"Forgot password" procedure is broken

[adrienjoly]

When an Openwhyd user forgets their password, they can normally pick a new one by following this procedure:

• from https://openwhyd.org/login, click on the "?" button => it goes to https://openwhyd.org/password
• from that page, they enter their email address
• if this email address matches an existing openwhyd account, an email is sent to that address
• the user click the URL included in that email => it leads to a https://openwhyd.org/password?uid=XXX&resetCode=YYY page that allows the user to set a new password
• the user can login with their new password

Apparently, the email is not sent anymore.

[adrienjoly]

I see that there were ~10k emails sent from our shared SendGrid account, on 11/10/2018:

=> Hypothesis: this spike may have caused our SendGrid account to go overquota, and/or our outgoing email requests to be throttled / rate limited.

[adrienjoly]

Indeed, I found many occurrences of the email response: {"errors":["Maximum credits exceeded"],"message":"error"} error coming from SendGrid, in our production logs.

[adrienjoly]

Analytics have been stable during that day:

[adrienjoly]

Starting on Thu, 11 Oct 2018 02:48:42 GMT, 11127 invites have been sent by a user (uId = 5bbeb9a0bedd3509a3da2ea2) to @qq.com email addresses.

=> Let's shut down the email invite system to prevent this situation from happening again.

[adrienjoly]

The situation will hopefully not happen again, when the PR is deployed in production => closing.