Skip to main content

​
Real-World Example

Sarah, a user at ABC Collections, forgets her password. She opens the Forgot Password page and enters her work email address. If the email is associated with a valid creditor account, the system sends a password reset link. Sarah opens the password reset link, enters a new password, confirms it, and saves. After the reset, the old password should no longer work, and the new password should allow successful login.

​
Visual Flow

​
How It Should Work

  • The user must request a password reset using their registered email address.
  • The system must send a password reset link when the account exists and the request is valid.
  • The reset page must require a new password and confirmation.
  • The new password must meet the system’s password requirements.
  • After reset, the user must be able to log in with the new password.

​
How It Should Not Work

  • The system must not reset a password without a valid reset request.
  • The system must not accept a weak or unconfirmed new password.
  • The system must not reveal private account details during the reset request.
  • The system should rate-limit repeated reset requests.

​
Developer Notes

  • Ensure login, registration, verification, and password reset redirects preserve the correct portal state.
  • Any new authentication flow must preserve creditor ownership and email verification behavior.
  • routes/creditor/auth.php
  • app/Livewire/Creditor/Auth
Last modified on May 27, 2026