Pull Request #2291
Add forgot password flow
Adds POST /api/auth/forgot-password endpoint. Accepts an email address, generates a signed one-time token, and sends a reset link via SendGrid. Token expires after 30 minutes.
Ready to merge
controller/PasswordResetController.java+22 additions
Viewed1
+ @RestController
2
+ @RequestMapping("/api/auth")
3
+ public class PasswordResetController {
4
+ @Autowired
5
+ private PasswordResetService resetService;
6
+
7
+ @PostMapping("/forgot-password")
8
+ public ResponseEntity<Void> forgotPassword(
9
+ @RequestBody @Valid ForgotPasswordRequest req) {
10
+ resetService.initiateReset(req.getEmail());
11
+ return ResponseEntity.ok().build();
12
+ }
13
+ }
SL
shreya_lead
Approved review
Token expiry is handled correctly, and the endpoint returns the same response whether the email exists or not — good for security. LGTM.