fix: prevent account enumeration on recover endpoint for invalid emai…

internal/api/recover.go

@@ -69,8 +69,14 @@ func (a *API) Recover(w http.ResponseWriter, r *http.Request) error {
 		return a.sendPasswordRecovery(r, tx, user, flowType)
 	})
 	if err != nil {
-		return err
+		// Prevent account enumeration: if sending password recovery fails because the email address
+		// is invalid or rejected by the mailer, return HTTP 200 OK to match the non-existent user path.
+		if httpErr, ok := err.(*apierrors.HTTPError); ok && httpErr.ErrorCode == apierrors.ErrorCodeEmailAddressInvalid {
+			return sendJSON(w, http.StatusOK, map[string]string{})
+		}
+        // Return all other errors (rate limits 429, DB transaction errors 500, etc.)
+    	return err
 	}
 
 	return sendJSON(w, http.StatusOK, map[string]string{})
-}
+}

internal/api/recover_test.go

@@ -151,3 +151,24 @@ func (ts *RecoverTestSuite) TestRecover_NoSideChannelLeak() {
 	ts.API.handler.ServeHTTP(w, req)
 	assert.Equal(ts.T(), http.StatusOK, w.Code)
 }
+
+func (ts *RecoverTestSuite) TestRecover_EmailAddressInvalidNoLeak() {
+	email := "test@example.com"
+
+	// Request body
+	var buffer bytes.Buffer
+	require.NoError(ts.T(), json.NewEncoder(&buffer).Encode(map[string]interface{}{
+		"email": email,
+	}))
+
+	// Setup request
+	req := httptest.NewRequest(http.MethodPost, "http://localhost/recover", &buffer)
+	req.Header.Set("Content-Type", "application/json")
+
+	// Setup response recorder
+	w := httptest.NewRecorder()
+	ts.API.handler.ServeHTTP(w, req)
+
+	// Both existing and missing users should return 200 OK without leaking account existence
+	assert.Equal(ts.T(), http.StatusOK, w.Code)
+}