Log completed password resets as $profile_reset

app.py

@@ -286,7 +286,7 @@ def evaluate_new_password():
     else:
         castle_status = "$succeeded"
 
-    castle_type = "$password_reset"
+    castle_type = "$profile_reset"
 
     payload_to_castle = {
         'type': castle_type,
@@ -299,7 +299,7 @@ def evaluate_new_password():
         'request_token': request_token
     }
 
-    # $password_reset is a good fit for the non-blocking log endpoint: we want
+    # $profile_reset is a good fit for the non-blocking log endpoint: we want
     # to record the event without waiting on a verdict.
     castle = Client.from_request(request)
     castle.log(payload_to_castle)

demo_config.py

@@ -19,7 +19,7 @@
     },
     "password_reset": {
         "friendly_name": "password reset",
-        "blurb": "Record a password-reset event with the non-blocking log endpoint."
+        "blurb": "Record a password-reset event ($profile_reset) with the non-blocking log endpoint."
     },
     "lists": {
         "friendly_name": "lists",

readme.md

@@ -12,7 +12,7 @@ the backend, which calls Castle and acts on the verdict.
 - **sign up** – `$registration` to `filter` (anonymous, so the email goes in `params`): `$attempted` for a new email, `$failed` (resolved via `matching_user_id`) for an email that already exists
 - **login** – `$login` reusing one request token across two calls: `filter` `$attempted` first, then `risk` `$succeeded` on success or `filter` `$failed` (wrong password / unknown user)
 - **account** – post-login actions: profile update (`$profile_update` to `risk`), a custom event (`Castle.custom()`), and logout (`$logout` via the non-blocking `log` endpoint)
-- **password reset** – `$password_reset` via the non-blocking `log` endpoint
+- **password reset** – `$profile_reset` via the non-blocking `log` endpoint
 - **lists** – the Lists API (`create_list`, `get_all_lists`)
 - **privacy** – the Privacy API (`request_user_data`, `delete_user_data`)
 - **webhooks** – incoming Castle webhooks are signature-verified with `WebhooksVerify` (against the `X-Castle-Signature` header) and the most recent payloads are listed

templates/password_reset.html

@@ -19,7 +19,7 @@
 {% block desc %}
 
 <p>This demo records the password-reset event with the non-blocking <code>/log</code> endpoint, which stores the event without returning a verdict.</p>
-<p>Assume the user already passed your reset challenge (e.g. an emailed OTP). Enter a value <em>different from</em> the valid password to send <code>$password_reset / $succeeded</code>, or the valid password to send <code>$password_reset / $failed</code>. (The password is not actually changed.)</p>
+<p>Assume the user already passed your reset challenge (e.g. an emailed OTP). Enter a value <em>different from</em> the valid password to send <code>$profile_reset / $succeeded</code>, or the valid password to send <code>$profile_reset / $failed</code>. (The password is not actually changed.)</p>
 
 {% endblock %}
 

tests/test_sdk_integration.py

@@ -203,7 +203,7 @@ def test_new_password_logs_succeeded(self, client, fake_sdk):
 
         fake_sdk.log.assert_called_once()
         sent = fake_sdk.log.call_args.args[0]
-        assert sent["type"] == "$password_reset"
+        assert sent["type"] == "$profile_reset"
         assert sent["status"] == "$succeeded"
         assert sent["user"]["email"] == "clark.kent@dailyplanet.com"
 
@@ -216,6 +216,7 @@ def test_reusing_current_password_logs_failed(self, client, fake_sdk):
         body = resp.get_json()
         assert body["status"] == "$failed"
         fake_sdk.log.assert_called_once()
+        assert fake_sdk.log.call_args.args[0]["type"] == "$profile_reset"
         assert fake_sdk.log.call_args.args[0]["status"] == "$failed"