---
phase: 01-setup-and-authentication
plan: 03
type: execute
wave: 2
depends_on: [01-01, 01-02]
files_modified: [src/app/api/auth/reset-password/route.ts, src/app/api/auth/verify-email/route.ts, src/app/auth/forgot-password/page.tsx, src/app/auth/reset-password/page.tsx, src/app/auth/verify-email/page.tsx]
autonomous: true
user_setup: []
must_haves:
truths:
- "User can reset password via email link"
- "User receives and can verify email address after signup"
- "Application interface loads and displays correctly on desktop and tablet devices"
artifacts:
- path: "src/app/api/auth/reset-password/route.ts"
provides: "POST /api/auth/reset-password endpoint"
exports: ["POST"]
- path: "src/app/api/auth/verify-email/route.ts"
provides: "POST /api/auth/verify-email endpoint"
exports: ["POST"]
- path: "src/app/auth/forgot-password/page.tsx"
provides: "Forgot password page"
min_lines: 20
- path: "src/app/auth/reset-password/page.tsx"
provides: "Reset password page"
min_lines: 20
- path: "src/app/auth/verify-email/page.tsx"
provides: "Email verification page"
min_lines: 20
key_links:
- from: "src/app/auth/forgot-password/page.tsx"
to: "/api/auth/reset-password"
via: "form submission"
pattern: "fetch.*\/api\/auth\/reset-password"
- from: "src/app/auth/reset-password/page.tsx"
to: "/api/auth/reset-password"
via: "form submission"
pattern: "fetch.*\/api\/auth\/reset-password"
- from: "src/app/auth/verify-email/page.tsx"
to: "/api/auth/verify-email"
via: "form submission"
pattern: "fetch.*\/api\/auth\/verify-email"
---
Implement complete email verification and password reset functionality to complete the authentication system.
@~/.config/opencode/get-shit-done/workflows/execute-plan.md
@~/.config/opencode/get-shit-done/templates/summary.md
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/research/ARCHITECTURE.md
@.planning/research/STACK.md
Enhance Prisma Schema for Email Verification
prisma/schema.prisma
Modify the User model in Prisma schema to add:
- verified boolean field (default false)
- emailVerificationToken string field
- emailVerificationExpires date field
- passwordResetToken string field (to be used in reset flow)
- passwordResetExpires date field
- Add indexes on email and emailVerificationToken for performance
Run `npx prisma generate` and verify schema changes are applied correctly
Prisma schema updated with new fields for email verification and password reset
Create Password Reset API Endpoint
src/app/api/auth/reset-password/route.ts
Create POST endpoint at /api/auth/reset-password that:
1. Accepts {email, token, newPassword}
2. Validates the token against stored token and expiration
3. Hashes new password with bcrypt
4. Updates user's password in database
5. Clears the reset token
6. Returns success response
Use jose library for token generation and validation
Run `npm run dev` and test with curl:
- curl -X POST http://localhost:3000/api/auth/reset-password -H "Content-Type: application/json" -d '{"email":"test@example.com","token":"abc123","newPassword":"newpassword123"}'
- Verify no errors occur and response is correct
Password reset endpoint properly handles token validation and password update
Create Email Verification API Endpoint
src/app/api/auth/verify-email/route.ts
Create POST endpoint at /api/auth/verify-email that:
1. Accepts {token}
2. Validates the token against stored token and expiration
3. Sets user.verified to true
4. Clears the verification token
5. Returns success response
Use jose library for token generation and validation
Run `npm run dev` and test with curl:
- curl -X POST http://localhost:3000/api/auth/verify-email -H "Content-Type: application/json" -d '{"token":"abc123"}'
- Verify no errors occur and response is correct
Email verification endpoint properly handles token validation and user verification
Create Email Verification Pages
src/app/auth/forgot-password/page.tsx, src/app/auth/reset-password/page.tsx, src/app/auth/verify-email/page.tsx
Create three pages for email verification and password reset flows:
1. Forgot Password (/app/auth/forgot-password/page.tsx) - form for email input to initiate reset
2. Reset Password (/app/auth/reset-password/page.tsx) - form with token and new password
3. Verify Email (/app/auth/verify-email/page.tsx) - page to handle email verification token
All pages should:
- Have clean, minimal UI
- Be responsive on desktop/tablet
- Show appropriate success/error messages
- Include navigation back to login
Run `npm run dev` and verify:
- Pages load without errors
- Forms render correctly
- Navigation works
- Responsive design works
All email verification and password reset pages exist with proper functionality
Verify that the complete email verification and password reset flows work properly, including token generation, validation, and user data updates. Test all email-related endpoints and pages.
- User can request password reset via email
- User receives and can use reset token to change password
- User receives email verification after signup
- User can verify their email address using the verification link
- All authentication endpoints return appropriate responses
- Passwords are properly encrypted before storage
- Email verification tokens have expiration dates
- Password reset tokens have expiration dates
- Application interface loads and displays correctly on desktop and tablet devices