forgot password in login page and account info implemented, sms.ir service works fine with sandbox key.

backend/src/modules/auth/auth.controller.ts

@@ -31,11 +31,17 @@ import { CreateOrganizationDto } from './dto/create-organization.dto';
 import { JwtAuthGuard } from './guards/jwt-auth.guard';
 import { LocalAuthGuard } from './guards/local-auth.guard';
 import { UpdateLanguageDto } from './dto/update-language.dto';
+import {
+  ForgotPasswordSendCodeDto,
+  ForgotPasswordVerifyDto,
+} from './dto/forgot-password.dto';
+import { ChangePasswordDto } from './dto/change-password.dto';
 
 @ApiTags('auth')
 @Controller('auth')
 export class AuthController {
   private static readonly REMEMBER_ME_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+  private static readonly PASSWORD_RESET_MAX_AGE_MS = 15 * 60 * 1000;
 
   constructor(private readonly authService: AuthService) {}
 
@@ -170,6 +176,67 @@ export class AuthController {
     return this.authService.updateLanguage(req.user.id, dto);
   }
 
+  @Patch('profile/password')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('JWT-auth')
+  @ApiOperation({ summary: 'Change account password' })
+  async changePassword(
+    @Req() req,
+    @Body() dto: ChangePasswordDto,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const skipCurrentPassword = req?.cookies?.passwordResetVerified === '1';
+
+    const result = await this.authService.changePassword(
+      req.user.id,
+      dto.currentPassword,
+      dto.newPassword,
+      skipCurrentPassword,
+    );
+
+    this.clearAuthCookies(res);
+    res.clearCookie('passwordResetVerified', this.baseCookieOptions());
+
+    return result;
+  }
+
+  @Post('forgot-password/send-code')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Send forgot-password SMS verification code' })
+  async sendForgotPasswordCode(@Body() dto: ForgotPasswordSendCodeDto) {
+    return this.authService.sendForgotPasswordCode(dto);
+  }
+
+  @Post('forgot-password/verify')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Verify SMS code and sign in for password reset' })
+  async verifyForgotPasswordCode(
+    @Body() dto: ForgotPasswordVerifyDto,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const result = await this.authService.verifyForgotPasswordCode(dto);
+
+    this.setAuthCookies(
+      res,
+      result.data.accessToken,
+      result.data.refreshToken,
+    );
+
+    res.cookie('passwordResetVerified', '1', {
+      ...this.baseCookieOptions(),
+      maxAge: AuthController.PASSWORD_RESET_MAX_AGE_MS,
+    });
+
+    return {
+      success: true,
+      data: {
+        user: result.data.user,
+        organizations: result.data.organizations,
+        redirectTo: '/settings/account',
+      },
+    };
+  }
+
   @Get('subscription-alert')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth('JWT-auth')
@@ -308,5 +375,6 @@ export class AuthController {
     res.clearCookie('accessToken', options);
     res.clearCookie('refreshToken', options);
     res.clearCookie('authRemember', options);
+    res.clearCookie('passwordResetVerified', options);
   }
 }