feat: setup forget password to the backoffice

apps/edr-freight-web/backoffice/src/auth/api.ts

@@ -1,5 +1,13 @@
 import { api } from "./http";
-import type { AuthTokens, AuthUser, LoginResponse } from "./types";
+import type {
+  AuthTokens,
+  AuthUser,
+  ForgotPasswordRequestPayload,
+  ForgotPasswordVerifyPayload,
+  LoginResponse,
+  ResetTicket,
+  SetPasswordPayload,
+} from "./types";
 
 export const loginRequest = async (payload: {
   email: string;
@@ -21,3 +29,31 @@ export const getMeRequest = async () => {
   const response = await api.get<AuthUser>("/me");
   return response.data;
 };
+
+// The three calls below drive the unauthenticated forgot-password flow.
+// Responses under /api/auth are *flattened* by the API's response
+// interceptor ({ success, ...payload }), so there is no `.data.data` here.
+
+export const requestPasswordResetRequest = async (
+  payload: ForgotPasswordRequestPayload,
+) => {
+  await api.post("/auth/forgot-password/request", payload);
+};
+
+export const verifyPasswordResetOtpRequest = async (
+  payload: ForgotPasswordVerifyPayload,
+) => {
+  const response = await api.post<ResetTicket>(
+    "/auth/forgot-password/verify",
+    payload,
+  );
+  return response.data;
+};
+
+/**
+ * Spend the reset ticket minted by {@link verifyPasswordResetOtpRequest}.
+ * Carries its own userId/verificationCode and never touches the session.
+ */
+export const resetPasswordRequest = async (payload: SetPasswordPayload) => {
+  await api.patch("/auth/set-password", payload);
+};

apps/edr-freight-web/backoffice/src/auth/types.ts

@@ -58,6 +58,33 @@ export interface LoginResponse extends Partial<AuthTokens> {
   mfaRequired?: boolean;
 }
 
+/** The channel a password-reset code is delivered over. */
+export type ResetChannel = "email" | "phone";
+
+export interface ForgotPasswordRequestPayload {
+  /** Email, username, or E.164 phone — whatever the user typed, normalised. */
+  identifier: string;
+  channel: ResetChannel;
+}
+
+export interface ForgotPasswordVerifyPayload extends ForgotPasswordRequestPayload {
+  otp: string;
+}
+
+/** Single-use ticket to spend on `PATCH /api/auth/set-password`. */
+export interface ResetTicket {
+  userId: string;
+  verificationCode: string;
+}
+
+export interface SetPasswordPayload {
+  newPassword: string;
+  confirmPassword: string;
+  userId: string;
+  email: string;
+  verificationCode: string;
+}
+
 // Additional types for Matrix form test
 export interface User {
   id: string;