My-Weekly-ToDo-List/.planning/phases/01-setup-and-authentication/01-03-PLAN.md

---
phase: 01-setup-and-authentication
plan: 03
type: execute
wave: 2
depends_on: [01-01, 01-02]
files_modified: [src/app/api/auth/reset-password/route.ts, src/app/api/auth/verify-email/route.ts, src/app/auth/forgot-password/page.tsx, src/app/auth/reset-password/page.tsx, src/app/auth/verify-email/page.tsx]
autonomous: true
user_setup: []

must_haves:
  truths:
    - "User can reset password via email link"
    - "User receives and can verify email address after signup"
    - "Application interface loads and displays correctly on desktop and tablet devices"
  artifacts:
    - path: "src/app/api/auth/reset-password/route.ts"
      provides: "POST /api/auth/reset-password endpoint"
      exports: ["POST"]
    - path: "src/app/api/auth/verify-email/route.ts"
      provides: "POST /api/auth/verify-email endpoint"
      exports: ["POST"]
    - path: "src/app/auth/forgot-password/page.tsx"
      provides: "Forgot password page"
      min_lines: 20
    - path: "src/app/auth/reset-password/page.tsx"
      provides: "Reset password page"
      min_lines: 20
    - path: "src/app/auth/verify-email/page.tsx"
      provides: "Email verification page"
      min_lines: 20
  key_links:
    - from: "src/app/auth/forgot-password/page.tsx"
      to: "/api/auth/reset-password"
      via: "form submission"
      pattern: "fetch.*\/api\/auth\/reset-password"
    - from: "src/app/auth/reset-password/page.tsx"
      to: "/api/auth/reset-password"
      via: "form submission"
      pattern: "fetch.*\/api\/auth\/reset-password"
    - from: "src/app/auth/verify-email/page.tsx"
      to: "/api/auth/verify-email"
      via: "form submission"
      pattern: "fetch.*\/api\/auth\/verify-email"
---

<objective>
Implement complete email verification and password reset functionality to complete the authentication system.
</objective>

<execution_context>
@~/.config/opencode/get-shit-done/workflows/execute-plan.md
@~/.config/opencode/get-shit-done/templates/summary.md
</execution_context>

<context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/research/ARCHITECTURE.md
@.planning/research/STACK.md
</context>

<tasks>

<task type="auto">
  <name>Enhance Prisma Schema for Email Verification</name>
  <files>prisma/schema.prisma</files>
  <action>Modify the User model in Prisma schema to add:
  - verified boolean field (default false)
  - emailVerificationToken string field
  - emailVerificationExpires date field
  - passwordResetToken string field (to be used in reset flow)
  - passwordResetExpires date field
  - Add indexes on email and emailVerificationToken for performance</action>
  <verify>Run `npx prisma generate` and verify schema changes are applied correctly</verify>
  <done>Prisma schema updated with new fields for email verification and password reset</done>
</task>

<task type="auto">
  <name>Create Password Reset API Endpoint</name>
  <files>src/app/api/auth/reset-password/route.ts</files>
  <action>Create POST endpoint at /api/auth/reset-password that:
  1. Accepts {email, token, newPassword}
  2. Validates the token against stored token and expiration
  3. Hashes new password with bcrypt
  4. Updates user's password in database
  5. Clears the reset token
  6. Returns success response
  Use jose library for token generation and validation</action>
  <verify>Run `npm run dev` and test with curl:
  - curl -X POST http://localhost:3000/api/auth/reset-password -H "Content-Type: application/json" -d '{"email":"test@example.com","token":"abc123","newPassword":"newpassword123"}'
  - Verify no errors occur and response is correct</verify>
  <done>Password reset endpoint properly handles token validation and password update</done>
</task>

<task type="auto">
  <name>Create Email Verification API Endpoint</name>
  <files>src/app/api/auth/verify-email/route.ts</files>
  <action>Create POST endpoint at /api/auth/verify-email that:
  1. Accepts {token}
  2. Validates the token against stored token and expiration
  3. Sets user.verified to true
  4. Clears the verification token
  5. Returns success response
  Use jose library for token generation and validation</action>
  <verify>Run `npm run dev` and test with curl:
  - curl -X POST http://localhost:3000/api/auth/verify-email -H "Content-Type: application/json" -d '{"token":"abc123"}'
  - Verify no errors occur and response is correct</verify>
  <done>Email verification endpoint properly handles token validation and user verification</done>
</task>

<task type="auto">
  <name>Create Email Verification Pages</name>
  <files>src/app/auth/forgot-password/page.tsx, src/app/auth/reset-password/page.tsx, src/app/auth/verify-email/page.tsx</files>
  <action>Create three pages for email verification and password reset flows:
  1. Forgot Password (/app/auth/forgot-password/page.tsx) - form for email input to initiate reset
  2. Reset Password (/app/auth/reset-password/page.tsx) - form with token and new password
  3. Verify Email (/app/auth/verify-email/page.tsx) - page to handle email verification token
  All pages should:
  - Have clean, minimal UI
  - Be responsive on desktop/tablet
  - Show appropriate success/error messages
  - Include navigation back to login</action>
  <verify>Run `npm run dev` and verify:
  - Pages load without errors
  - Forms render correctly
  - Navigation works
  - Responsive design works</verify>
  <done>All email verification and password reset pages exist with proper functionality</done>
</task>

</tasks>

<verification>
Verify that the complete email verification and password reset flows work properly, including token generation, validation, and user data updates. Test all email-related endpoints and pages.
</verification>

<success_criteria>
- User can request password reset via email
- User receives and can use reset token to change password
- User receives email verification after signup
- User can verify their email address using the verification link
- All authentication endpoints return appropriate responses
- Passwords are properly encrypted before storage
- Email verification tokens have expiration dates
- Password reset tokens have expiration dates
- Application interface loads and displays correctly on desktop and tablet devices
</success_criteria>

<output>
After completion, create `.planning/phases/01-setup-and-authentication/01-03-SUMMARY.md`
</output>