[Core]: Login screen

[naui95]

SMART Plan — [Core] Password reset page

Specific

Implement the full password reset flow accessible from the login screen:

1. A "Forgot your password?" link on the login page leads to a request form where the user enters their email.
2. The application sends a password reset email with a signed, time-limited token link.
3. Clicking the link opens a reset form where the user enters a new password (with confirmation).
4. On success the user is redirected to the login page with a success notification.

Measurable

• "Forgot your password?" link is visible on the login page.
• Submitting a known email triggers a password reset email (testable via Mail::fake() / Notification::fake()).
• Submitting an unknown email returns no error that reveals account existence (security best practice).
• Clicking a valid token link opens the reset form; submitting a new password updates the user record.
• An expired or invalid token shows a clear error message.
• PHPUnit covers: link present, email sent, reset success, invalid token rejected.

Achievable

Filament v4 ships RequestPasswordReset and ResetPassword auth pages. Register them in the company panel provider. The email is dispatched via Laravel's built-in Password::broker(). Any branding overrides go in Modules/Core/Filament/Pages/Auth/.

Relevant

Without password reset, a user who forgets their password must contact an admin. This is a baseline auth requirement for any production application.

Time-bound

Sprint 5.

---

Acceptance Criteria

• "Forgot your password?" link present on the login page
• Submitting the request form with a registered email dispatches the reset notification
• Reset email contains a link valid for 60 minutes (Laravel default)
• Reset form validates: password required, min 8 chars, confirmed
• Successful reset redirects to login with a success flash message
• Expired or invalid token shows a clear error (not a 500)
• PHPUnit tests cover the happy path and the invalid-token case

[nielsdrost7]

Sprint 5 — Implementation Plan

Specific: Add a Filament password reset flow to the Company panel login page.

Files to create/modify:

1. Register the built-in Filament pages in Modules/Core/Providers/CompanyPanelProvider.php:

use Filament\Pages\Auth\PasswordReset\RequestPasswordReset;
use Filament\Pages\Auth\PasswordReset\ResetPassword;

->authPasswordBroker('users')  // ensure this is set
->pages([]) // Filament auto-registers auth pages if not customised

Or, if custom login page overrides the defaults, explicitly add:

->login(Login::class) // existing custom login
->passwordReset()     // enables the reset flow (Filament built-in)

2. Mail config: Ensure MAIL_* env variables are set in .env.example/.env.testing.example. The reset email uses Laravel's built-in Notification::route('mail', ...).

3. Password resets table: php artisan migrate — Laravel's password_reset_tokens table must exist. Check it's in migrations.

4. Custom styling (optional): Add a RequestPasswordReset page class in Modules/Core/Filament/Pages/Auth/ if you need branded styling.

Test to add in Modules/Core/Tests/Feature/AuthTest.php (or create it):

#[Test]
public function it_renders_the_password_reset_request_page(): void
{
    $component = Livewire::test(RequestPasswordReset::class);
    $component->assertSuccessful();
}

#[Test]
public function it_sends_a_password_reset_email(): void
{
    \Illuminate\Support\Facades\Notification::fake();
    $user = User::factory()->create(['email' => 'test@example.com']);

    Livewire::test(RequestPasswordReset::class)
        ->fillForm(['email' => 'test@example.com'])
        ->call('request');

    \Illuminate\Support\Facades\Notification::assertSentTo($user,
        \Illuminate\Auth\Notifications\ResetPassword::class
    );
}

Effort: ~2 hours (mostly config + test).

---

Generated by Claude Code