> ## Documentation Index
> Fetch the complete documentation index at: https://docs.younegotiate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Forgot Password & Reset Flow

> Allow creditor users to securely reset their password and regain portal access.

## Real-World Example

Sarah, a user at ABC Collections, forgets her password. She opens the Forgot Password page and enters her work email address. If the email is associated with a valid creditor account, the system sends a password reset link.

Sarah opens the password reset link, enters a new password, confirms it, and saves. After the reset, the old password should no longer work, and the new password should allow successful login.

## Visual Flow

```mermaid placement="top-right" actions={true} theme={"system"}
flowchart TD
    A["User requests password reset"] --> B["System sends password reset link"]
    B --> C["User opens password reset link"]
    C --> D["User enters new password"]
    D --> E["New password is saved"]
    E --> F["User logs in with new password"]
    classDef default fill:#F8FAFC,stroke:#64748B,stroke-width:1.5px,color:#0F172A;
    classDef actor fill:#E0F2FE,stroke:#0284C7,stroke-width:2px,color:#0C4A6E;
    classDef system fill:#F8FAFC,stroke:#64748B,stroke-width:1.5px,color:#0F172A;
    classDef decision fill:#FEF3C7,stroke:#D97706,stroke-width:2px,color:#78350F;
    classDef risk fill:#FEE2E2,stroke:#DC2626,stroke-width:2px,color:#7F1D1D;
    classDef outcome fill:#DCFCE7,stroke:#16A34A,stroke-width:2px,color:#14532D;
    class A actor;
    class B,C,D,F system;
    class E outcome;
    linkStyle default stroke:#94A3B8,stroke-width:2px;
```

## How It Should Work

* The user must request a password reset using their registered email address.
* The system must send a password reset link when the account exists and the request is valid.
* The reset page must require a new password and confirmation.
* The new password must meet the system's password requirements.
* After reset, the user must be able to log in with the new password.

## How It Should Not Work

* The system must not reset a password without a valid reset request.
* The system must not accept a weak or unconfirmed new password.
* The system must not reveal private account details during the reset request.
* The system should rate-limit repeated reset requests.

## Developer Notes

* Ensure login, registration, verification, and password reset redirects preserve the correct portal state.
* Any new authentication flow must preserve creditor ownership and email verification behavior.

## Related App Areas

* `routes/creditor/auth.php`
* `app/Livewire/Creditor/Auth`