Webpage Integration: Password Reset #2423

Goal

Wire up the full password reset flow to the backend, implement backend password validation, and create the password reset email template.

Figma

Scope

Full-stack: reset request, email delivery, token validation, password update, and confirmation email template.

Acceptance Criteria

Step 1 — Request password reset

• The user submits their email address to request a password reset.
• If the email is registered, a reset email is sent to that address.
• If the email is not registered, an email is sent to the address informing the user that they are not registered and gives them a path to register; this email exists.

Step 2 — Password reset email

• A password reset email template is created as part of this ticket.
• The email includes a reset link containing a time-limited, single-use token.

Email copy placeholder:
Subject: [TBD]
Body: [Email copy will be added here]

Email Template Design

Step 3 — Reset link validation

• When the user clicks the reset link, the token is validated.
• If the token is valid, the user is taken to the new password form.
• If the token is expired or invalid, an error state is shown with a prompt to request a new reset link.

Step 4 — Set new password

• The user enters and confirms a new password.
• Frontend validation is covered in a separate ticket.
• Backend validation is triggered only on form submission (i.e. clicking the CTA).
  • Password not commonly used: If the submitted password appears in a common passwords list, return an error and display an inline message: "This password is too common. Please choose a different one."

Step 5 — Confirmation

• On successful password reset, the user is shown a confirmation state and redirected to the sign in page.

FE/BE Actions

Out of Scope

• Frontend field validation (covered in a separate ticket)
• Sign in page