create forgote password

backend/app/Admin/Controllers/ForgotPasswordOtpController.php

@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Admin\Controllers;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use App\Services\Auth\PasswordResetOtpService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\ValidationException;
+
+class ForgotPasswordOtpController extends Controller
+{
+    public function __construct(
+        private readonly PasswordResetOtpService $otpService
+    ) {}
+
+    public function sendOtp(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'exists:users,email'],
+        ]);
+
+        $email = $validated['email'];
+
+        $key = 'user-forgot-password-otp:' . $email . ':' . $request->ip();
+
+        if (RateLimiter::tooManyAttempts($key, 3)) {
+            throw ValidationException::withMessages([
+                'email' => ['Too many OTP requests. Please try again later.'],
+            ]);
+        }
+
+        RateLimiter::hit($key, 600);
+
+        $user = User::query()->where('email', $email)->firstOrFail();
+
+        $this->otpService->sendOtp($user, 'user');
+
+        return response()->json([
+            'message' => 'OTP sent to your email.',
+        ]);
+    }
+
+    public function verifyOtp(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'exists:users,email'],
+            'otp' => ['required', 'digits:6'],
+        ]);
+
+        $this->otpService->verifyOtp(
+            email: $validated['email'],
+            otp: $validated['otp'],
+            guard: 'user'
+        );
+
+        return response()->json([
+            'message' => 'OTP verified successfully.',
+        ]);
+    }
+
+    public function resetPassword(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'exists:users,email'],
+            'password' => ['required', 'confirmed',],
+        ]);
+
+        $record = $this->otpService->ensureVerified(
+            email: $validated['email'],
+            guard: 'user'
+        );
+
+        $user = User::query()->where('email', $validated['email'])->firstOrFail();
+
+        $user->update([
+            'password' => Hash::make($validated['password']),
+        ]);
+
+        $record->delete();
+
+        return response()->json([
+            'message' => 'User password reset successfully.',
+        ]);
+    }
+}

backend/app/Models/PasswordResetOtp.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class PasswordResetOtp extends Model
+{
+    protected $guarded = ['id'];
+}

backend/app/Models/UserGateway.php

@@ -3,10 +3,8 @@
 namespace App\Models;
 
 use Database\Factories\UserGatewayFactory;
-use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
-use Illuminate\Support\Facades\Storage;
 
 class UserGateway extends Model
 {
@@ -14,11 +12,4 @@ class UserGateway extends Model
     use HasFactory;
 
     protected $guarded = ['id'];
-
-    protected function logo(): Attribute
-    {
-        return Attribute::make(
-            get: fn($value) => $value == null ? null : Storage::disk('public')->url($value)
-        );
-    }
 }

backend/app/Notifications/ResetPasswordOtpNotification.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Notifications;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+class ResetPasswordOtpNotification extends Notification
+{
+    use Queueable;
+
+    public function __construct(
+        private readonly string $otp
+    ) {}
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject('Reset Password OTP')
+            ->greeting('Hello!')
+            ->line('Your password reset code is:')
+            ->line($this->otp)
+            ->line('This code will expire in 10 minutes.')
+            ->line('If you did not request password reset, ignore this email.');
+    }
+}

backend/app/Services/Auth/PasswordResetOtpService.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Services\Auth;
+
+use App\Models\PasswordResetOtp;
+use App\Notifications\ResetPasswordOtpNotification;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\ValidationException;
+
+class PasswordResetOtpService
+{
+    public function sendOtp(Model $user, string $guard = 'user'): void
+    {
+        $otp = (string) random_int(100000, 999999);
+
+        PasswordResetOtp::query()->where('email', $user->email)
+            ->where('guard', $guard)
+            ->delete();
+
+        PasswordResetOtp::query()->create([
+            'email' => $user->email,
+            'guard' => $guard,
+            'otp' => Hash::make($otp),
+            'expires_at' => now()->addMinutes(10),
+        ]);
+
+        $user->notify(new ResetPasswordOtpNotification($otp));
+    }
+
+    public function verifyOtp(string $email, string $otp, string $guard = 'user'): void
+    {
+        $record = PasswordResetOtp::query()->where('email', $email)
+            ->where('guard', $guard)
+            ->latest()
+            ->first();
+
+        if (! $record) {
+            throw ValidationException::withMessages([
+                'otp' => ['Invalid OTP.'],
+            ]);
+        }
+
+        if ($record->isExpired()) {
+            $record->delete();
+
+            throw ValidationException::withMessages([
+                'otp' => ['OTP has expired.'],
+            ]);
+        }
+
+        if ($record->attempts >= 5) {
+            $record->delete();
+
+            throw ValidationException::withMessages([
+                'otp' => ['Too many wrong attempts. Please request a new OTP.'],
+            ]);
+        }
+
+        if (! Hash::check($otp, $record->otp)) {
+            $record->increment('attempts');
+
+            throw ValidationException::withMessages([
+                'otp' => ['Invalid OTP.'],
+            ]);
+        }
+
+        $record->update([
+            'verified_at' => now(),
+        ]);
+    }
+
+    public function ensureVerified(string $email, string $guard = 'user'): PasswordResetOtp
+    {
+        $record = PasswordResetOtp::query()->where('email', $email)
+            ->where('guard', $guard)
+            ->latest()
+            ->first();
+
+        if (! $record || ! $record->isVerified()) {
+            throw ValidationException::withMessages([
+                'otp' => ['Please verify OTP first.'],
+            ]);
+        }
+
+        if ($record->isExpired()) {
+            $record->delete();
+
+            throw ValidationException::withMessages([
+                'otp' => ['OTP has expired.'],
+            ]);
+        }
+
+        return $record;
+    }
+
+    public function deleteOtp(string $email, string $guard = 'user'): void
+    {
+        PasswordResetOtp::query()->where('email', $email)
+            ->where('guard', $guard)
+            ->delete();
+    }
+}

backend/app/User/Controllers/ForgotPasswordOtpController.php

@@ -0,0 +1,89 @@
+<?php
+
+namespace App\User\Controllers;
+
+use App\Http\Controllers\Controller;
+use App\Models\Expert;
+use Illuminate\Http\Request;
+use App\Services\Auth\PasswordResetOtpService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\ValidationException;
+
+class ForgotPasswordOtpController extends Controller
+{
+    public function __construct(
+        private readonly PasswordResetOtpService $otpService
+    ) {}
+
+    public function sendOtp(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'exists:experts,email'],
+        ]);
+
+        $email = $validated['email'];
+
+        $key = 'expert-forgot-password-otp:' . $email . ':' . $request->ip();
+
+        if (RateLimiter::tooManyAttempts($key, 3)) {
+            throw ValidationException::withMessages([
+                'email' => ['Too many OTP requests. Please try again later.'],
+            ]);
+        }
+
+        RateLimiter::hit($key, 600);
+
+        $expert = Expert::query()->where('email', $email)->firstOrFail();
+
+        $this->otpService->sendOtp($expert, 'expert');
+
+        return response()->json([
+            'message' => 'OTP sent to your email.',
+        ]);
+    }
+
+    public function verifyOtp(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'exists:experts,email'],
+            'otp' => ['required', 'digits:6'],
+        ]);
+
+        $this->otpService->verifyOtp(
+            email: $validated['email'],
+            otp: $validated['otp'],
+            guard: 'expert'
+        );
+
+        return response()->json([
+            'message' => 'OTP verified successfully.',
+        ]);
+    }
+
+    public function resetPassword(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'exists:experts,email'],
+            'password' => ['required', 'confirmed'],
+        ]);
+
+        $record = $this->otpService->ensureVerified(
+            email: $validated['email'],
+            guard: 'expert'
+        );
+
+        $expert = Expert::query()->where('email', $validated['email'])->firstOrFail();
+
+        $expert->update([
+            'password' => Hash::make($validated['password']),
+        ]);
+
+        $record->delete();
+
+        return response()->json([
+            'message' => 'Expert password reset successfully.',
+        ]);
+    }
+}

backend/app/User/Controllers/GatewayManagementController.php

@@ -14,7 +14,6 @@ use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
-use Laravel\Passport\ClientRepository;
 use Throwable;
 
 class GatewayManagementController extends Controller
@@ -28,7 +27,7 @@ class GatewayManagementController extends Controller
             $request,
             allowedFilters: ['*'],
             allowedSortings: ['*'],
-            allowedSelects: ['*'],
+            allowedSelects: ['id', 'name', 'domain', 'tax_id', 'bank_name', 'account_holder', 'iban', 'business_type_id', 'business_type_name'],
         );
     }
 
@@ -39,19 +38,9 @@ class GatewayManagementController extends Controller
     {
         $user = Auth::guard('web')->user();
 
-        $logo = $request->hasFile('logo')
+        $logo = $request->has('logo') ? FileFacade::save($request->file('logo'), "{$user->id}") : null;
-            ? FileFacade::save($request->file('logo'), "user_gateway/{$user->id}")
-            : null;
-
-        $passportClient = DB::transaction(function () use ($user, $logo, $request) {
-
-            $clientName = "Gateway {$request->name} - User {$user->id}";
-            $client = app(ClientRepository::class)->createPasswordGrantClient($clientName, 'users', true);
-            $client->Fill([
-                'owner_type' => get_class($user),
-                'owner_id' => $user->id,
-            ])->save();
 
+        DB::transaction(function () use ($user, $logo, $request) {
             UserGateway::query()->create([
                 'user_id' => $user->id,
                 'username' => $user->username,
@@ -64,20 +53,15 @@ class GatewayManagementController extends Controller
                 'business_type_id' => $request->business_type_id,
                 'business_type_name' => BusinessTypeEnum::name($request->business_type_id),
                 'logo' => $logo,
-                'client_id' => $client->id,
-                'client_secret' => $client->secret,
             ]);
 
             $user->update(['authority_level' => 1]);
-
-            return $client;
         });
 
-        return $this->successResponse([
+
-            'client_id' => $passportClient->id,
+        return $this->successResponse();
-            'client_secret' => $passportClient->secret,
-        ]);
     }
+
     public function show(UserGateway $gateway): JsonResponse
     {
         return $this->successResponse($gateway);

backend/app/User/Requests/Gateway/StoreRequest.php

@@ -13,7 +13,8 @@ class StoreRequest extends FormRequest
      */
     public function authorize(): bool
     {
-return true;    }
+        return Auth::guard('web')->user()->kyc_status;
+    }
 
     /**
      * Get the validation rules that apply to the request.

backend/database/migrations/2026_06_01_062350_create_password_reset_otps_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('password_reset_otps', function (Blueprint $table) {
+        $table->id();
+        $table->string('email')->index();
+        $table->string('otp');
+        $table->string('guard_name');
+        $table->timestamp('expires_at');
+        $table->timestamp('verified_at')->nullable();
+        $table->unsignedTinyInteger('attempts')->default(0);
+        $table->timestamps();
+        });
+        }
+
+        public function down(): void
+        {
+        Schema::dropIfExists('password_reset_otps');
+        }
+};

backend/database/migrations/2026_06_01_102551_add_client_credentials_to_user_gateways_table.php

@@ -1,30 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::table('user_gateways', function (Blueprint $table) {
-            $table->string('client_id')->nullable();
-            $table->string('client_secret')->nullable();
-            $table->integer('status')->default(0);
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('user_gateways', function (Blueprint $table) {
-            $table->dropColumn(['client_id', 'client_secret','status']);
-        });
-    }
-};

backend/routes/expert.php

@@ -77,7 +77,7 @@ Route::prefix('expert')
 
 Route::prefix('profile')
     ->name('profile.')
-    ->middleware('auth:expert')
+    ->middleware('auth')
     ->controller(ProfileController::class)
     ->group(function () {
         Route::get('info', 'info')->name('info');