Add password reset flow (mailer, API, UI, DB migration, i18n, tests)

[ultimate]

Motivation

• Provide a complete password reset flow so users can request reset links, receive emails, and set new passwords securely.
• Allow deployments to send real SMTP emails while keeping local development safe by logging reset links to the console.

Description

• Added database migration and schema entries for password_reset_tokens to store hashed tokens, expiry and usage timestamps (app/lib/db/migrations/018_password_reset_tokens.sql and schema update).
• Implemented token lifecycle and handlers in app/lib/users.ts, including requestPasswordReset, resetPasswordWithToken, token hashing, and reset URL construction based on NEXT_PUBLIC_APP_URL/deployment env fallbacks.
• Implemented SMTP-backed mailer app/lib/mailer.ts using nodemailer that sends localized reset emails or logs links in non-production environments.
• Added API routes POST /api/password-reset/request and POST /api/password-reset/confirm to request a reset and apply a token respectively.
• Added client pages/components for the flow: forgot-password page, reset-password page, and small UI change to AuthForm to surface the "forgot password" action, plus CSS tweaks for success messaging and secondary auth button.
• Updated i18n dictionaries (en, de, fr, it) with localized strings for the reset flow, updated .env.example and README.md with SMTP and public URL configuration, and widened the proxy matcher to allow unauthenticated access to password-reset and related routes.
• Added nodemailer and its types to package.json/package-lock.json.

Testing

• Added unit tests tests/app/lib/mailer.test.ts verifying SMTP config, locale content, local logging, and production failure behavior, and tests/app/api/password-reset-route.test.ts verifying the request/confirm endpoint behavior and error masking.
• Ran the new test suite with vitest for those files and the added tests passed.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ultilog	Ready	Preview, Comment	Jul 11, 2026 12:27pm

[ultimate]

Implements #121