feat: implement full authentication system with CSRF protection and email verification flow

app/api/auth/reset-password/route.ts

@@ -1,10 +1,22 @@
-import { NextResponse } from 'next/server';
+import { NextResponse, NextRequest } from 'next/server';
 import prisma from '@/lib/prisma';
 import bcrypt from 'bcryptjs';
+import { verifyCsrfToken, verifyOrigin } from '@/lib/csrf';
+
+export async function POST(request: NextRequest) {
+  // CSRF Protection
+  const isOriginValid = verifyOrigin(request);
+  const isCsrfValid = await verifyCsrfToken(request);
+
+  if (!isOriginValid || !isCsrfValid) {
+    return NextResponse.json(
+      { error: 'Protection CSRF : Requête invalide' },
+      { status: 403 }
+    );
+  }
 
-export async function POST(req: Request) {
   try {
-    const { token, password } = await req.json();
+    const { token, password } = await request.json();
 
     if (!token || !password) {
       return NextResponse.json({ error: 'Token et mot de passe sont requis' }, { status: 400 });