Implement Forget and Reset Password API

[sanjaysah101]

Description:

According to the flow diagram, I've attached, we should implement APIs for the Forget Password and Reset Password functionalities. This will allow users to recover their accounts by generating a One-Time Password (OTP) sent via email, verifying the OTP, and resetting their password.

Flow Overview:

1. Forget Password Flow:

   • Endpoint: POST /api/v1/auth/forget-password
   • Payload: { email }
   • Process:
     • Validate the request.
     • Verify if the email exists.
     • Generate an OTP and set an expiry time.
     • Save the OTP and send it via email to the user.

2. OTP Verification Flow:

   • Endpoint: POST /api/v1/otp/verify
   • Payload: { otp }
   • Process:
     • Verify the OTP.
     • If valid, generate a token for password reset.
     • Return the token to the user.

3. Reset Password Flow:

   • Endpoint: POST /api/v1/auth/reset-password
   • Payload: { password, confirmPassword, token }
   • Process:
     • Verify the token.
     • Validate password and confirmPassword.
     • Encrypt and store the new password.
     • Send a confirmation email that the password has been changed.

Notification Service Integration

• The OTP and password reset emails will be sent through the Notification Service using:

  • Endpoint: POST /api/v1/emails

  • Payload example:

    export type EmailNotification = {
        to: string;
        eventType: string;
        payload: { otp: string };
        subject: string;
    };

Edge Cases:

• Implement a limit for the number of OTP entry attempts.
• Ensure proper error handling for scenarios like expired OTP, invalid tokens, or mismatched passwords.

Tasks:

• Create forget-password endpoints to handle the OTP generation process.
• Implement otp/verify endpoint to validate the OTP and generate a password reset token.
• Implement a reset-password endpoint to handle the new password submission, validation, and storage.
• Integrate with the Notification Service to send OTP and password change confirmation emails.

---

References