d33d0e1c19117a0347dbadb99a77e9f12483c735
max
  Tue Sep 1 06:56:09 2026 -0700
hgLogin: let users set or change their recovery email address, refs #38197

Adds a page where a signed-in user can set or change the recovery address on
their account, offered in the account menu next to "Change email" -- both in
the top right blue bar popup and on the session page. It is off by default:
set login.recovEmailChange=on in hg.conf to offer it. The page also needs
login.cookieSalt, working outbound mail and the recovEmailVerified column,
and stays hidden where any of those is missing.

The new address is confirmed by mail before it takes effect, so whatever is
on the account keeps working until the link is opened and a typo costs the
user nothing. An account that has a password must supply it, since a
confirmed recovery address can sign in. Once the address does change, the
account's main address is told, the same notice that a change of the main
address already sends.

One signature now covers both the address given at signup and a later
change, so there is a single confirmation path rather than two.

diff --git src/hg/lib/web.c src/hg/lib/web.c
index 4efdfd2e875..3956dfe8a48 100644
--- src/hg/lib/web.c
+++ src/hg/lib/web.c
@@ -1689,36 +1689,40 @@
             // rather than bouncing the user through hgSession first.
             char *loginUrl = retEnc ? wikiLinkUserLoginUrlReturning(hgsid, retEnc)
                                     : wikiLinkUserLoginUrl(hgsid);
             dyStringPrintf(dy, "<a class='topRightLink' href='%s' id='loginLink' "
                 "title='Log in to save and share sessions'>Login</a>", loginUrl);
             freez(&loginUrl);
             }
         else
             {
             char *logoutUrl = retEnc ? wikiLinkUserLogoutUrlReturning(hgsid, retEnc)
                                      : wikiLinkUserLogoutUrl(hgsid);
             char *changePwUrl = retEnc ? wikiLinkChangePasswordUrlReturning(hgsid, retEnc)
                                        : wikiLinkChangePasswordUrl(hgsid);
             char *changeEmailUrl = retEnc ? wikiLinkChangeEmailUrlReturning(hgsid, retEnc)
                                           : wikiLinkChangeEmailUrl(hgsid);
+            char *changeRecovEmailUrl = retEnc
+                ? wikiLinkChangeRecovEmailUrlReturning(hgsid, retEnc)
+                : wikiLinkChangeRecovEmailUrl(hgsid);
             dyStringPrintf(dy, "<a class='topRightLink' href='#' id='loginLink' "
                 "title='Account info and sign out' "
                 "data-username=\"%s\" data-logouturl=\"%s\" data-changepwurl=\"%s\" "
-                "data-changeemailurl=\"%s\">%s</a>",
+                "data-changeemailurl=\"%s\" data-changerecovemailurl=\"%s\">%s</a>",
                 userName, logoutUrl, changePwUrl ? changePwUrl : "",
-                changeEmailUrl ? changeEmailUrl : "", userName);
+                changeEmailUrl ? changeEmailUrl : "",
+                changeRecovEmailUrl ? changeRecovEmailUrl : "", userName);
             }
         freez(&retEnc);
         loginLi = dyStringCannibalize(&dy);
         }
     menuStr = replaceChars(menuStr, "<!-- LOGIN_LINK -->", loginLi);
     }
 
 // Fill in the top-right "Share a link" link (placeholder <!-- SHARE_LINK -->).
 // data-sharemode tells topLinks.js what to do:
 //   "session" (hgTracks): save the current view as a session and show a short link; branches on
 //             data-loggedin to either name a session (logged in) or make an anonymous link.
 //   "url" (hgTrackUi): just show the current page URL with the hgsid stripped, for sharing.
     {
     char *shareLi = "";
     boolean isHgTracks = (scriptName && endsWith(scriptName, "hgTracks"));