feat: implement full authentication system with CSRF protection and email verification flow

app/api/auth/forgot-password/route.ts

@@ -1,9 +1,22 @@
-import { NextResponse } from 'next/server';
+import { NextResponse, NextRequest } from 'next/server';
 import prisma from '@/lib/prisma';
 import { sendEmail } from '@/lib/mail';
 import crypto from 'crypto';
 
-export async function POST(req: Request) {
+import { verifyCsrfToken, verifyOrigin } from '@/lib/csrf';
+
+export async function POST(req: NextRequest) {
+    // CSRF Protection
+    const isOriginValid = verifyOrigin(req);
+    const isCsrfValid = await verifyCsrfToken(req);
+
+    if (!isOriginValid || !isCsrfValid) {
+        return NextResponse.json(
+            { error: 'Protection CSRF : Requête invalide' },
+            { status: 403 }
+        );
+    }
+
   try {
     const { email } = await req.json();