My-Weekly-ToDo-List/.planning/phases/01-setup-and-authentication/01-02-PLAN.md

phase	plan	type	wave	depends_on	files_modified	autonomous	must_haves
01-setup-and-authentication	02	execute	1		src/app/api/auth/forgot-password/route.ts src/app/api/auth/reset-password/route.ts src/app/api/auth/verify-email/route.ts src/app/auth/forgot-password/page.tsx src/app/auth/reset-password/page.tsx src/app/auth/verify-email/page.tsx src/components/PasswordResetForm.tsx src/components/EmailVerificationForm.tsx	true	truths artifacts key_links User receives email verification after signup User can reset password via email link User can access email verification page after signup path provides exports src/app/api/auth/forgot-password/route.ts POST endpoint for initiating password reset process POST path provides exports src/app/api/auth/reset-password/route.ts POST endpoint for resetting password with token validation POST path provides exports src/app/api/auth/verify-email/route.ts GET endpoint for verifying email with token GET path provides min_lines src/app/auth/forgot-password/page.tsx Forgot password page component with form handling 20 path provides min_lines src/app/auth/reset-password/page.tsx Reset password page component with form handling 20 path provides min_lines src/app/auth/verify-email/page.tsx Email verification page component with token handling 20 from to via pattern src/app/auth/forgot-password/page.tsx /api/auth/forgot-password fetch API call fetch.*api/auth/forgot-password from to via pattern src/app/auth/reset-password/page.tsx /api/auth/reset-password fetch API call fetch.*api/auth/reset-password from to via pattern src/app/api/auth/forgot-password/route.ts prisma.user database lookup for email verification prisma.user.(findUnique) from to via pattern src/app/api/auth/reset-password/route.ts prisma.user database lookup and update prisma.user.(findUnique|update)

Phase 1, Plan 2: Complete Authentication Flow

Objective

Implement the complete authentication flow including email verification, password reset, and middleware protection for authenticated routes.

Purpose

This plan expands the authentication system to include comprehensive email verification and password recovery mechanisms. These features improve user experience by enabling account recovery and ensuring email authenticity.

Output

• Complete email verification flow with token-based verification
• Password reset functionality with token-based process
• Dedicated pages for password reset and email verification
• Supporting components for these flows

Context

Building upon the foundation established in Plan 1, this plan implements the remaining authentication features. We'll need to add API endpoints to handle:

• Password reset requests
• Email verification with tokens
• Support for forgot password flow
• UI components for these flows

Tasks

Implement Password Reset Request Endpoint src/app/api/auth/forgot-password/route.ts Implement the POST endpoint for initiating password reset: - Add validation for required email field - Look up user by email in database using Prisma - Generate a secure password reset token with expiration (e.g., 1 hour) - Store the token and expiration in the user record - Send password reset email with link containing token - Return appropriate response regardless of whether user exists (prevents enumeration attacks)

The implementation should:
- Use secure random token generation for password reset
- Set appropriate expiration time (e.g., 1 hour)
- Send email using configured email service (details in infrastructure)
- Not reveal if email exists in system to prevent enumeration

Run `curl -X POST http://localhost:3001/api/auth/forgot-password -H "Content-Type: application/json" -d '{"email":"test@example.com"}'` and verify behavior User can request password reset and receive confirmation without revealing account existence Implement Password Reset Confirmation Endpoint src/app/api/auth/reset-password/route.ts Implement the POST endpoint for completing password reset: - Validate the presence of email and token parameters - Look up user by email in database using Prisma - Verify that the reset token matches and hasn't expired - Hash the new password using bcryptjs with salt rounds >= 10 - Update the user's password and clear the reset token - Return success message to indicate password reset completion

The implementation should:
- Validate token expiration before allowing reset
- Ensure token matches exactly stored value
- Clear the reset token after successful use
- Return appropriate error responses for invalid or expired tokens
- Use bcryptjs for password hashing

Run `curl -X POST http://localhost:3001/api/auth/reset-password -H "Content-Type: application/json" -d '{"email":"test@example.com","token":"reset-token","password":"newpassword"}'` and verify behavior User can complete password reset with valid token and receive confirmation Implement Email Verification Endpoint src/app/api/auth/verify-email/route.ts Implement the GET endpoint for email verification: - Extract token from query parameters - Look up user by email verification token in database using Prisma - Verify that token hasn't expired - Update user's verifiedAt field to current timestamp - Clear the verification token - Redirect to appropriate page (login or dashboard) with success message

The implementation should:
- Use query parameters for token (as GET requests are used for verification)
- Validate token before allowing verification
- Set verification timestamp upon successful verification
- Clear token from database after verification
- Handle invalid/missing/expired tokens gracefully

Visit `http://localhost:3001/api/auth/verify-email?token=verification-token` and verify behavior User can verify email address with valid token and receive confirmation Create Forgot Password Page src/app/auth/forgot-password/page.tsx Create a dedicated page for the forgot password flow: - Add form for entering email address - Display appropriate success/error messages - Implement form submission handler calling /api/auth/forgot-password - Add loading states during submission - Include clear user instructions and navigation back to login

The page should:
- Be responsive and accessible
- Provide clear feedback on submission
- Be styled consistently with the rest of the application
- Have a link back to login page

Visit http://localhost:3001/auth/forgot-password and verify form renders correctly Forgot password page is accessible, visually consistent, and functional Create Reset Password Page src/app/auth/reset-password/page.tsx Create a dedicated page for password reset: - Accept token from URL query parameters - Add form for entering new password - Implement form submission handler calling /api/auth/reset-password - Display appropriate success/error messages - Add loading states during submission - Include clear user instructions and navigation back to login

The page should:
- Be responsive and accessible
- Handle invalid or expired tokens gracefully
- Provide clear feedback on submission
- Be styled consistently with the rest of the application
- Have a link back to login page

Visit http://localhost:3001/auth/reset-password?token=test-token and verify form renders correctly Password reset page is accessible, visually consistent, and functional Create Email Verification Page src/app/auth/verify-email/page.tsx Create a dedicated page for email verification: - Accept token from URL query parameters - Call the verification endpoint (/api/auth/verify-email) - Display appropriate success/error messages - Include user instructions and navigation back to login - Redirect to login or dashboard after successful verification

The page should:
- Be responsive and accessible
- Handle verification process automatically
- Provide clear feedback on verification status
- Be styled consistently with the rest of the application

Visit http://localhost:3001/auth/verify-email?token=test-token and verify behavior Email verification page is accessible, visually consistent, and functional - All authentication API endpoints for password reset and email verification are functional - Users can request password reset via email - Users can reset their password with token - Users can verify their email address with token - Dedicated pages display properly for all authentication flows

<success_criteria>

• User receives and can verify email address after signup
• User can reset password via email link
• User can access email verification page after signup </success_criteria>

After completion, create `.planning/phases/01-setup-and-authentication/01-02-SUMMARY.md`