GitHub Issue to Implementation Planner

I have analyzed the request and mapped out the necessary changes for the password reset flow.

[Implementation Plan]

Goal: Implement a secure "Forgot Password" flow that allows users to request a reset link via email and update their password using a unique token.

• Acceptance Criteria:
  • User can submit their email address on a '/forgot-password' page.
  • System sends a transactional email with a time-limited (1 hour) signed JWT link.
  • User can set a new password via the link, which invalidates the token upon success.
  • Appropriate success/error toast notifications are displayed for all states.
• Affected Files:
  • src/api/auth.ts (New endpoints for request and reset)
  • src/pages/ForgotPassword.tsx (New UI)
  • src/pages/ResetPassword.tsx (New UI)
  • src/services/emailService.ts (Email logic)
  • src/middleware/authGuard.ts (Token validation)
• Execution Steps:
  1. Define the backend API routes for POST /auth/forgot-password and POST /auth/reset-password.
  2. Implement the email service logic using the existing SMTP provider to send reset links.
  3. Create the ForgotPassword request form with email validation.
  4. Create the ResetPassword form that handles the token from the URL and submits the new password.
  5. Add global state handling for loading and error messages during the flow.
• Edge Cases to Test:
  • User submits an email that does not exist in the database (should show generic success to prevent enumeration).
  • User attempts to use an expired or previously used reset token.

Next steps

1. Review the proposed file list to ensure no shared components were missed.
2. Confirm if the token expiration time (1 hour) aligns with security requirements.
3. Approve this plan to begin the backend API implementation.