Initial config with email service test

backend/app/api/auth.py

@@ -7,8 +7,11 @@ from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel
 
 from backend.app.database import get_connection, init_db
-from backend.app.services.auth_service import authenticate_user
+from backend.app.core.config import settings
+from backend.app.services.auth_service import authenticate_user, find_user
+from backend.app.services.email_service import send_password_reset_email, smtp_configured
 from backend.app.services.email_verification import verify_email
+from backend.app.services.password_reset import create_reset_token, reset_password
 from backend.app.services.token_service import issue_token, revoke_token, validate_token
 
 router = APIRouter()
@@ -21,10 +24,23 @@ class LoginRequest(BaseModel):
     password: str
 
 
+class PasswordResetRequest(BaseModel):
+    token: str
+    password: str
+
+
 @router.post('/login')
 def login(payload: LoginRequest):
     user = authenticate_user(payload.username, payload.password)
     if user is None:
+        reset_user = find_user(payload.username)
+        if reset_user and reset_user['email_verified'] and smtp_configured():
+            try:
+                token = create_reset_token(reset_user['id'])
+                reset_url = f'{settings.public_url}/reset-password?token={token}'
+                send_password_reset_email(reset_user['email'], reset_user['username'], reset_url)
+            except Exception:
+                pass
         raise HTTPException(status_code=401, detail='Invalid username or password')
     if not user['email_verified']:
         raise HTTPException(status_code=403, detail='Email address is not verified')
@@ -46,6 +62,15 @@ def verify_email_address(token: str):
     return {'status': 'verified', 'message': 'Email address verified. You can now sign in.'}
 
 
+@router.post('/reset-password')
+def reset_password_endpoint(payload: PasswordResetRequest):
+    if len(payload.password) < 8:
+        raise HTTPException(status_code=422, detail='Password must contain at least 8 characters')
+    if not reset_password(payload.token, payload.password):
+        raise HTTPException(status_code=400, detail='Password reset link is invalid or expired')
+    return {'status': 'password_reset', 'message': 'Password reset. You can now sign in.'}
+
+
 @router.post('/logout')
 def logout(payload: dict):
     token = payload.get('token')