# Registration: Reset password
###### Sprint: 2

### Outcome:
Users can reset login password by entering email and confirm by OTP code

### Implementation description:

#### Endpoints:
POST {$domain}/api/v2/barong/identity/users/password/generate_code
POST {$domain}/api/v2/barong/identity/users/password/confirm_code
POST {$domain}/api/v2/barong/identity/users/password/reset


#### File destination:
{$Dalan_Path}/app/api/v2/identity/users.rb

#### Commits:
9e17677b
42b34ae2
e04a58b0

#### What did we implement:
In the Opendax, users get a reset token by entering their email, after in reset password page user can reset the password by entering a valid reset token and a new password

In Zagros, the reset password process is done in 3 steps, the first step is to generate OTP code by Vault, then is a step to check the OTP code in by separate API, and then reset the password

```mermaid
sequenceDiagram

    Title: Reset password
    
    User->>Ranj:email
    Ranj->>Dalan:Post: after client side checking
    Dalan->>Ranj:4xx if the user does not exist
    Dalan->>User:2xx send otp to his or her mail
    Ranj->>User:Ask OTP code for confirming
    User-->>Ranj:if OTP code not received, try for resend after <color:#red>120</color> seconds
    Ranj-->>Dalan: Ask for sending OTP code again
    Dalan-->>User:2xx send otp to his or her mail
    User->>Ranj: enter OTP code
    Ranj->>Dalan: OTP code for checking
    Dalan->>Ranj:4xx if user does not exist in the system
    Dalan->>Ranj:4xx if OTP code expired
    Dalan->>Ranj:2xx OTP code is check\n
    Ranj->>User: show reset password page
    Ranj->>Dalan: email, password, confirm_password
    Dalan->>Ranj:4xx if user does not exist in the system
    Dalan->>Ranj:4xx if new_password is not same to confirm_password
    Dalan->>Ranj:4xx if new password is not strong
    Dalan->>Ranj:2xx reset user password
    Ranj->>User:notify user that password changed
```