feat: implement ForgotPassword and ResetPassword routes using WhatsApp OTP

controllers/auth_controller.go

@@ -97,6 +97,16 @@ type ResendOTPRequest struct {
 	Phone string `json:"phone" binding:"required"`
 }
 
+type ForgotPasswordRequest struct {
+	Phone string `json:"phone" binding:"required"`
+}
+
+type ResetPasswordRequest struct {
+	Phone       string `json:"phone" binding:"required"`
+	OTPCode     string `json:"otp_code" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required"`
+}
+
 type UpdateUserRequest struct {
 	Name     string `json:"name"`
 	Email    string `json:"email"`
@@ -380,6 +390,103 @@ func ResendOTP(c *gin.Context) {
 	})
 }
 
+func ForgotPassword(c *gin.Context) {
+	var req ForgotPasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	// Cari user berdasarkan nomor telepon (OwnerPhone atau Phone)
+	var user models.User
+	if err := config.DB.Where("phone = ?", req.Phone).First(&user).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Nomor WhatsApp tidak terdaftar"})
+		return
+	}
+
+	// Generate OTP 6 digit
+	code := fmt.Sprintf("%06d", rand.Intn(900000)+100000)
+
+	// Simpan ke database otps
+	otpEntry := models.OTP{
+		PhoneNumber: req.Phone,
+		OTPCode:     code,
+		IsVerified:  false,
+		ExpiresAt:   time.Now().Add(10 * time.Minute), // Kadaluarsa dalam 10 menit
+	}
+	if err := config.DB.Create(&otpEntry).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal membuat OTP reset password"})
+		return
+	}
+
+	// Kirim Notifikasi OTP Reset Password via WA
+	go services.SendOtpWa(req.Phone, code)
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "Kode OTP reset password telah dikirim ke WhatsApp Anda",
+	})
+}
+
+func ResetPassword(c *gin.Context) {
+	var req ResetPasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	// Validasi OTP
+	var record models.OTP
+	if err := config.DB.Where("phone_number = ? AND otp_code = ? AND is_verified = ?", req.Phone, req.OTPCode, false).Order("id desc").First(&record).Error; err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Kode OTP salah atau tidak ditemukan"})
+		return
+	}
+
+	if record.ExpiresAt.Before(time.Now()) {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Kode OTP sudah kadaluarsa"})
+		return
+	}
+
+	// Temukan user
+	var user models.User
+	if err := config.DB.Where("phone = ?", req.Phone).First(&user).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "User tidak ditemukan"})
+		return
+	}
+
+	// Hash password baru
+	hashed, err := middleware.HashPassword(req.NewPassword)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal enkripsi password"})
+		return
+	}
+
+	// Mulai Transaksi Database untuk memastikan data konsisten
+	tx := config.DB.Begin()
+	
+	// Simpan password baru ke user
+	if err := tx.Model(&user).Update("password", hashed).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mereset password"})
+		return
+	}
+
+	// Tandai OTP telah digunakan
+	record.IsVerified = true
+	if err := tx.Save(&record).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal memperbarui status OTP"})
+		return
+	}
+
+	tx.Commit()
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "Password Anda berhasil diperbarui. Silakan login kembali dengan password baru Anda.",
+	})
+}
+
 func GetMe(c *gin.Context) {
 	userVal, _ := c.Get("user")
 	user := userVal.(*models.User)

main.go

@@ -76,6 +76,8 @@ func main() {
 			auth.POST("/register-tenant", controllers.RegisterTenant)
 			auth.POST("/verify-otp", controllers.VerifyOTP)
 			auth.POST("/resend-otp", controllers.ResendOTP)
+			auth.POST("/forgot-password", controllers.ForgotPassword)
+			auth.POST("/reset-password", controllers.ResetPassword)
 
 			// Authenticated Auth Routes
 			auth.Use(middleware.GetCurrentUser())