fix: reset-password and the admin password set stamp tokens_valid_after in whole seconds, so a token minted in the same second is accepted

JWT iat is whole seconds and every cutoff check is iat before tokens_valid_after, so a sub-second cutoff refused the login that followed a reset within the same second. POST /reset-password and the admin Users password set now truncate the cutoff to the second, like RevokeUserAccess; email_verified_at keeps full precision. Change-password and bouncer's comparison are unchanged.

controllers/api_controller.go

@@ -417,11 +417,14 @@ func ResetPassword(app *backpack.App) http.HandlerFunc {
 		}
 		// The reset code was mailed to the account's address, so the write
 		// that stores the new password also records the proof of that
-		// address (D-27). A reset that fails here records nothing.
+		// address (D-27). A reset that fails here records nothing. The
+		// session cutoff is truncated to whole seconds, as in
+		// RevokeUserAccess, because JWT iat has whole-second precision, so
+		// the login that follows the reset is not refused.
 		now := time.Now()
 		if err := gdb.WithContext(r.Context()).Model(&models.User{}).Where("id = ?", user.ID).Updates(map[string]any{
 			"password":           hashed,
-			"tokens_valid_after": now,
+			"tokens_valid_after": now.Truncate(time.Second),
 			"email_verified_at":  now,
 		}).Error; err != nil {
 			writeOpaque500(w)

controllers/users_admin_controller.go

@@ -241,8 +241,10 @@ func (c usersAdminController) FormBeforeUpdate(ctx context.Context, model any) e
 	}
 	if changed {
 		// An admin password reset ends every session of the user, as the
-		// user's own change-password does.
-		now := time.Now()
+		// user's own change-password does. The cutoff is truncated to whole
+		// seconds, as in RevokeUserAccess, because JWT iat has whole-second
+		// precision, so the user's next login in that second is not refused.
+		now := time.Now().Truncate(time.Second)
 		user.TokensValidAfter = &now
 	}
 	return nil