From 211117e61afa8ef642c9394a371329733fbcc85b Mon Sep 17 00:00:00 2001
From: weeihan <whyap79@gmail.com>
Date: Tue, 21 Jul 2026 22:29:39 +0800
Subject: [PATCH] feat(auth): add forgot-password page

---
 app/(auth)/forgot-password/page.tsx | 96 +++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 app/(auth)/forgot-password/page.tsx

diff --git a/app/(auth)/forgot-password/page.tsx b/app/(auth)/forgot-password/page.tsx
new file mode 100644
index 0000000..34f9ac2
--- /dev/null
+++ b/app/(auth)/forgot-password/page.tsx
@@ -0,0 +1,96 @@
+'use client'
+
+import { useState } from 'react'
+import Link from 'next/link'
+import { createClient } from '@/lib/supabase/client'
+
+export default function ForgotPasswordPage() {
+  const [email, setEmail] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [submitted, setSubmitted] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    if (!email) return
+    setLoading(true)
+    setError(null)
+
+    const supabase = createClient()
+    const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? ''
+    const redirectTo = `${appUrl}/api/auth/callback?next=/reset-password`
+
+    const { error: resetError } = await supabase.auth.resetPasswordForEmail(email, {
+      redirectTo,
+    })
+
+    setLoading(false)
+
+    if (resetError) {
+      setError('Something went wrong. Please try again.')
+      return
+    }
+
+    // Always show success — never reveal whether email exists
+    setSubmitted(true)
+  }
+
+  if (submitted) {
+    return (
+      <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
+        <div className="w-full max-w-sm space-y-4 text-center">
+          <h1 className="text-2xl font-bold text-gray-900">Check your email</h1>
+          <p className="text-sm text-gray-500">
+            If an account exists for <strong>{email}</strong>, a password reset link has been sent.
+          </p>
+          <Link href="/login" className="text-sm text-blue-600 hover:underline">
+            Back to sign in
+          </Link>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
+      <form onSubmit={handleSubmit} className="flex flex-col gap-4 w-full max-w-sm">
+        <div className="text-center">
+          <h1 className="text-2xl font-bold">Reset password</h1>
+          <p className="text-sm text-gray-500 mt-1">
+            Enter your email and we&apos;ll send a reset link.
+          </p>
+        </div>
+
+        {error && (
+          <p className="bg-red-50 border border-red-200 text-red-700 text-sm rounded px-3 py-2">
+            {error}
+          </p>
+        )}
+
+        <input
+          type="email"
+          placeholder="Email"
+          value={email}
+          onChange={e => setEmail(e.target.value)}
+          required
+          autoComplete="email"
+          className="border border-gray-300 rounded-md px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-blue-500"
+        />
+
+        <button
+          type="submit"
+          disabled={loading}
+          className="bg-blue-600 hover:bg-blue-700 text-white font-medium py-2 rounded-md disabled:opacity-50 transition-colors"
+        >
+          {loading ? 'Sending…' : 'Send reset link'}
+        </button>
+
+        <p className="text-center text-sm text-gray-500">
+          <Link href="/login" className="text-blue-600 hover:underline">
+            Back to sign in
+          </Link>
+        </p>
+      </form>
+    </div>
+  )
+}