feat: forgot password admin-assisted

README.md

@@ -66,6 +66,8 @@ SECRET_KEY=your-32-char-secret-key
 ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=480
 CORS_ORIGINS=http://localhost:5173
+FRONTEND_URL=http://localhost:5173
+PASSWORD_RESET_EXPIRE_MINUTES=30
 UPLOAD_DIR=uploads
 AUTH_COOKIE_SECURE=false
 AUTH_COOKIE_SAMESITE=lax
@@ -128,6 +130,8 @@ ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=480
 UPLOAD_DIR=/data/uploads
 CORS_ORIGINS=http://localhost:5173
+FRONTEND_URL=https://gateprep6901.vercel.app
+PASSWORD_RESET_EXPIRE_MINUTES=30
 AUTH_COOKIE_SECURE=true
 AUTH_COOKIE_SAMESITE=none
 CLOUDINARY_CLOUD_NAME=your_cloud_name

backend/app/api/deps.py

@@ -31,8 +31,8 @@ def get_current_user(
     if not user:
         raise HTTPException(status_code=401, detail="User not found")
 
-    # Single session check — token must match current session
-    if session_id and user.current_session_id and session_id != user.current_session_id:
+    # Single session check — token must match the currently stored session.
+    if not session_id or user.current_session_id != session_id:
         raise HTTPException(
             status_code=401,
             detail="Session expired. You logged in from another device."

backend/app/api/routes/admin.py

@@ -1,7 +1,9 @@
 import json
 import os
 import uuid
+from datetime import datetime, timedelta, timezone
 from typing import Any, List, Optional
+from urllib.parse import urlencode
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Form
 from fastapi.concurrency import run_in_threadpool
 from sqlalchemy import func
@@ -9,8 +11,9 @@ from sqlalchemy.orm import Session
 from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator, model_validator
 from app.core.database import get_db
 from app.core.config import settings
+from app.core.security import generate_password_reset_token, hash_password_reset_token
 from app.api.deps import require_admin
-from app.models.models import User, Test, Question, QuestionType, UserRole
+from app.models.models import PasswordResetToken, User, Test, Question, QuestionType, UserRole
 from app.services.answer_utils import is_valid_nat_answer, normalize_question_type, split_answer_tokens
 from app.services.pdf_service import extract_questions_from_pdf
 from app.services.cloudinary_service import upload_image, delete_image
@@ -33,6 +36,14 @@ PDF_IMPORT_BLOCKING_WARNINGS = {
 }
 
 
+def _utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _password_reset_url(token: str) -> str:
+    return f"{settings.FRONTEND_URL.rstrip('/')}/reset-password?{urlencode({'token': token})}"
+
+
 async def _save_pdf_upload(pdf_file: UploadFile, path: str) -> None:
     file_size = 0
 
@@ -125,6 +136,42 @@ def toggle_status(user_id: int, db: Session = Depends(get_db), _=Depends(require
     return {"message": f"User {'activated' if user.is_active else 'deactivated'}", "is_active": user.is_active}
 
 
+@router.post("/users/{user_id}/password-reset")
+def create_password_reset_link(user_id: int, db: Session = Depends(get_db), current=Depends(require_admin)):
+    user = db.query(User).filter(User.id == user_id).first()
+    if not user:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    now = _utcnow()
+    (
+        db.query(PasswordResetToken)
+        .filter(
+            PasswordResetToken.user_id == user.id,
+            PasswordResetToken.used_at.is_(None),
+        )
+        .update({PasswordResetToken.used_at: now}, synchronize_session=False)
+    )
+
+    token = generate_password_reset_token()
+    expires_at = now + timedelta(minutes=settings.PASSWORD_RESET_EXPIRE_MINUTES)
+    reset_token = PasswordResetToken(
+        user_id=user.id,
+        created_by=current.id,
+        token_hash=hash_password_reset_token(token),
+        expires_at=expires_at,
+    )
+    db.add(reset_token)
+    db.commit()
+
+    return {
+        "user_id": user.id,
+        "email": user.email,
+        "full_name": user.full_name,
+        "reset_url": _password_reset_url(token),
+        "expires_at": expires_at,
+    }
+
+
 # ── Tests ─────────────────────────────────────────────────────────
 
 @router.get("/tests")

backend/app/api/routes/auth.py

@@ -1,3 +1,4 @@
+from datetime import datetime, timezone
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from sqlalchemy.orm import Session
 from pydantic import BaseModel, EmailStr
@@ -10,8 +11,9 @@ from app.core.security import (
     create_access_token,
     decode_token,
     generate_session_id,
+    hash_password_reset_token,
 )
-from app.models.models import User, UserRole
+from app.models.models import PasswordResetToken, User, UserRole
 from app.api.deps import get_current_user
 
 router = APIRouter(prefix="/auth", tags=["Authentication"])
@@ -26,6 +28,10 @@ class LoginRequest(BaseModel):
     email: EmailStr
     password: str
 
+class ResetPasswordRequest(BaseModel):
+    token: str
+    password: str
+
 class AuthUserResponse(BaseModel):
     id: int
     email: EmailStr
@@ -33,6 +39,16 @@ class AuthUserResponse(BaseModel):
     full_name: str
 
 
+def _utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _as_utc(value: datetime) -> datetime:
+    if value.tzinfo is None:
+        return value.replace(tzinfo=timezone.utc)
+    return value.astimezone(timezone.utc)
+
+
 def _auth_cookie_max_age_seconds() -> int:
     return settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60
 
@@ -138,6 +154,51 @@ def logout(request: Request, response: Response, db: Session = Depends(get_db)):
     return {"message": "Logged out"}
 
 
+# ── Reset Password ────────────────────────────────────────────────
+
+@router.post("/reset-password")
+def reset_password(payload: ResetPasswordRequest, db: Session = Depends(get_db)):
+    token = payload.token.strip()
+    if not token:
+        raise HTTPException(status_code=400, detail="Invalid or expired reset link")
+    if len(payload.password) < 6:
+        raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
+
+    reset_token = (
+        db.query(PasswordResetToken)
+        .filter(PasswordResetToken.token_hash == hash_password_reset_token(token))
+        .first()
+    )
+    now = _utcnow()
+    if (
+        not reset_token
+        or reset_token.used_at is not None
+        or _as_utc(reset_token.expires_at) < now
+    ):
+        raise HTTPException(status_code=400, detail="Invalid or expired reset link")
+
+    user = db.query(User).filter(User.id == reset_token.user_id).first()
+    if not user:
+        raise HTTPException(status_code=400, detail="Invalid or expired reset link")
+
+    user.hashed_password = hash_password(payload.password)
+    user.current_session_id = None
+    user.current_ip = None
+    reset_token.used_at = now
+    (
+        db.query(PasswordResetToken)
+        .filter(
+            PasswordResetToken.user_id == user.id,
+            PasswordResetToken.used_at.is_(None),
+            PasswordResetToken.id != reset_token.id,
+        )
+        .update({PasswordResetToken.used_at: now}, synchronize_session=False)
+    )
+    db.commit()
+
+    return {"message": "Password reset successful. Please sign in."}
+
+
 # ── Me ────────────────────────────────────────────────────────────
 
 @router.get("/me")

backend/app/core/config.py

@@ -76,6 +76,8 @@ class Settings(BaseSettings):
     ALGORITHM: str = "HS256"
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 480
     CORS_ORIGINS: str = "http://localhost:5173,https://gateprep6901.vercel.app"
+    FRONTEND_URL: str = "http://localhost:5173"
+    PASSWORD_RESET_EXPIRE_MINUTES: int = 30
     UPLOAD_DIR: str = "uploads"
     AUTH_COOKIE_NAME: str = "access_token"
     AUTH_COOKIE_SECURE: bool = True

backend/app/core/security.py

@@ -1,5 +1,6 @@
 from datetime import datetime, timedelta, timezone
 from typing import Optional
+import hashlib
 import secrets
 from jose import JWTError, jwt
 from passlib.context import CryptContext
@@ -17,6 +18,12 @@ def generate_session_id() -> str:
     """Unique session ID stored in DB — invalidates old sessions."""
     return secrets.token_hex(32)
 
+def generate_password_reset_token() -> str:
+    return secrets.token_urlsafe(48)
+
+def hash_password_reset_token(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
 def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
     to_encode = data.copy()
     expire = datetime.now(timezone.utc) + (

backend/app/models/models.py

@@ -44,6 +44,26 @@ class User(Base):
     practice_counters = relationship("PracticeAttemptCounter", back_populates="user", cascade="all, delete-orphan")
     bookmarks = relationship("Bookmark", back_populates="user", cascade="all, delete-orphan")
     checklist_items = relationship("ChecklistProgress", back_populates="user", cascade="all, delete-orphan")
+    password_reset_tokens = relationship(
+        "PasswordResetToken",
+        foreign_keys="PasswordResetToken.user_id",
+        back_populates="user",
+        cascade="all, delete-orphan",
+    )
+
+
+class PasswordResetToken(Base):
+    __tablename__ = "password_reset_tokens"
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("users.id"), nullable=False, index=True)
+    created_by = Column(Integer, ForeignKey("users.id"), nullable=False)
+    token_hash = Column(String(64), unique=True, index=True, nullable=False)
+    expires_at = Column(DateTime(timezone=True), nullable=False)
+    used_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc))
+
+    user = relationship("User", foreign_keys=[user_id], back_populates="password_reset_tokens")
+    creator = relationship("User", foreign_keys=[created_by])
 
 
 class TestSeries(Base):

backend/tests/test_password_reset.py

@@ -0,0 +1,181 @@
+import unittest
+from datetime import datetime, timedelta, timezone
+from urllib.parse import parse_qs, urlparse
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy.pool import StaticPool
+
+from app.api.routes import admin as admin_routes
+from app.api.routes import auth as auth_routes
+from app.core.config import settings
+from app.core.database import Base, get_db
+from app.core.security import (
+    generate_password_reset_token,
+    hash_password,
+    hash_password_reset_token,
+)
+from app.models.models import PasswordResetToken, User, UserRole
+
+
+class PasswordResetTests(unittest.TestCase):
+    def setUp(self):
+        self.original_frontend_url = settings.FRONTEND_URL
+        self.original_cookie_secure = settings.AUTH_COOKIE_SECURE
+        settings.FRONTEND_URL = "https://frontend.test"
+        settings.AUTH_COOKIE_SECURE = True
+        self.addCleanup(self._restore_settings)
+
+        self.engine = create_engine(
+            "sqlite:///:memory:",
+            connect_args={"check_same_thread": False},
+            poolclass=StaticPool,
+        )
+        Base.metadata.create_all(self.engine)
+        self.SessionLocal = sessionmaker(bind=self.engine)
+
+        db = self.SessionLocal()
+        try:
+            admin = User(
+                email="admin@example.com",
+                full_name="Admin User",
+                hashed_password=hash_password("adminsecret"),
+                role=UserRole.admin,
+                is_active=True,
+            )
+            user = User(
+                email="student@example.com",
+                full_name="Student User",
+                hashed_password=hash_password("oldsecret"),
+                role=UserRole.aspirant,
+                is_active=True,
+            )
+            db.add_all([admin, user])
+            db.commit()
+            db.refresh(admin)
+            db.refresh(user)
+            self.admin_id = admin.id
+            self.user_id = user.id
+        finally:
+            db.close()
+
+        app = FastAPI()
+        app.include_router(auth_routes.router)
+        app.include_router(admin_routes.router)
+
+        def override_get_db():
+            db = self.SessionLocal()
+            try:
+                yield db
+            finally:
+                db.close()
+
+        app.dependency_overrides[get_db] = override_get_db
+        self.admin_client = TestClient(app, base_url="https://testserver")
+        self.user_client = TestClient(app, base_url="https://testserver")
+        self.public_client = TestClient(app, base_url="https://testserver")
+
+    def _restore_settings(self):
+        settings.FRONTEND_URL = self.original_frontend_url
+        settings.AUTH_COOKIE_SECURE = self.original_cookie_secure
+
+    def _login_admin(self):
+        response = self.admin_client.post(
+            "/auth/login",
+            json={"email": "admin@example.com", "password": "adminsecret"},
+        )
+        self.assertEqual(response.status_code, 200)
+
+    def _create_reset_link(self):
+        response = self.admin_client.post(f"/admin/users/{self.user_id}/password-reset")
+        self.assertEqual(response.status_code, 200)
+        return response.json()
+
+    def _token_from_url(self, reset_url: str) -> str:
+        token = parse_qs(urlparse(reset_url).query).get("token", [None])[0]
+        self.assertTrue(token)
+        return token
+
+    def test_admin_generated_link_resets_password_once_and_invalidates_session(self):
+        self._login_admin()
+        user_login = self.user_client.post(
+            "/auth/login",
+            json={"email": "student@example.com", "password": "oldsecret"},
+        )
+        self.assertEqual(user_login.status_code, 200)
+        self.assertEqual(self.user_client.get("/auth/me").status_code, 200)
+
+        reset_payload = self._create_reset_link()
+        self.assertEqual(reset_payload["email"], "student@example.com")
+        self.assertTrue(reset_payload["reset_url"].startswith(f"{settings.FRONTEND_URL}/reset-password?"))
+        self.assertNotIn("token_hash", reset_payload)
+
+        token = self._token_from_url(reset_payload["reset_url"])
+        reset_response = self.public_client.post(
+            "/auth/reset-password",
+            json={"token": token, "password": "newsecret"},
+        )
+        self.assertEqual(reset_response.status_code, 200)
+
+        self.assertEqual(self.user_client.get("/auth/me").status_code, 401)
+        old_login = self.user_client.post(
+            "/auth/login",
+            json={"email": "student@example.com", "password": "oldsecret"},
+        )
+        self.assertEqual(old_login.status_code, 401)
+        new_login = self.user_client.post(
+            "/auth/login",
+            json={"email": "student@example.com", "password": "newsecret"},
+        )
+        self.assertEqual(new_login.status_code, 200)
+
+        reuse_response = self.public_client.post(
+            "/auth/reset-password",
+            json={"token": token, "password": "anothersecret"},
+        )
+        self.assertEqual(reuse_response.status_code, 400)
+
+    def test_new_admin_link_invalidates_previous_unused_link(self):
+        self._login_admin()
+        first = self._token_from_url(self._create_reset_link()["reset_url"])
+        second = self._token_from_url(self._create_reset_link()["reset_url"])
+
+        first_response = self.public_client.post(
+            "/auth/reset-password",
+            json={"token": first, "password": "firstsecret"},
+        )
+        self.assertEqual(first_response.status_code, 400)
+
+        second_response = self.public_client.post(
+            "/auth/reset-password",
+            json={"token": second, "password": "secondsecret"},
+        )
+        self.assertEqual(second_response.status_code, 200)
+
+    def test_expired_reset_token_is_rejected(self):
+        token = generate_password_reset_token()
+        db = self.SessionLocal()
+        try:
+            db.add(
+                PasswordResetToken(
+                    user_id=self.user_id,
+                    created_by=self.admin_id,
+                    token_hash=hash_password_reset_token(token),
+                    expires_at=datetime.now(timezone.utc) - timedelta(minutes=1),
+                )
+            )
+            db.commit()
+        finally:
+            db.close()
+
+        response = self.public_client.post(
+            "/auth/reset-password",
+            json={"token": token, "password": "newsecret"},
+        )
+        self.assertEqual(response.status_code, 400)
+
+
+if __name__ == "__main__":
+    unittest.main()

docker-compose.yml

@@ -26,6 +26,8 @@ services:
       SECRET_KEY: dev-secret-key-change-in-production
       ALGORITHM: HS256
       ACCESS_TOKEN_EXPIRE_MINUTES: 480
+      FRONTEND_URL: http://localhost:5173
+      PASSWORD_RESET_EXPIRE_MINUTES: 30
       UPLOAD_DIR: /app/uploads
       CORS_ORIGINS: http://localhost:5173
       AUTH_COOKIE_SECURE: "false"

frontend/src/App.jsx

@@ -7,6 +7,8 @@ import Spinner from './components/shared/Spinner'
 
 const LoginPage        = lazy(() => import('./pages/Login'))
 const RegisterPage     = lazy(() => import('./pages/Register'))
+const ForgotPassword   = lazy(() => import('./pages/ForgotPassword'))
+const ResetPassword    = lazy(() => import('./pages/ResetPassword'))
 const PendingPage      = lazy(() => import('./pages/Pending'))
 
 const AdminDashboard   = lazy(() => import('./pages/AdminDashboard'))
@@ -33,6 +35,8 @@ export default function App() {
             {/* Public */}
             <Route path="/login"    element={<GuestRoute><LoginPage /></GuestRoute>} />
             <Route path="/register" element={<GuestRoute><RegisterPage /></GuestRoute>} />
+            <Route path="/forgot-password" element={<GuestRoute><ForgotPassword /></GuestRoute>} />
+            <Route path="/reset-password" element={<ResetPassword />} />
             <Route path="/pending"  element={<PendingPage />} />
 
             {/* Admin */}

frontend/src/api/api.js

@@ -4,6 +4,7 @@ import api from './client'
 export const authAPI = {
   register: (data) => api.post('/auth/register', data),
   login:    (data) => api.post('/auth/login', data),
+  resetPassword: (data) => api.post('/auth/reset-password', data),
   logout:   ()     => api.post('/auth/logout'),
   me:       ()     => api.get('/auth/me'),
 }
@@ -13,6 +14,7 @@ export const adminAPI = {
   getUsers:         ()              => api.get('/admin/users'),
   updateRole:       (id, role)      => api.patch(`/admin/users/${id}/role`, { role }),
   toggleStatus:     (id)            => api.patch(`/admin/users/${id}/status`),
+  createPasswordReset: (id)         => api.post(`/admin/users/${id}/password-reset`),
   getTests:         ()              => api.get('/admin/tests'),
   getTest:          (id)            => api.get(`/admin/tests/${id}`),
   createTest:       (form)          => api.post('/admin/tests', form, { headers: { 'Content-Type': 'multipart/form-data' } }),

frontend/src/pages/AdminUsers.jsx

@@ -2,9 +2,8 @@ import { useEffect, useState } from 'react'
 import Layout from '../components/shared/Layout'
 import { adminAPI } from '../api/api'
 import toast from 'react-hot-toast'
-import { Users, Search, ShieldCheck, UserX, UserCheck, RefreshCw } from 'lucide-react'
+import { Copy, KeyRound, Search, UserX, UserCheck, RefreshCw, X } from 'lucide-react'
 import Spinner from '../components/shared/Spinner'
-import clsx from 'clsx'
 
 const ROLES = ['admin', 'aspirant', 'user']
 const roleStyle = { admin: 'badge-blue', aspirant: 'badge-green', user: 'badge-amber' }
@@ -14,6 +13,7 @@ export default function AdminUsers() {
   const [loading, setLoading] = useState(true)
   const [search, setSearch] = useState('')
   const [updating, setUpdating] = useState({})
+  const [resetLink, setResetLink] = useState(null)
 
   const load = () => {
     setLoading(true)
@@ -47,6 +47,30 @@ export default function AdminUsers() {
     }
   }
 
+  const createResetLink = async (userId) => {
+    const key = `reset-${userId}`
+    setUpdating(u => ({ ...u, [key]: true }))
+    try {
+      const res = await adminAPI.createPasswordReset(userId)
+      setResetLink(res.data)
+      toast.success('Reset link created')
+    } catch (err) {
+      toast.error(err.response?.data?.detail || 'Failed to create reset link')
+    } finally {
+      setUpdating(u => ({ ...u, [key]: false }))
+    }
+  }
+
+  const copyResetLink = async () => {
+    if (!resetLink?.reset_url) return
+    try {
+      await navigator.clipboard.writeText(resetLink.reset_url)
+      toast.success('Reset link copied')
+    } catch {
+      toast.error('Could not copy link')
+    }
+  }
+
   const filtered = users.filter(u =>
     u.full_name.toLowerCase().includes(search.toLowerCase()) ||
     u.email.toLowerCase().includes(search.toLowerCase())
@@ -138,6 +162,13 @@ export default function AdminUsers() {
                                 {u.is_active ? 'Disable' : 'Enable'}
                               </button>
                             )}
+                            <button
+                              onClick={() => createResetLink(u.id)}
+                              disabled={updating[`reset-${u.id}`]}
+                              className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-sky-500/10 border border-sky-500/20 text-sky-400 text-xs font-medium hover:bg-sky-500/20 transition-colors disabled:opacity-50"
+                            >
+                              {updating[`reset-${u.id}`] ? <Spinner size={13} /> : <KeyRound size={13} />} Reset
+                            </button>
                           </>
                         )}
                       </div>
@@ -151,6 +182,52 @@ export default function AdminUsers() {
             </table>
           </div>
         )}
+
+        {resetLink && (
+          <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4">
+            <div className="gate-card w-full max-w-lg p-5 animate-slide-up">
+              <div className="flex items-start justify-between gap-4 mb-4">
+                <div>
+                  <h2 className="text-lg font-bold text-white">Password Reset Link</h2>
+                  <p className="text-sm text-slate-400 mt-1">{resetLink.full_name} · {resetLink.email}</p>
+                </div>
+                <button
+                  onClick={() => setResetLink(null)}
+                  className="p-1.5 rounded text-slate-500 hover:text-slate-200 hover:bg-slate-800 transition-colors"
+                  aria-label="Close"
+                >
+                  <X size={18} />
+                </button>
+              </div>
+
+              <label className="label">Reset Link</label>
+              <input
+                value={resetLink.reset_url}
+                readOnly
+                className="input font-mono text-xs"
+                aria-label="Password reset link"
+              />
+              <p className="text-xs text-slate-500 mt-2">
+                Expires {new Date(resetLink.expires_at).toLocaleString('en-IN', {
+                  day: '2-digit',
+                  month: 'short',
+                  year: 'numeric',
+                  hour: '2-digit',
+                  minute: '2-digit',
+                })}
+              </p>
+
+              <div className="flex items-center justify-end gap-3 mt-5">
+                <button onClick={() => setResetLink(null)} className="btn-ghost">
+                  Close
+                </button>
+                <button onClick={copyResetLink} className="btn-primary flex items-center gap-2">
+                  <Copy size={15} /> Copy Link
+                </button>
+              </div>
+            </div>
+          </div>
+        )}
       </div>
     </Layout>
   )

frontend/src/pages/ForgotPassword.jsx

@@ -0,0 +1,40 @@
+import { Link } from 'react-router-dom'
+import { ArrowLeft, ShieldCheck } from 'lucide-react'
+
+export default function ForgotPasswordPage() {
+  return (
+    <div className="min-h-screen flex items-center justify-center p-4" style={{ background: 'var(--bg)' }}>
+      <div className="w-full max-w-md animate-slide-up">
+        <div className="flex items-center gap-2 mb-8">
+          <div className="w-8 h-8 rounded bg-sky-600 flex items-center justify-center">
+            <span className="font-bold text-white">G</span>
+          </div>
+          <span className="font-bold text-lg" style={{ color: 'var(--text)' }}>GATEPrep</span>
+        </div>
+
+        <h2 className="text-2xl font-bold mb-1" style={{ color: 'var(--text)' }}>Account recovery</h2>
+        <p className="text-sm mb-6" style={{ color: 'var(--text-muted)' }}>
+          Contact your administrator to receive a secure reset link.
+        </p>
+
+        <div className="gate-card p-6">
+          <div className="flex items-start gap-4">
+            <div className="w-10 h-10 rounded bg-sky-500/15 border border-sky-500/25 flex items-center justify-center flex-shrink-0">
+              <ShieldCheck size={18} className="text-sky-400" />
+            </div>
+            <div>
+              <h3 className="font-semibold text-base" style={{ color: 'var(--text)' }}>Admin-assisted reset</h3>
+              <p className="text-sm mt-1 leading-relaxed" style={{ color: 'var(--text-muted)' }}>
+                An administrator can generate a one-time link from the Users page.
+              </p>
+            </div>
+          </div>
+
+          <Link to="/login" className="btn-ghost w-full mt-6 flex items-center justify-center gap-2">
+            <ArrowLeft size={15} /> Back to sign in
+          </Link>
+        </div>
+      </div>
+    </div>
+  )
+}

frontend/src/pages/Login.jsx

@@ -82,7 +82,12 @@ export default function LoginPage() {
                   placeholder="you@example.com" className="input" autoFocus />
               </div>
               <div>
-                <label className="label">Password</label>
+                <div className="flex items-center justify-between mb-1.5">
+                  <label className="label mb-0">Password</label>
+                  <Link to="/forgot-password" className="text-xs text-sky-400 hover:text-sky-300 font-medium">
+                    Forgot password?
+                  </Link>
+                </div>
                 <div className="relative">
                   <input type={show ? 'text' : 'password'} required value={form.password}
                     onChange={handle('password')} placeholder="••••••••" className="input pr-10" />

frontend/src/pages/ResetPassword.jsx

@@ -0,0 +1,113 @@
+import { useState } from 'react'
+import { Link, useNavigate, useSearchParams } from 'react-router-dom'
+import toast from 'react-hot-toast'
+import { ArrowLeft, Eye, EyeOff, KeyRound } from 'lucide-react'
+import { authAPI } from '../api/api'
+import Spinner from '../components/shared/Spinner'
+
+export default function ResetPasswordPage() {
+  const [searchParams] = useSearchParams()
+  const navigate = useNavigate()
+  const token = searchParams.get('token') || ''
+  const [form, setForm] = useState({ password: '', confirm: '' })
+  const [show, setShow] = useState(false)
+  const [loading, setLoading] = useState(false)
+
+  const handle = k => e => setForm(f => ({ ...f, [k]: e.target.value }))
+
+  const submit = async e => {
+    e.preventDefault()
+    if (!token) { toast.error('Invalid reset link'); return }
+    if (form.password !== form.confirm) { toast.error('Passwords do not match'); return }
+    if (form.password.length < 6) { toast.error('Password must be at least 6 characters'); return }
+
+    setLoading(true)
+    try {
+      await authAPI.resetPassword({ token, password: form.password })
+      toast.success('Password updated. Sign in again.')
+      navigate('/login', { replace: true })
+    } catch (err) {
+      toast.error(err.response?.data?.detail || 'Password reset failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center p-4" style={{ background: 'var(--bg)' }}>
+      <div className="w-full max-w-md animate-slide-up">
+        <div className="flex items-center gap-2 mb-8">
+          <div className="w-8 h-8 rounded bg-sky-600 flex items-center justify-center">
+            <span className="font-bold text-white">G</span>
+          </div>
+          <span className="font-bold text-lg" style={{ color: 'var(--text)' }}>GATEPrep</span>
+        </div>
+
+        <h2 className="text-2xl font-bold mb-1" style={{ color: 'var(--text)' }}>Reset password</h2>
+        <p className="text-sm mb-6" style={{ color: 'var(--text-muted)' }}>Choose a new password for your account</p>
+
+        <div className="gate-card p-6">
+          {!token ? (
+            <div className="text-center">
+              <p className="text-sm mb-5" style={{ color: 'var(--text-muted)' }}>This reset link is invalid.</p>
+              <Link to="/login" className="btn-ghost w-full flex items-center justify-center gap-2">
+                <ArrowLeft size={15} /> Back to sign in
+              </Link>
+            </div>
+          ) : (
+            <form onSubmit={submit} className="space-y-4">
+              <div>
+                <label className="label">New Password</label>
+                <div className="relative">
+                  <input
+                    type={show ? 'text' : 'password'}
+                    required
+                    value={form.password}
+                    onChange={handle('password')}
+                    placeholder="Min. 6 characters"
+                    className="input pr-10"
+                    autoComplete="new-password"
+                    autoFocus
+                  />
+                  <button
+                    type="button"
+                    onClick={() => setShow(s => !s)}
+                    className="absolute right-3 top-1/2 -translate-y-1/2"
+                    style={{ color: 'var(--text-muted)' }}
+                  >
+                    {show ? <EyeOff size={16} /> : <Eye size={16} />}
+                  </button>
+                </div>
+              </div>
+              <div>
+                <label className="label">Confirm Password</label>
+                <input
+                  type={show ? 'text' : 'password'}
+                  required
+                  value={form.confirm}
+                  onChange={handle('confirm')}
+                  placeholder="Re-enter password"
+                  className="input"
+                  autoComplete="new-password"
+                />
+              </div>
+              <button
+                type="submit"
+                disabled={loading}
+                className="btn-primary w-full flex items-center justify-center gap-2 mt-2"
+              >
+                {loading ? <Spinner size={15} /> : <KeyRound size={15} />}
+                {loading ? 'Updating password...' : 'Update Password'}
+              </button>
+            </form>
+          )}
+        </div>
+
+        <p className="text-center mt-4 text-sm" style={{ color: 'var(--text-muted)' }}>
+          Remember your password?{' '}
+          <Link to="/login" className="text-sky-400 hover:text-sky-300 font-medium">Sign in</Link>
+        </p>
+      </div>
+    </div>
+  )
+}