats strfmt.Registry) error {
+
+	if err := validate.Required("currentPassword", "body", m.CurrentPassword); err != nil {
+		return err
+	}
+
+	if err := validate.FormatOf("currentPassword", "body", "password", m.CurrentPassword.String(), formats); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *PasswordChangeRequest) validateNewPassword(formats strfmt.Registry) error {
+
+	if err := validate.Required("newPassword", "body", m.NewPassword); err != nil {
+		return err
+	}
+
+	if err := validate.FormatOf("newPassword", "body", "password", m.NewPassword.String(), formats); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ContextValidate validates this password change request based on context it is used
+func (m *PasswordChangeRequest) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *PasswordChangeRequest) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return jsonutils.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *PasswordChangeRequest) UnmarshalBinary(b []byte) error {
+	var res PasswordChangeRequest
+	if err := jsonutils.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

api/members/members_models/password_recovery_accepted.go

@@ -0,0 +1,105 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package members_models
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag/jsonutils"
+	"github.com/go-openapi/validate"
+)
+
+// PasswordRecoveryAccepted password recovery accepted
+//
+// swagger:model PasswordRecoveryAccepted
+type PasswordRecoveryAccepted struct {
+
+	// status
+	// Required: true
+	// Enum: ["accepted"]
+	Status *string `json:"status"`
+}
+
+// Validate validates this password recovery accepted
+func (m *PasswordRecoveryAccepted) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateStatus(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+var passwordRecoveryAcceptedTypeStatusPropEnum []any
+
+func init() {
+	var res []string
+	if err := json.Unmarshal([]byte(`["accepted"]`), &res); err != nil {
+		panic(err)
+	}
+	for _, v := range res {
+		passwordRecoveryAcceptedTypeStatusPropEnum = append(passwordRecoveryAcceptedTypeStatusPropEnum, v)
+	}
+}
+
+const (
+
+	// PasswordRecoveryAcceptedStatusAccepted captures enum value "accepted"
+	PasswordRecoveryAcceptedStatusAccepted string = "accepted"
+)
+
+// prop value enum
+func (m *PasswordRecoveryAccepted) validateStatusEnum(path, location string, value string) error {
+	if err := validate.EnumCase(path, location, value, passwordRecoveryAcceptedTypeStatusPropEnum, true); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (m *PasswordRecoveryAccepted) validateStatus(formats strfmt.Registry) error {
+
+	if err := validate.Required("status", "body", m.Status); err != nil {
+		return err
+	}
+
+	// value enum
+	if err := m.validateStatusEnum("status", "body", *m.Status); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ContextValidate validates this password recovery accepted based on context it is used
+func (m *PasswordRecoveryAccepted) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *PasswordRecoveryAccepted) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return jsonutils.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *PasswordRecoveryAccepted) UnmarshalBinary(b []byte) error {
+	var res PasswordRecoveryAccepted
+	if err := jsonutils.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

api/members/members_models/password_recovery_completion.go

@@ -0,0 +1,104 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package members_models
+
+import (
+	"context"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag/jsonutils"
+	"github.com/go-openapi/validate"
+)
+
+// PasswordRecoveryCompletion Secret-bearing single-use recovery completion request.
+//
+// swagger:model PasswordRecoveryCompletion
+type PasswordRecoveryCompletion struct {
+
+	// Plaintext new password; Members enforces 12-64 valid UTF-8 bytes.
+	// Required: true
+	// Format: password
+	NewPassword *strfmt.Password `json:"newPassword"`
+
+	// token
+	// Required: true
+	// Max Length: 512
+	// Min Length: 32
+	Token *string `json:"token"`
+}
+
+// Validate validates this password recovery completion
+func (m *PasswordRecoveryCompletion) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateNewPassword(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateToken(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *PasswordRecoveryCompletion) validateNewPassword(formats strfmt.Registry) error {
+
+	if err := validate.Required("newPassword", "body", m.NewPassword); err != nil {
+		return err
+	}
+
+	if err := validate.FormatOf("newPassword", "body", "password", m.NewPassword.String(), formats); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *PasswordRecoveryCompletion) validateToken(formats strfmt.Registry) error {
+
+	if err := validate.Required("token", "body", m.Token); err != nil {
+		return err
+	}
+
+	if err := validate.MinLength("token", "body", *m.Token, 32); err != nil {
+		return err
+	}
+
+	if err := validate.MaxLength("token", "body", *m.Token, 512); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ContextValidate validates this password recovery completion based on context it is used
+func (m *PasswordRecoveryCompletion) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *PasswordRecoveryCompletion) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return jsonutils.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *PasswordRecoveryCompletion) UnmarshalBinary(b []byte) error {
+	var res PasswordRecoveryCompletion
+	if err := jsonutils.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

api/members/members_models/password_recovery_request.go

@@ -0,0 +1,82 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+// (c) 2012-2020 by Taxnexus, Inc.
+// All rights reserved worldwide.
+// Proprietary product; unlicensed use is not allowed
+
+package members_models
+
+import (
+	"context"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag/jsonutils"
+	"github.com/go-openapi/validate"
+)
+
+// PasswordRecoveryRequest Recovery selector accepted uniformly regardless of account state.
+//
+// swagger:model PasswordRecoveryRequest
+type PasswordRecoveryRequest struct {
+
+	// email
+	// Required: true
+	// Max Length: 320
+	// Format: email
+	Email *strfmt.Email `json:"email"`
+}
+
+// Validate validates this password recovery request
+func (m *PasswordRecoveryRequest) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateEmail(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *PasswordRecoveryRequest) validateEmail(formats strfmt.Registry) error {
+
+	if err := validate.Required("email", "body", m.Email); err != nil {
+		return err
+	}
+
+	if err := validate.MaxLength("email", "body", m.Email.String(), 320); err != nil {
+		return err
+	}
+
+	if err := validate.FormatOf("email", "body", "email", m.Email.String(), formats); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ContextValidate validates this password recovery request based on context it is used
+func (m *PasswordRecoveryRequest) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *PasswordRecoveryRequest) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return jsonutils.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *PasswordRecoveryRequest) UnmarshalBinary(b []byte) error {
+	var res PasswordRecoveryRequest
+	if err := jsonutils.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

swagger/external/members-vernonkeenan.yaml

@@ -383,11 +383,34 @@ parameters:
     required: false
     type: boolean
   auth0UserIdQuery:
-    description: External Auth0 User ID
+    description: Deprecated external identity subject lookup. Password-verifier-shaped values are always rejected.
     in: query
     name: auth0UserId
     required: false
     type: string
+  identityProviderQuery:
+    description: Normalized external identity provider used together with identitySubject.
+    in: query
+    name: identityProvider
+    required: false
+    type: string
+    minLength: 1
+    maxLength: 64
+  recoveryClientIP:
+    description: Original network client IP asserted by the authenticated KV ID server; used only to derive a keyed throttle bucket and never stored raw.
+    in: header
+    name: X-KV-Client-IP
+    required: false
+    type: string
+    maxLength: 64
+  identitySubjectQuery:
+    description: External provider subject used together with identityProvider.
+    in: query
+    name: identitySubject
+    required: false
+    type: string
+    minLength: 1
+    maxLength: 255
   userIdQuery:
     description: Internal User ID
     in: query
@@ -1338,6 +1361,70 @@ paths:
         409: {description: "Optimistic, self-change, owner, or state conflict"}
         500: {description: Server error}
       security: *portalSecurity
+  /credentials/password/change:
+    post:
+      tags: [credentials]
+      summary: Change the current user's password and revoke every session
+      operationId: changePassword
+      security:
+        - ApiKeyAuth: []
+          kvSessionCookie: []
+      parameters:
+        - $ref: "#/parameters/requestId"
+        - name: passwordChangeRequest
+          in: body
+          required: true
+          schema: {$ref: "#/definitions/PasswordChangeRequest"}
+      responses:
+        204:
+          description: Password changed; all sessions revoked and fresh login required.
+        401: {$ref: "#/responses/Unauthorized"}
+        422: {$ref: "#/responses/UnprocessableEntity"}
+        500: {$ref: "#/responses/ServerError"}
+
+  /credentials/password/recovery-requests:
+    post:
+      tags: [credentials]
+      summary: Request password recovery without disclosing account state
+      operationId: requestPasswordRecovery
+      security:
+        - ApiKeyAuth: []
+      parameters:
+        - $ref: "#/parameters/requestId"
+        - $ref: "#/parameters/recoveryClientIP"
+        - name: passwordRecoveryRequest
+          in: body
+          required: true
+          schema: {$ref: "#/definitions/PasswordRecoveryRequest"}
+      responses:
+        202:
+          description: Uniform accepted response for every account state.
+          schema: {$ref: "#/definitions/PasswordRecoveryAccepted"}
+        401: {$ref: "#/responses/Unauthorized"}
+        500: {$ref: "#/responses/ServerError"}
+
+  /credentials/password/recovery-completions:
+    post:
+      tags: [credentials]
+      summary: Consume a single-use recovery token and revoke every session
+      operationId: completePasswordRecovery
+      security:
+        - ApiKeyAuth: []
+      parameters:
+        - $ref: "#/parameters/requestId"
+        - name: passwordRecoveryCompletion
+          in: body
+          required: true
+          schema: {$ref: "#/definitions/PasswordRecoveryCompletion"}
+      responses:
+        204:
+          description: Password reset; all sessions revoked and fresh login required.
+        401: {$ref: "#/responses/Unauthorized"}
+        422:
+          description: Invalid, expired, revoked, or consumed token, or invalid password.
+          schema: {$ref: "../../lib/swagger/defs/error.yaml#/Error"}
+        500: {$ref: "#/responses/ServerError"}
+
   /sessions:
     post:
       tags: [sessions]
@@ -3841,6 +3928,8 @@ paths:
         - $ref: "#/parameters/offsetQuery"
         - $ref: "#/parameters/emailQuery"
         - $ref: "#/parameters/auth0UserIdQuery"
+        - $ref: "#/parameters/identityProviderQuery"
+        - $ref: "#/parameters/identitySubjectQuery"
         - $ref: "#/parameters/userIdQuery"
         - $ref: "#/parameters/contactIdQuery"
       responses:
@@ -4182,10 +4271,9 @@ definitions:
         type: string
         format: email
       password:
-        description: Plaintext password; hashed server-side as bcrypt(password+pepper)
         type: string
         format: password
-        minLength: 12
+        description: Plaintext password; Members enforces 12-64 valid UTF-8 bytes before hashing.
       firstName:
         description: First name
         type: string
@@ -4195,6 +4283,48 @@ definitions:
       companyName:
         description: Company name
         type: string
+  PasswordChangeRequest:
+    description: Secret-bearing request. Values are never logged, stored raw, echoed, or generated into response models.
+    type: object
+    required: [currentPassword, newPassword]
+    properties:
+      currentPassword:
+        type: string
+        format: password
+        description: Plaintext current password; verified only in memory and never logged.
+      newPassword:
+        type: string
+        format: password
+        description: Plaintext new password; Members enforces 12-64 valid UTF-8 bytes.
+  PasswordRecoveryRequest:
+    description: Recovery selector accepted uniformly regardless of account state.
+    type: object
+    required: [email]
+    properties:
+      email:
+        type: string
+        format: email
+        maxLength: 320
+  PasswordRecoveryCompletion:
+    description: Secret-bearing single-use recovery completion request.
+    type: object
+    required: [token, newPassword]
+    properties:
+      token:
+        type: string
+        minLength: 32
+        maxLength: 512
+      newPassword:
+        type: string
+        format: password
+        description: Plaintext new password; Members enforces 12-64 valid UTF-8 bytes.
+  PasswordRecoveryAccepted:
+    type: object
+    required: [status]
+    properties:
+      status:
+        type: string
+        enum: [accepted]
   AttendeeRequest:
     description: An array of Attendee objects
     properties:

swagger/members-vernonkeenan.yaml

@@ -383,11 +383,34 @@ parameters:
     required: false
     type: boolean
   auth0UserIdQuery:
-    description: External Auth0 User ID
+    description: Deprecated external identity subject lookup. Password-verifier-shaped values are always rejected.
     in: query
     name: auth0UserId
     required: false
     type: string
+  identityProviderQuery:
+    description: Normalized external identity provider used together with identitySubject.
+    in: query
+    name: identityProvider
+    required: false
+    type: string
+    minLength: 1
+    maxLength: 64
+  recoveryClientIP:
+    description: Original network client IP asserted by the authenticated KV ID server; used only to derive a keyed throttle bucket and never stored raw.
+    in: header
+    name: X-KV-Client-IP
+    required: false
+    type: string
+    maxLength: 64
+  identitySubjectQuery:
+    description: External provider subject used together with identityProvider.
+    in: query
+    name: identitySubject
+    required: false
+    type: string
+    minLength: 1
+    maxLength: 255
   userIdQuery:
     description: Internal User ID
     in: query
@@ -1338,6 +1361,70 @@ paths:
         409: {description: "Optimistic, self-change, owner, or state conflict"}
         500: {description: Server error}
       security: *portalSecurity
+  /credentials/password/change:
+    post:
+      tags: [credentials]
+      summary: Change the current user's password and revoke every session
+      operationId: changePassword
+      security:
+        - ApiKeyAuth: []
+          kvSessionCookie: []
+      parameters:
+        - $ref: "#/parameters/requestId"
+        - name: passwordChangeRequest
+          in: body
+          required: true
+          schema: {$ref: "#/definitions/PasswordChangeRequest"}
+      responses:
+        204:
+          description: Password changed; all sessions revoked and fresh login required.
+        401: {$ref: "#/responses/Unauthorized"}
+        422: {$ref: "#/responses/UnprocessableEntity"}
+        500: {$ref: "#/responses/ServerError"}
+
+  /credentials/password/recovery-requests:
+    post:
+      tags: [credentials]
+      summary: Request password recovery without disclosing account state
+      operationId: requestPasswordRecovery
+      security:
+        - ApiKeyAuth: []
+      parameters:
+        - $ref: "#/parameters/requestId"
+        - $ref: "#/parameters/recoveryClientIP"
+        - name: passwordRecoveryRequest
+          in: body
+          required: true
+          schema: {$ref: "#/definitions/PasswordRecoveryRequest"}
+      responses:
+        202:
+          description: Uniform accepted response for every account state.
+          schema: {$ref: "#/definitions/PasswordRecoveryAccepted"}
+        401: {$ref: "#/responses/Unauthorized"}
+        500: {$ref: "#/responses/ServerError"}
+
+  /credentials/password/recovery-completions:
+    post:
+      tags: [credentials]
+      summary: Consume a single-use recovery token and revoke every session
+      operationId: completePasswordRecovery
+      security:
+        - ApiKeyAuth: []
+      parameters:
+        - $ref: "#/parameters/requestId"
+        - name: passwordRecoveryCompletion
+          in: body
+          required: true
+          schema: {$ref: "#/definitions/PasswordRecoveryCompletion"}
+      responses:
+        204:
+          description: Password reset; all sessions revoked and fresh login required.
+        401: {$ref: "#/responses/Unauthorized"}
+        422:
+          description: Invalid, expired, revoked, or consumed token, or invalid password.
+          schema: {$ref: "../../lib/swagger/defs/error.yaml#/Error"}
+        500: {$ref: "#/responses/ServerError"}
+
   /sessions:
     post:
       tags: [sessions]
@@ -3841,6 +3928,8 @@ paths:
         - $ref: "#/parameters/offsetQuery"
         - $ref: "#/parameters/emailQuery"
         - $ref: "#/parameters/auth0UserIdQuery"
+        - $ref: "#/parameters/identityProviderQuery"
+        - $ref: "#/parameters/identitySubjectQuery"
         - $ref: "#/parameters/userIdQuery"
         - $ref: "#/parameters/contactIdQuery"
       responses:
@@ -4182,10 +4271,9 @@ definitions:
         type: string
         format: email
       password:
-        description: Plaintext password; hashed server-side as bcrypt(password+pepper)
         type: string
         format: password
-        minLength: 12
+        description: Plaintext password; Members enforces 12-64 valid UTF-8 bytes before hashing.
       firstName:
         description: First name
         type: string
@@ -4195,6 +4283,48 @@ definitions:
       companyName:
         description: Company name
         type: string
+  PasswordChangeRequest:
+    description: Secret-bearing request. Values are never logged, stored raw, echoed, or generated into response models.
+    type: object
+    required: [currentPassword, newPassword]
+    properties:
+      currentPassword:
+        type: string
+        format: password
+        description: Plaintext current password; verified only in memory and never logged.
+      newPassword:
+        type: string
+        format: password
+        description: Plaintext new password; Members enforces 12-64 valid UTF-8 bytes.
+  PasswordRecoveryRequest:
+    description: Recovery selector accepted uniformly regardless of account state.
+    type: object
+    required: [email]
+    properties:
+      email:
+        type: string
+        format: email
+        maxLength: 320
+  PasswordRecoveryCompletion:
+    description: Secret-bearing single-use recovery completion request.
+    type: object
+    required: [token, newPassword]
+    properties:
+      token:
+        type: string
+        minLength: 32
+        maxLength: 512
+      newPassword:
+        type: string
+        format: password
+        description: Plaintext new password; Members enforces 12-64 valid UTF-8 bytes.
+  PasswordRecoveryAccepted:
+    type: object
+    required: [status]
+    properties:
+      status:
+        type: string
+        enum: [accepted]
   AttendeeRequest:
     description: An array of Attendee objects
     properties: