[Backend] Implement Forgot Password API

[mertcat]

📝 Implement Forgot Password API

Description

Implement backend support for the "Forgot Password" functionality, allowing users to request a password reset and securely set a new password using a time-limited token.

Feature / Task Details

• Create endpoint to request password reset (e.g., POST /auth/forgot-password)
• Generate secure, time-limited reset token
• Send password reset email with link or code
• Create endpoint to reset password (e.g., POST /auth/reset-password)
• Validate token and expiration
• Hash and update new password securely
• Prevent user enumeration (do not reveal if email exists)
• Handle invalid/expired token cases

Deliverables

• Forgot password request endpoint
• Reset password endpoint
• Email sending integration
• Secure token handling logic

Acceptance Criteria

• User can request password reset
• Reset email is sent (if account exists)
• Token is secure and expires properly
• User can reset password with valid token
• Invalid/expired tokens are rejected
• Password is securely updated
• All tests pass

Deadline

10.05.2026