fix: send real password reset link instead of dummy route

.gitignore

@@ -30,3 +30,12 @@ build/
 
 ### ENVIRONMENT ###
 .env
+.env.local
+.env.*.local
+
+### SECRETS ###
+# Credential files kept locally but never committed
+secret.json
+**/secret.json
+*-credentials.json
+serviceAccount*.json

src/main/java/com/pecacm/backend/services/EmailService.java

@@ -8,6 +8,7 @@
 import jakarta.mail.internet.MimeMessage;
 import org.commonmark.node.Node;
 import org.commonmark.renderer.html.HtmlRenderer;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.mail.SimpleMailMessage;
 import org.springframework.mail.javamail.JavaMailSender;
@@ -26,6 +27,18 @@ public class EmailService {
     private final VerificationService verificationService;
     private final UserRepository userRepository;
     private final UserService userService;
+
+    @Value("${verify.base.frontend}")
+    private String frontendBaseUrl;
+
+    @Value("${verify.reset.path:forgot-password/change-password}")
+    private String resetPath;
+
+    // Gmail requires the sender to match the authenticated account, so the From
+    // address is taken from the same property used to log in to the SMTP server.
+    @Value("${spring.mail.username}")
+    private String fromAddress;
+
     public EmailService(JavaMailSender javaMailSender, VerificationService verificationService, UserRepository userRepository, UserService userService) {
         this.javaMailSender = javaMailSender;
         this.verificationService = verificationService;
@@ -41,15 +54,26 @@ public void sendVerificationEmail(String username) {
         VerificationToken token = verificationService.getVerificationToken(userService.getUserByEmail(username));
 
         SimpleMailMessage mailMessage = new SimpleMailMessage();
+        mailMessage.setFrom(fromAddress);
         mailMessage.setTo(username);
         mailMessage.setSubject("Reset your password");
         mailMessage.setText(
-                "to change your password please click here " + "dummyFrontEndRoute?token=" + token.getToken().toString()
+                "Hi,\n\n"
+                        + "We received a request to reset the password for your PEC ACM account.\n\n"
+                        + "Reset it here (this link is valid for 15 minutes):\n"
+                        + buildResetLink(token) + "\n\n"
+                        + "If you did not request this, you can safely ignore this email.\n"
         );
 
         javaMailSender.send(mailMessage);
     }
 
+    private String buildResetLink(VerificationToken token) {
+        String base = frontendBaseUrl.endsWith("/") ? frontendBaseUrl : frontendBaseUrl + "/";
+        String path = resetPath.startsWith("/") ? resetPath.substring(1) : resetPath;
+        return base + path + "?token=" + token.getToken();
+    }
+
     public void sendEmail(List<User> users, String subject, String body) {
         String[] recipients = users.stream().map(User::getEmail).toArray(String[]::new);
         String htmlBody = convertMarkdownToHtml(body);

src/main/resources/application.yml

@@ -63,6 +63,9 @@ jwt:
 verify:
   base:
     frontend: https://pecacm.in/
+  reset:
+    # Frontend route that reads ?token= and collects the new password
+    path: forgot-password/change-password
 
 logging:
   file: