Map the user flow for a task, with decision points and edge cases

See it in action

What this prompt produces with example details filled in:

**Flow scope** — A locked-out existing user resets a forgotten password from the login screen and ends logged in on their dashboard.

**Happy path**

| Step | Screen/State | User action | System response |
|---|---|---|---|
| 1 | Forgot-password form | Enters account email, submits | Validates format, sends reset email if the account exists, shows "Check your inbox" |
| 2 | Check-inbox confirmation | Opens email, clicks reset link | Verifies link is valid and unexpired, opens the reset form |
| 3 | Set-new-password | Enters and confirms new password, submits | Checks strength rules, saves password, invalidates the link |
| 4 | Auto sign-in | (none) | Logs the user in, redirects to dashboard with a "Password updated" toast |

**Decision points**
- At step 1: if email format is invalid then show inline error and stay on form, else proceed.
- At step 1: if the email belongs to an SSO account then show "Sign in with your identity provider" and send no email, else send the reset email.
- At step 1 (anti-enumeration): show the same "Check your inbox" screen whether or not the email is on file; only actually send mail when the account exists.
- At step 2: if the link is expired or already used then show "Link expired" with "Send a new link", else open the reset form.
- At step 3: if the password fails strength rules or the two entries don't match then show inline errors and stay on form, else save.

**Edge cases & error states**

| Trigger | What the user sees | Recovery path |
|---|---|---|
| Email not on file | Same "Check your inbox" screen, no mail sent | Re-check email, or "Contact support" link |
| SSO-managed account | "Your account uses SSO — sign in there" | Deep link out to the SSO provider |
| Reset link expired (>60 min) | "This link has expired" | "Send a new link" returns to the check-inbox step |
| Reset link already used | "This link is no longer valid" | "Send a new link" |
| Weak password or mismatch | Inline field errors | Correct input, resubmit (entries preserved) |
| Account locked (5 failed logins) | "Account locked for 15 minutes" banner on login, timer shown | Wait, or complete the reset flow to regain access |
| Network / server error on submit | "Something went wrong — try again" with a retry button | Retry; form data is preserved |
| User closes the tab mid-flow | — | Reset link stays valid until it expires; resume from the email |

**Exit points**
- Success exits: new password saved, auto signed in, lands on dashboard.
- Failure / abandon exits: redirected out to the SSO provider; tab closed (link valid until expiry); repeated dead ends route to "Contact support".

**Flow diagram**

```mermaid
flowchart TD
    A[Login screen] -->|Taps Forgot password| B[Enter email]
    B --> C{Email format valid?}
    C -->|No| B
    C -->|Yes| D{SSO account?}
    D -->|Yes| E[Use SSO provider]
    D -->|No| F[Check your inbox]
    F --> G{Link valid and unexpired?}
    G -->|No| H[Link expired]
    H --> F
    G -->|Yes| I[Set new password]
    I --> J{Meets rules and matches?}
    J -->|No| I
    J -->|Yes| K[Save, invalidate link]
    K --> L[Auto sign-in to dashboard]
```

**Assumptions & open questions**
- Assumed the reset email arrives promptly. Not specified: is there a cooldown or daily cap on how often a user can request a new link?
- Not specified: does setting a new password sign out other active sessions?
- Not specified: is there a CAPTCHA or bot check on the request form?
- Assumed the "Account locked (15 min)" state blocks login attempts but does not block a password-reset request.