Password & Account Setup

Purpose - Lets a user create their first password using an OTP, and lets any existing user reset a forgotten password. 

Who Can Use It 

All login-capable roles: DHE, School Admin (via linked employee credentials), Employee, Student. 

Key Capabilities 

• Create Password: set an initial password using an OTP delivered to email or phone.
• Forgot Password: request a reset OTP by email or phone (web and mobile flows).
• Forgot Password Verify: submit OTP and new password to complete reset.
• For School Admin forgot-password on web, the list of associated school names is returned as informational context. 
• For School Admin and Student forgot-password on mobile, if multiple accounts are linked to the login, the user can pick the specific account first. 

How It Works 

1. User requests either the "create password" or "forgot password" flow.
2.  An OTP is sent to the registered email or phone. 
3. User submits the OTP and the new password.
4. The password is stored; the user is issued fresh access and refresh tokens.
   

Rules & Restrictions

• Minimum password length is 8 characters. 
• OTP and session token are both required to complete password creation or reset.
• For School Admin, the password is stored on the linked employee record (not on the school row), because a school is administered through an employee login.
• Session tokens are single-purpose and time-limited; expired or reused tokens fail verification.