# Password Change Verification Code Setup

## Overview
This feature adds email verification to password changes, requiring users to verify a 6-digit code sent to their email before changing their password. This matches the existing email change verification flow.

## Files Created/Modified

### New API Routes
1. **`app/api/auth/send-password-change-code/route.ts`**
   - Sends a verification code to the user's email
   - Checks for existing unexpired codes to prevent spam

2. **`app/api/auth/verify-password-change-code/route.ts`**
   - Verifies the code and updates the password
   - Uses Supabase admin credentials to update the auth password

### Updated Files
1. **`contexts/supabase-auth-context.tsx`**
   - Added `sendPasswordChangeCode()` method
   - Added `verifyPasswordChangeCode()` method
   - Updated `AuthContextType` interface

2. **`app/settings/page.tsx`**
   - Updated password change flow to use verification codes
   - Removed current password re-authentication requirement
   - Added password code state management
   - Updated UI to match email change verification pattern

### Database
1. **`create-password-change-verification-codes-table.sql`**
   - Creates the `password_change_verification_codes` table
   - Includes indexes and RLS policies

## Setup Instructions

### Step 1: Create the Database Table
Run the SQL file in your Supabase SQL Editor:
```sql
-- Navigate to Supabase Dashboard → SQL Editor
-- Copy the contents of create-password-change-verification-codes-table.sql
-- Paste and run the query
```

The table will store:
- `id` - Primary key
- `user_id` - Foreign key to users table
- `code` - 6-digit verification code
- `verified` - Whether the code was verified
- `expires_at` - Code expiration time (5 minutes)
- `created_at` - Creation timestamp

### Step 2: Verify Environment Variables
Ensure your `.env.local` has valid SMTP credentials:
- `SMTP_HOST`
- `SMTP_PORT`
- `SMTP_USER`
- `SMTP_PASSWORD`
- `SMTP_FROM_EMAIL`
- `SMTP_FROM_NAME`

These are required for sending the verification codes.

## User Flow

1. User goes to Settings → Account Security
2. Enters new password and confirms it
3. Clicks "Send Verification Code"
4. Verification code is sent to their email
5. User enters the 6-digit code
6. Clicks "Verify Code & Update Password"
7. Password is updated and user is notified

## Security Features

- **Time-limited codes**: Codes expire in 5 minutes
- **Single-use codes**: Codes are marked as verified after use
- **Email verification**: Users must have access to their email to change password
- **Database constraints**: Prevents old/invalid codes from being used
- **Row-level security**: Users can only access their own verification codes

## Testing

You can test this feature by:
1. Going to Settings page
2. Entering a new password
3. Clicking "Send Verification Code"
4. Checking your email for the verification code
5. Entering the code and verifying

If you're using a test email service (like Mailtrap), verify the email arrives in your test inbox.