initial commit

2026-07-21 13:38:38 +07:00
commit 5047288f04
777 changed files with 57255 additions and 0 deletions
@@ -0,0 +1,63 @@
+@page "/account/access-denied"
+@using Indotalent.Features.Root
+@using MudBlazor
+@layout MainLayout
+
+<PageTitle>Access Denied - Insufficient Permissions</PageTitle>
+
+<MudContainer MaxWidth="MaxWidth.Medium" Class="d-flex align-center justify-center" Style="height: calc(100vh - 64px);">
+
+    <div class="text-center">
+
+        <MudIcon Icon="@Icons.Material.Filled.GppBad"
+                 Size="Size.Large"
+                 Color="Color.Error"
+                 Class="mb-6"
+                 Style="font-size: 120px;" />
+
+        <MudText Typo="Typo.h3" Class="mb-4" Style="font-weight: 800; color: #1a1a1a;">Access Denied</MudText>
+
+        <MudText Typo="Typo.body1" Class="mb-6" Style="color: #64748b;">
+            Sorry, you do not have the required permissions to access this module.<br />
+            This area is restricted to authorized administrative personnel only.
+        </MudText>
+
+        <MudPaper Elevation="1" Class="pa-4 mb-8 d-inline-block" Style="border-radius: 4px; border: 1px solid #DCEBFA;">
+            <MudText Typo="Typo.subtitle2" Class="mb-1">
+                <strong>Error Code:</strong> <code>AGS_AUTH_INSUFFICIENT_PERMISSIONS</code>
+            </MudText>
+            <MudText Typo="Typo.caption" Style="color: #94a3b8; font-family: 'Consolas', monospace;">
+                Verification failed for the current security context.
+            </MudText>
+        </MudPaper>
+
+        <div class="d-flex align-center justify-center gap-4">
+            <MudButton Variant="Variant.Filled"
+                       Color="Color.Primary"
+                       Size="Size.Large"
+                       OnClick="GoHome"
+                       StartIcon="@Icons.Material.Filled.Home"
+                       Style="border-radius: 4px; font-weight: 700;">
+                Back to Home
+            </MudButton>
+
+            <MudButton Variant="Variant.Outlined"
+                       Color="Color.Default"
+                       Size="Size.Large"
+                       OnClick="Logout"
+                       StartIcon="@Icons.Material.Filled.Logout"
+                       Style="border-radius: 4px; font-weight: 700; border: 2px solid #e2e8f0;">
+                Logout & Switch Account
+            </MudButton>
+        </div>
+
+    </div>
+
+</MudContainer>
+
+@code {
+    [Inject] private NavigationManager Nav { get; set; } = default!;
+
+    private void GoHome() => Nav.NavigateTo("/");
+    private void Logout() => Nav.NavigateTo("/account/logout");
+}
@@ -0,0 +1,19 @@
+@inject NavigationManager Navigation
+@using Microsoft.AspNetCore.Authorization
+@using Microsoft.AspNetCore.Components.Authorization
+@attribute [AllowAnonymous]
+
+<AuthorizeView>
+    <NotAuthorized>
+        @{
+            var returnUrl = Navigation.ToBaseRelativePath(Navigation.Uri);
+            Navigation.NavigateTo($"/account/login?returnUrl={Uri.EscapeDataString(returnUrl)}", forceLoad: false);
+        }
+    </NotAuthorized>
+    <Authorized>
+        @{
+            Navigation.NavigateTo("/account/access-denied");
+        }
+    </Authorized>
+</AuthorizeView>
+
@@ -0,0 +1,217 @@
+using Indotalent.ConfigFrontEnd.Service;
+using Indotalent.Data.Entities;
+using Indotalent.Features.Account.ForgotPassword.Cqrs;
+using Indotalent.Features.Account.Login.Cqrs;
+using Indotalent.Features.Account.Register.Cqrs;
+using Indotalent.Features.Account.ResetPassword.Cqrs;
+using Indotalent.Infrastructure.Authentication.Identity;
+using MediatR;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+using System.Security.Claims;
+
+namespace Indotalent.Features.Account;
+
+public static class AccountEndPoint
+{
+    public static IEndpointConventionBuilder MapAccountEndpoints(this IEndpointRouteBuilder endpoints)
+    {
+        var group = endpoints.MapGroup("/account").WithTags("Account");
+
+        group.MapPost("/signin-sso", async ([FromQuery] string email, UserManager<ApplicationUser> userManager, SignInManager<ApplicationUser> signInManager, IOptions<JwtSettingsModel> jwtOptions, HttpContext context) =>
+        {
+            if (string.IsNullOrWhiteSpace(email)) return Results.Json(new { status = 401, title = "Email is required" }, statusCode: 401);
+
+            var user = await userManager.FindByEmailAsync(email);
+
+            if (user == null || !user.IsActive)
+            {
+                return Results.Json(new { status = 401, title = "Account not found or inactive" }, statusCode: 401);
+            }
+
+            var jwtSettings = jwtOptions.Value;
+            var token = JwtService.GenerateNewJwt(user, jwtSettings);
+            var refreshToken = Guid.NewGuid().ToString().Replace("-", "");
+
+            user.RefreshToken = refreshToken;
+            user.LastLoginAt = DateTime.Now;
+            await userManager.UpdateAsync(user);
+
+            await signInManager.SignInAsync(user, isPersistent: true);
+
+            context.Response.Cookies.Append("X-Auth-Token", token, new CookieOptions
+            {
+                HttpOnly = true,
+                Secure = true,
+                SameSite = SameSiteMode.Strict,
+                Expires = DateTimeOffset.UtcNow.AddDays(1)
+            });
+
+            context.Response.Cookies.Append("X-Refresh-Token", refreshToken, new CookieOptions
+            {
+                HttpOnly = true,
+                Secure = true,
+                SameSite = SameSiteMode.Strict,
+                Expires = DateTimeOffset.UtcNow.AddDays(7)
+            });
+
+            return Results.Ok(new { status = 200, title = "SSO Login successful" });
+        });
+
+        group.MapGet("/active-user-exists", async ([FromQuery] string email, UserManager<ApplicationUser> userManager) =>
+        {
+            if (string.IsNullOrWhiteSpace(email))
+            {
+                return Results.Ok(new { exists = false, isActive = false });
+            }
+
+            var user = await userManager.FindByEmailAsync(email);
+
+            if (user == null)
+            {
+                return Results.Ok(new { exists = false, isActive = false });
+            }
+
+            return Results.Ok(new { exists = true, isActive = user.IsActive });
+        });
+
+        group.MapPost("/signin", async ([FromBody] LoginRequest request, IMediator mediator, HttpContext context, UserManager<ApplicationUser> userManager) =>
+        {
+            var command = new LoginCommand(request);
+            var response = await mediator.Send(command);
+
+            if (response.Succeeded)
+            {
+                var user = await userManager.FindByEmailAsync(request.Email);
+
+                if (user != null)
+                {
+                    context.Response.Cookies.Append("X-Auth-Token", response.Token!, new CookieOptions
+                    {
+                        HttpOnly = true,
+                        Secure = true,
+                        SameSite = SameSiteMode.Strict,
+                        Expires = DateTimeOffset.UtcNow.AddDays(1)
+                    });
+
+                    context.Response.Cookies.Append("X-Refresh-Token", user.RefreshToken!, new CookieOptions
+                    {
+                        HttpOnly = true,
+                        Secure = true,
+                        SameSite = SameSiteMode.Strict,
+                        Expires = DateTimeOffset.UtcNow.AddDays(7)
+                    });
+                }
+
+                return Results.Ok(new { status = 200, title = response.Message });
+            }
+            return Results.Json(new { status = 401, title = response.Message }, statusCode: 401);
+        });
+
+
+
+        group.MapPost("/refresh-token", async (HttpContext context) =>
+        {
+            var userManager = context.RequestServices.GetRequiredService<UserManager<ApplicationUser>>();
+            var jwtSettings = context.RequestServices.GetRequiredService<IOptions<JwtSettingsModel>>().Value;
+
+            var refreshToken = context.Request.Headers["X-Refresh-Token"].ToString();
+
+            if (string.IsNullOrEmpty(refreshToken)) return Results.Unauthorized();
+
+            var user = await userManager.Users.FirstOrDefaultAsync(u => u.RefreshToken == refreshToken);
+
+            if (user == null || !user.IsActive) return Results.Unauthorized();
+
+            var newToken = JwtService.GenerateNewJwt(user, jwtSettings);
+
+            context.Response.Cookies.Append("X-Auth-Token", newToken, new CookieOptions
+            {
+                HttpOnly = true,
+                Secure = true,
+                SameSite = SameSiteMode.Strict,
+                Expires = DateTimeOffset.UtcNow.AddDays(1)
+            });
+
+            return Results.Ok(new LoginResponse { Succeeded = true, Token = newToken });
+        });
+
+        group.MapPost("/signup", async ([FromBody] CreateUserRequest request, IMediator mediator) =>
+        {
+            try
+            {
+                var command = new CreateUserCommand(request);
+                var response = await mediator.Send(command);
+                return Results.Ok(response);
+            }
+            catch (Exception ex)
+            {
+                return Results.BadRequest(new { errors = new[] { ex.Message } });
+            }
+        });
+
+        group.MapPost("/signout", async (
+            SignInManager<ApplicationUser> signInManager,
+            UserManager<ApplicationUser> userManager,
+            HttpContext context) =>
+        {
+            var userId = context.User.FindFirstValue(ClaimTypes.NameIdentifier);
+
+            if (!string.IsNullOrEmpty(userId))
+            {
+                var user = await userManager.FindByIdAsync(userId);
+                if (user != null)
+                {
+                    user.RefreshToken = null;
+                    await userManager.UpdateAsync(user);
+                }
+            }
+
+            await signInManager.SignOutAsync();
+
+            context.Response.Cookies.Delete("X-Auth-Token");
+            context.Response.Cookies.Delete("X-Refresh-Token");
+
+            return Results.Ok(new { status = 200, title = "Successfully signed out" });
+
+        });
+
+        group.MapPost("/forgot-password", async ([FromBody] ForgotPasswordRequest request, IMediator mediator) =>
+        {
+            try
+            {
+                var command = new ForgotPasswordCommand(request);
+                var response = await mediator.Send(command);
+                return Results.Ok(response);
+            }
+            catch (Exception ex)
+            {
+                return Results.BadRequest(new { errors = new[] { ex.Message } });
+            }
+        });
+
+        group.MapPost("/logout", async (SignInManager<ApplicationUser> signInManager) =>
+        {
+            await signInManager.SignOutAsync();
+            return Results.Ok(new { title = "Success user logout" });
+        }).RequireAuthorization();
+
+        group.MapPost("/reset-password", async ([FromBody] ResetPasswordRequest request, IMediator mediator) =>
+        {
+            try
+            {
+                var command = new ResetPasswordCommand(request);
+                var response = await mediator.Send(command);
+                return Results.Ok(response);
+            }
+            catch (Exception ex)
+            {
+                return Results.BadRequest(new { errors = new[] { ex.Message } });
+            }
+        });
+
+        return group;
+    }
+}
@@ -0,0 +1,350 @@
+@using Indotalent.Shared.Consts
+@inherits LayoutComponentBase
+@inject NavigationManager Navigation
+
+<MudThemeProvider />
+<MudDialogProvider />
+<MudSnackbarProvider />
+<MudPopoverProvider />
+
+<style>
+    @@import url('https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;450;500;600;700;800&display=swap');
+
+    *, *::before, *::after { box-sizing: border-box; }
+
+    /* ===== SPLIT CONTAINER ===== */
+    .auth-split-container {
+        display: flex;
+        min-height: 100vh;
+        font-family: "Poppins", sans-serif;
+    }
+
+    /* ===== LEFT PANEL - BRANDING ===== */
+    .auth-left-panel {
+        display: none;
+        position: relative;
+        overflow: hidden;
+        background: linear-gradient(135deg, #7C3AED, #8B5CF6, #6D28D9);
+    }
+
+    .auth-left-panel::before {
+        content: '';
+        position: absolute;
+        width: 500px;
+        height: 500px;
+        border-radius: 50%;
+        background: rgba(255, 255, 255, 0.06);
+        top: -120px;
+        right: -180px;
+    }
+
+    .auth-left-panel::after {
+        content: '';
+        position: absolute;
+        width: 300px;
+        height: 300px;
+        border-radius: 50%;
+        background: rgba(255, 255, 255, 0.04);
+        bottom: -60px;
+        left: -80px;
+    }
+
+    .auth-left-content {
+        position: relative;
+        z-index: 1;
+        max-width: 26rem;
+        padding: 3rem;
+        display: flex;
+        flex-direction: column;
+        justify-content: center;
+        gap: 2rem;
+    }
+
+    .auth-brand-row {
+        display: flex;
+        align-items: center;
+        gap: 0.75rem;
+    }
+
+    .auth-brand-icon {
+        width: 3rem;
+        height: 3rem;
+        background: rgba(255, 255, 255, 0.2);
+        border-radius: 0.75rem;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        backdrop-filter: blur(4px);
+        cursor: pointer;
+        transition: background 0.2s;
+        flex-shrink: 0;
+    }
+
+    .auth-brand-icon:hover {
+        background: rgba(255, 255, 255, 0.3);
+    }
+
+    .auth-brand-icon svg {
+        width: 1.75rem;
+        height: 1.75rem;
+        color: #ffffff;
+    }
+
+    .auth-brand-name {
+        font-size: 1.375rem;
+        font-weight: 700;
+        color: #ffffff;
+        line-height: 1.2;
+    }
+
+    .auth-brand-subtitle {
+        font-size: 0.75rem;
+        color: rgba(255, 255, 255, 0.65);
+    }
+
+    .auth-welcome-title {
+        font-size: 1.75rem;
+        font-weight: 700;
+        color: #ffffff;
+        line-height: 1.3;
+        margin: 0;
+    }
+
+    .auth-feature-list {
+        display: flex;
+        flex-direction: column;
+        gap: 0.75rem;
+    }
+
+    .auth-feature-item {
+        display: flex;
+        align-items: center;
+        gap: 0.625rem;
+        padding: 0.625rem 0.875rem;
+        background: rgba(255, 255, 255, 0.08);
+        border-radius: 0.5rem;
+        border: 1px solid rgba(255, 255, 255, 0.1);
+    }
+
+    .auth-feature-icon {
+        width: 1.75rem;
+        height: 1.75rem;
+        border-radius: 0.375rem;
+        background: rgba(255, 255, 255, 0.15);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        flex-shrink: 0;
+    }
+
+    .auth-feature-icon svg {
+        width: 0.875rem;
+        height: 0.875rem;
+        color: #ffffff;
+    }
+
+    .auth-feature-text-title {
+        font-size: 0.8125rem;
+        font-weight: 600;
+        color: #ffffff;
+    }
+
+    .auth-feature-text-desc {
+        font-size: 0.71875rem;
+        color: rgba(255, 255, 255, 0.65);
+        margin-top: 0.0625rem;
+    }
+
+    /* ===== RIGHT PANEL - FORM AREA ===== */
+    .auth-right-panel {
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        width: 100%;
+        padding: 1.5rem;
+    }
+
+    .auth-form-wrapper {
+        width: 100%;
+        max-width: 28rem;
+    }
+
+    .auth-card {
+        border-radius: 1rem !important;
+        border: 1px solid #E2E8F0 !important;
+        box-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.05), 0 8px 10px -6px rgba(0, 0, 0, 0.02) !important;
+        overflow: visible !important;
+    }
+
+    .auth-card .mud-card-content {
+        padding: 2rem !important;
+    }
+
+    .auth-card-footer {
+        text-align: center;
+        padding: 1.25rem 1rem 0.5rem 1rem;
+    }
+
+    .auth-card-footer-text {
+        font-size: 0.75rem;
+        color: #94A3B8;
+        letter-spacing: 0.5px;
+        font-weight: 500;
+    }
+
+    /* ===== MOBILE BRAND STRIP ===== */
+    .auth-mobile-brand {
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.625rem;
+        padding: 0.75rem 1rem;
+        margin-bottom: 1.5rem;
+    }
+
+    .auth-mobile-brand-icon {
+        width: 2.5rem;
+        height: 2.5rem;
+        background: #8B5CF6;
+        border-radius: 0.625rem;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+    }
+
+    .auth-mobile-brand-icon svg {
+        width: 1.5rem;
+        height: 1.5rem;
+        color: #ffffff;
+    }
+
+    .auth-mobile-brand-name {
+        font-size: 1.25rem;
+        font-weight: 700;
+        color: #1E293B;
+    }
+
+    /* ===== RESPONSIVE ===== */
+    @@media (min-width: 1024px) {
+        .auth-left-panel {
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            width: 50%;
+        }
+
+        .auth-right-panel {
+            width: 50%;
+            padding: 3rem 4rem;
+        }
+
+        .auth-mobile-brand {
+            display: none;
+        }
+    }
+
+    @@media (min-width: 1280px) {
+        .auth-right-panel {
+            padding: 4rem 5rem;
+        }
+
+        .auth-left-content {
+            padding: 4rem;
+        }
+    }
+</style>
+
+<div class="auth-split-container">
+
+    <!-- ===== LEFT PANEL: BRANDING ===== -->
+    <div class="auth-left-panel">
+        <div class="auth-left-content">
+            <div class="auth-brand-row">
+                <div class="auth-brand-icon" @onclick="NavigateToHome">
+                    <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                        <path stroke-linecap="round" stroke-linejoin="round" d="M12 2L2 7l10 5 10-5-10-5zM2 17l10 5 10-5M2 12l10 5 10-5"/>
+                    </svg>
+                </div>
+                <div>
+                    <div class="auth-brand-name">@GlobalConsts.AppName</div>
+                    <div class="auth-brand-subtitle">Enterprise Application Platform</div>
+                </div>
+            </div>
+
+            <h2 class="auth-welcome-title">One Platform,<br/>All Your Business</h2>
+
+            <div class="auth-feature-list">
+                <div class="auth-feature-item">
+                    <div class="auth-feature-icon">
+                        <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6A2.25 2.25 0 016 3.75h2.25A2.25 2.25 0 0110.5 6v2.25a2.25 2.25 0 01-2.25 2.25H6a2.25 2.25 0 01-2.25-2.25V6zM13.5 6a2.25 2.25 0 012.25-2.25H18A2.25 2.25 0 0120.25 6v2.25A2.25 2.25 0 0118 10.5h-2.25A2.25 2.25 0 0113.5 8.25V6zM3.75 15.75A2.25 2.25 0 016 13.5h2.25a2.25 2.25 0 012.25 2.25V18a2.25 2.25 0 01-2.25 2.25H6A2.25 2.25 0 013.75 18v-2.25zM13.5 15.75a2.25 2.25 0 012.25-2.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-2.25A2.25 2.25 0 0113.5 18v-2.25z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <div class="auth-feature-text-title">Inventory & Procurement</div>
+                        <div class="auth-feature-text-desc">Products, warehouses, purchase orders</div>
+                    </div>
+                </div>
+                <div class="auth-feature-item">
+                    <div class="auth-feature-icon">
+                        <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M2.25 18.75a60.07 60.07 0 0115.797 2.101c.727.198 1.453-.342 1.453-1.096V18.75M3.75 4.5v.75A.75.75 0 013 6h-.75m0 0v-.375c0-.621.504-1.125 1.125-1.125H20.25M2.25 6v9m18-10.5v.75c0 .414.336.75.75.75h.75m-1.5 0h.375c.621 0 1.125.504 1.125 1.125v9.75c0 .621-.504 1.125-1.125 1.125h-.375M20.25 18v-.75c0-.414.336-.75.75-.75h.75M6 12h.008v.008H6V12zm3 0h.008v.008H9V12zm3 0h.008v.008H12V12z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <div class="auth-feature-text-title">Sales & Orders</div>
+                        <div class="auth-feature-text-desc">Invoices, payments, customer management</div>
+                    </div>
+                </div>
+                <div class="auth-feature-item">
+                    <div class="auth-feature-icon">
+                        <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M3 13.125C3 12.504 3.504 12 4.125 12h2.25c.621 0 1.125.504 1.125 1.125v6.75C7.5 20.496 6.996 21 6.375 21h-2.25A1.125 1.125 0 013 19.875v-6.75zM9.75 8.625c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125v11.25c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 01-1.125-1.125V8.625zM16.5 4.125c0-.621.504-1.125 1.125-1.125h2.25C20.496 3 21 3.504 21 4.125v15.75c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 01-1.125-1.125V4.125z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <div class="auth-feature-text-title">Reports & Analytics</div>
+                        <div class="auth-feature-text-desc">Real-time dashboards and data insights</div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <!-- ===== RIGHT PANEL: FORM AREA ===== -->
+    <div class="auth-right-panel">
+        <div class="auth-form-wrapper">
+
+            <!-- Mobile Brand Strip -->
+            <div class="auth-mobile-brand">
+                <div class="auth-mobile-brand-icon">
+                    <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                        <path stroke-linecap="round" stroke-linejoin="round" d="M12 2L2 7l10 5 10-5-10-5zM2 17l10 5 10-5M2 12l10 5 10-5"/>
+                    </svg>
+                </div>
+                <span class="auth-mobile-brand-name">@GlobalConsts.AppName</span>
+            </div>
+
+            <!-- Form Card -->
+            <MudCard Elevation="0" Class="auth-card">
+                <MudCardContent>
+                    @Body
+                </MudCardContent>
+            </MudCard>
+
+            <!-- Footer Copyright -->
+            <div class="auth-card-footer">
+                <span class="auth-card-footer-text">
+                    © @DateTime.Now.Year @GlobalConsts.AppInitial. ALL RIGHTS RESERVED.
+                </span>
+            </div>
+        </div>
+    </div>
+</div>
+
+@code {
+    private void NavigateToHome()
+    {
+        Navigation.NavigateTo("/", forceLoad: true);
+    }
+}
@@ -0,0 +1,130 @@
+@page "/account/confirm-email"
+@layout AuthenticationLayout
+@using Indotalent.Shared.Consts
+@using Microsoft.AspNetCore.Identity
+@using Microsoft.AspNetCore.WebUtilities
+@using System.Text
+@using Indotalent.Data.Entities
+@inject UserManager<ApplicationUser> UserManager
+@inject NavigationManager Navigation
+@inject ISnackbar Snackbar
+
+<PageTitle>Confirming Email - @GlobalConsts.AppInitial</PageTitle>
+
+<style>
+    /* ===== CONFIRM CONTAINER ===== */
+    .confirm-container {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        text-align: center;
+    }
+
+    .confirm-icon-wrapper {
+        display: flex;
+        justify-content: center;
+        margin-bottom: 1.5rem;
+    }
+
+    .confirm-icon-circle {
+        width: 4.5rem;
+        height: 4.5rem;
+        border-radius: 50%;
+        background: rgba(139, 92, 246, 0.1);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+    }
+
+    .confirm-icon-circle svg {
+        width: 2.25rem;
+        height: 2.25rem;
+        color: #8B5CF6;
+    }
+
+    .confirm-title {
+        font-size: 1.5rem;
+        font-weight: 700;
+        color: #1E293B;
+        margin: 0 0 0.25rem 0;
+    }
+
+    .confirm-desc {
+        font-size: 0.875rem;
+        color: #64748B;
+        margin: 0 0 2rem 0;
+    }
+
+    /* ===== SPINNER ===== */
+    .confirm-spinner {
+        width: 3rem;
+        height: 3rem;
+        border: 4px solid rgba(139, 92, 246, 0.15);
+        border-top-color: #8B5CF6;
+        border-radius: 50%;
+        animation: confirm-spin 0.8s linear infinite;
+    }
+
+    @@keyframes confirm-spin {
+        to { transform: rotate(360deg); }
+    }
+</style>
+
+<div class="confirm-container">
+    <div class="confirm-icon-wrapper">
+        <div class="confirm-icon-circle">
+            <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75m-3-7.036A11.959 11.959 0 013.598 6 11.99 11.99 0 003 9.749c0 5.592 3.824 10.29 9 11.623 5.176-1.332 9-6.03 9-11.622 0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285z"/>
+            </svg>
+        </div>
+    </div>
+
+    <h2 class="confirm-title">Verifying Your Account</h2>
+    <p class="confirm-desc">Please wait while we validate your email address...</p>
+
+    <div class="confirm-spinner"></div>
+</div>
+
+@code {
+    [SupplyParameterFromQuery] public string? userId { get; set; }
+    [SupplyParameterFromQuery] public string? code { get; set; }
+
+    protected override async Task OnInitializedAsync()
+    {
+        if (string.IsNullOrEmpty(userId) || string.IsNullOrEmpty(code))
+        {
+            Snackbar.Add("Invalid or expired confirmation link.", Severity.Error);
+            Navigation.NavigateTo("/account/login");
+            return;
+        }
+
+        var user = await UserManager.FindByIdAsync(userId);
+        if (user == null)
+        {
+            Snackbar.Add("User record not found.", Severity.Error);
+            Navigation.NavigateTo("/account/login");
+            return;
+        }
+
+        try
+        {
+            var decodedCode = Encoding.UTF8.GetString(WebEncoders.Base64UrlDecode(code));
+            var result = await UserManager.ConfirmEmailAsync(user, decodedCode);
+            await Task.Delay(500);
+            if (result.Succeeded)
+            {
+                Snackbar.Add("Email verified successfully! You can now sign in.", Severity.Success);
+            }
+            else
+            {
+                Snackbar.Add("Verification failed. The link may have expired.", Severity.Error);
+            }
+        }
+        catch
+        {
+            Snackbar.Add("An error occurred during verification.", Severity.Error);
+        }
+
+        Navigation.NavigateTo("/account/login");
+    }
+}
@@ -0,0 +1,216 @@
+@page "/account/forgot-password"
+@layout AuthenticationLayout
+@using System.ComponentModel.DataAnnotations
+@using Indotalent.Shared.Consts
+@using Microsoft.JSInterop
+@inject IJSRuntime JSRuntime
+@inject ISnackbar Snackbar
+@inject NavigationManager Navigation
+
+<PageTitle>Forgot Password - @GlobalConsts.AppInitial</PageTitle>
+
+<style>
+    /* ===== PAGE HEADER ===== */
+    .page-header {
+        text-align: center;
+        margin-bottom: 2rem;
+    }
+
+    .page-header h2 {
+        font-size: 1.5rem;
+        font-weight: 700;
+        color: #1E293B;
+        margin: 0 0 0.25rem 0;
+    }
+
+    .page-header p {
+        font-size: 0.875rem;
+        color: #94A3B8;
+        margin: 0;
+        line-height: 1.5;
+    }
+
+    /* ===== FORM LABEL ===== */
+    .form-label {
+        display: block;
+        font-size: 0.8125rem;
+        font-weight: 600;
+        color: #475569;
+        margin-bottom: 0.375rem;
+    }
+
+    /* ===== SUBMIT BUTTON ===== */
+    .btn-submit {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.5rem;
+        padding: 0.75rem 1.75rem;
+        background: #8B5CF6;
+        color: #ffffff;
+        font-size: 0.875rem;
+        font-weight: 600;
+        border-radius: 0.5rem;
+        transition: all 0.2s;
+        cursor: pointer;
+        border: none;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+    }
+
+    .btn-submit:hover:not(:disabled) {
+        background: #7C3AED;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(139, 92, 246, 0.3);
+    }
+
+    .btn-submit:disabled {
+        opacity: 0.7;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+    }
+
+    /* ===== SPINNER ANIMATION ===== */
+    @@keyframes spin {
+        to { transform: rotate(360deg); }
+    }
+
+    .spinner {
+        animation: spin 1s linear infinite;
+    }
+
+    /* ===== FOOTER ===== */
+    .auth-link {
+        color: #8B5CF6;
+        font-size: 0.875rem;
+        font-weight: 600;
+        text-decoration: none;
+        cursor: pointer;
+        transition: color 0.2s;
+    }
+
+    .auth-link:hover {
+        color: #7C3AED;
+        text-decoration: underline;
+    }
+
+    .auth-footer {
+        margin-top: 1.5rem;
+        text-align: center;
+        font-size: 0.875rem;
+        color: #64748B;
+    }
+</style>
+
+<div class="page-header">
+    <h2>Forgot Password?</h2>
+    <p>Enter your email address below and we'll send you a link to reset your password.</p>
+</div>
+
+<MudForm @ref="form" @bind-IsValid="@success">
+
+    <div style="display: flex; flex-direction: column; gap: 1rem;">
+        <div>
+            <label class="form-label" for="email-field">Email Address</label>
+            <MudTextField T="string"
+                          @bind-Value="model.Email"
+                          Variant="Variant.Outlined"
+                          Placeholder="name@example.com"
+                          Margin="Margin.Dense"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Email"
+                          Required="true"
+                          Validation="@(new EmailAddressAttribute() { ErrorMessage = "Invalid email address format" })"
+                          For="@(() => model.Email)"
+                          id="email-field" />
+        </div>
+
+        <button class="btn-submit" type="button" disabled="@(!success || isProcessing)" @onclick="HandleForgotPassword">
+            @if (isProcessing)
+            {
+                <svg class="spinner" style="width: 1rem; height: 1rem;" fill="none" viewBox="0 0 24 24">
+                    <circle style="opacity: 0.25;" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"/>
+                    <path style="opacity: 0.75;" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"/>
+                </svg>
+                <span>Sending link...</span>
+            }
+            else
+            {
+                <span>Send Reset Link</span>
+            }
+        </button>
+    </div>
+</MudForm>
+
+<div class="auth-footer">
+    Remember your password?
+    <a class="auth-link" href="/account/login">Back to Sign In</a>
+</div>
+
+@code {
+    private MudForm form = default!;
+    private bool success;
+    private bool isProcessing;
+    private ForgotPasswordModel model = new();
+
+    private class ForgotPasswordModel
+    {
+        public string Email { get; set; } = "";
+    }
+
+    private async Task HandleForgotPassword()
+    {
+        await form.Validate();
+        if (!success) return;
+
+        isProcessing = true;
+        StateHasChanged();
+
+        var result = await JSRuntime.InvokeAsync<ApiResponse>("apiForgotPassword", model.Email);
+
+        if (result.Status == 200)
+        {
+            Snackbar.Add("If your email is registered, a reset link has been sent.", Severity.Success);
+            await Task.Delay(500);
+            Navigation.NavigateTo("/account/login");
+        }
+        else
+        {
+            Snackbar.Add(result.Title ?? "Failed to send reset link", Severity.Error);
+        }
+
+        isProcessing = false;
+        StateHasChanged();
+    }
+
+    private class ApiResponse
+    {
+        public int Status { get; set; }
+        public string? Title { get; set; }
+    }
+}
+
+<script>
+    window.apiForgotPassword = async (email) => {
+        try {
+            const response = await fetch('/api/account/forgot-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email })
+            });
+
+            if (response.ok) {
+                return { status: 200, title: 'Success' };
+            } else {
+                const data = await response.json();
+                let msg = 'Error processing request';
+                if (data.errors && data.errors.length > 0) msg = data.errors[0];
+                return { status: response.status, title: msg };
+            }
+        } catch (error) {
+            return { status: 500, title: 'Network error' };
+        }
+    };
+</script>
@@ -0,0 +1,70 @@
+using Indotalent.Data.Entities;
+using MediatR;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.WebUtilities;
+using System.Text;
+
+namespace Indotalent.Features.Account.ForgotPassword.Cqrs;
+
+public class ForgotPasswordRequest
+{
+    public string Email { get; set; } = string.Empty;
+}
+
+public class ForgotPasswordResponse
+{
+    public string Message { get; set; } = string.Empty;
+}
+
+public record ForgotPasswordCommand(ForgotPasswordRequest Data) : IRequest<ForgotPasswordResponse>;
+
+public class ForgotPasswordHandler : IRequestHandler<ForgotPasswordCommand, ForgotPasswordResponse>
+{
+    private readonly UserManager<ApplicationUser> _userManager;
+    private readonly IEmailSender<ApplicationUser> _emailSender;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public ForgotPasswordHandler(
+        UserManager<ApplicationUser> userManager,
+        IEmailSender<ApplicationUser> emailSender,
+        IHttpContextAccessor httpContextAccessor)
+    {
+        _userManager = userManager;
+        _emailSender = emailSender;
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public async Task<ForgotPasswordResponse> Handle(ForgotPasswordCommand request, CancellationToken cancellationToken)
+    {
+        var user = await _userManager.FindByEmailAsync(request.Data.Email);
+
+        if (user == null || !(await _userManager.IsEmailConfirmedAsync(user)))
+        {
+            return new ForgotPasswordResponse { Message = "If your email is registered, you will receive a reset link." };
+        }
+
+        var code = await _userManager.GeneratePasswordResetTokenAsync(user);
+        code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
+
+        var requestHttp = _httpContextAccessor.HttpContext?.Request;
+        var scheme = requestHttp?.Scheme ?? "https";
+        var host = requestHttp?.Host.Value ?? "localhost:8080";
+
+        var callbackUrl = $"{scheme}://{host}/account/reset-password?userId={user.Id}&code={code}";
+
+        var message = $@"
+            <div style=""font-family: Arial, sans-serif;"">
+                <h3>Password Reset Request</h3>
+                <p>Hello, {user.FullName}!</p>
+                <p>We received a request to reset your password. Click the link below to proceed:</p>
+                <p><a href=""{callbackUrl}"" style=""color: #2196F3; font-weight: bold;"">Reset Password</a></p>
+                <br/>
+                <p style=""font-size: 0.8em; color: #666;"">If you didn't request this, you can safely ignore this email.</p>
+                <p style=""font-size: 0.8em; color: #666;"">{callbackUrl}</p>
+            </div>";
+
+        await _emailSender.SendPasswordResetLinkAsync(user, user.Email!, message);
+
+        return new ForgotPasswordResponse { Message = "Reset link has been sent." };
+    }
+}
@@ -0,0 +1,451 @@
+@page "/account/login"
+@layout AuthenticationLayout
+@using Indotalent.Shared.Consts
+@using Microsoft.JSInterop
+@using Indotalent.Infrastructure.Authentication.Identity
+@using Microsoft.Extensions.Options
+@inject IJSRuntime JSRuntime
+@inject IOptions<IdentitySettingsModel> IdentityOptions
+@inject NavigationManager Navigation
+@inject ISnackbar Snackbar
+
+<PageTitle>Sign In - @GlobalConsts.AppInitial</PageTitle>
+
+<style>
+    /* ===== PAGE HEADER ===== */
+    .page-header {
+        text-align: center;
+        margin-bottom: 2rem;
+    }
+
+    .page-header h2 {
+        font-size: 1.5rem;
+        font-weight: 700;
+        color: #1E293B;
+        margin: 0 0 0.25rem 0;
+    }
+
+    .page-header p {
+        font-size: 0.875rem;
+        color: #94A3B8;
+        margin: 0;
+    }
+
+    /* ===== FORM LABEL ===== */
+    .form-label {
+        display: block;
+        font-size: 0.8125rem;
+        font-weight: 600;
+        color: #475569;
+        margin-bottom: 0.375rem;
+    }
+
+    .form-label-row {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        margin-bottom: 0.375rem;
+    }
+
+    .form-label-row .form-label {
+        margin-bottom: 0;
+    }
+
+    .forgot-link {
+        font-size: 0.8125rem;
+        color: #8B5CF6;
+        font-weight: 500;
+        text-decoration: none;
+        cursor: pointer;
+        transition: color 0.2s;
+    }
+
+    .forgot-link:hover {
+        color: #7C3AED;
+        text-decoration: underline;
+    }
+
+    /* ===== REMEMBER ME ROW ===== */
+    .remember-row {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        margin-bottom: 0.75rem;
+    }
+
+    /* ===== SIGN IN BUTTON ===== */
+    .btn-signin {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.5rem;
+        padding: 0.75rem 1.75rem;
+        background: #8B5CF6;
+        color: #ffffff;
+        font-size: 0.875rem;
+        font-weight: 600;
+        border-radius: 0.5rem;
+        transition: all 0.2s;
+        cursor: pointer;
+        border: none;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+    }
+
+    .btn-signin:hover:not(:disabled) {
+        background: #7C3AED;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(139, 92, 246, 0.3);
+    }
+
+    .btn-signin:disabled {
+        opacity: 0.7;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+    }
+
+    /* ===== DIVIDER ===== */
+    .divider-or {
+        display: flex;
+        align-items: center;
+        gap: 1rem;
+        margin: 1.5rem 0;
+    }
+
+    .divider-or::before,
+    .divider-or::after {
+        content: '';
+        flex: 1;
+        height: 1px;
+        background: #E2E8F0;
+    }
+
+    .divider-or span {
+        font-size: 0.75rem;
+        color: #94A3B8;
+        font-weight: 500;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+    }
+
+    /* ===== GOOGLE BUTTON ===== */
+    .btn-google {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.5rem;
+        padding: 0.625rem 1rem;
+        background: transparent;
+        color: #1E293B;
+        font-size: 0.875rem;
+        font-weight: 500;
+        border-radius: 0.5rem;
+        border: 1.5px solid #E2E8F0;
+        transition: all 0.2s;
+        cursor: pointer;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+    }
+
+    .btn-google:hover:not(:disabled) {
+        border-color: #8B5CF6;
+        background: rgba(139, 92, 246, 0.03);
+    }
+
+    .btn-google:disabled {
+        opacity: 0.6;
+        cursor: not-allowed;
+    }
+
+    .btn-google svg {
+        width: 1.25rem;
+        height: 1.25rem;
+    }
+
+    /* ===== FOOTER LINK ===== */
+    .auth-link {
+        color: #8B5CF6;
+        font-size: 0.875rem;
+        font-weight: 600;
+        text-decoration: none;
+        cursor: pointer;
+        transition: color 0.2s;
+    }
+
+    .auth-link:hover {
+        color: #7C3AED;
+        text-decoration: underline;
+    }
+
+    .auth-footer {
+        margin-top: 1.5rem;
+        text-align: center;
+        font-size: 0.875rem;
+        color: #64748B;
+    }
+</style>
+
+<div class="page-header">
+    <h2>Sign In</h2>
+    <p>Enter your credentials to access your account</p>
+</div>
+
+<MudForm @ref="form"
+         @bind-IsValid="@success"
+         Validation="@(new Func<EditContext, Task<bool>>(ValidateForm))">
+
+    <div style="display: flex; flex-direction: column; gap: 1rem;">
+        <div>
+            <label class="form-label" for="email-field">Email Address</label>
+            <MudTextField T="string"
+                          @bind-Value="model.Email"
+                          Variant="Variant.Outlined"
+                          Placeholder="you@company.com"
+                          Margin="Margin.Dense"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Email"
+                          Required="true"
+                          For="@(() => model.Email)"
+                          id="email-field" />
+        </div>
+
+        <div>
+            <div class="form-label-row">
+                <label class="form-label" for="password-field">Password</label>
+                <a class="forgot-link" href="/account/forgot-password">Forgot password?</a>
+            </div>
+            <MudTextField T="string"
+                          @bind-Value="model.Password"
+                          Variant="Variant.Outlined"
+                          Placeholder="Enter your password"
+                          Margin="Margin.Dense"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Lock"
+                          InputType="@(showPassword ? InputType.Text : InputType.Password)"
+                          AdornmentEndIcon="@(showPassword ? Icons.Material.Filled.Visibility : Icons.Material.Filled.VisibilityOff)"
+                          OnAdornmentEndClick="() => showPassword = !showPassword"
+                          Required="true"
+                          For="@(() => model.Password)"
+                          id="password-field" />
+        </div>
+
+        <div class="remember-row">
+            <MudCheckBox T="bool"
+                         @bind-Value="rememberMe"
+                         Label="Remember me"
+                         Color="Color.Primary"
+                         Dense="true" />
+        </div>
+
+        <button class="btn-signin" type="button" disabled="@(!success || isProcessing)" @onclick="HandleLogin">
+            @if (isProcessing)
+            {
+                <svg class="spinner" style="width: 1rem; height: 1rem;" fill="none" viewBox="0 0 24 24">
+                    <circle style="opacity: 0.25;" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"/>
+                    <path style="opacity: 0.75;" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"/>
+                </svg>
+                <span>Signing in...</span>
+            }
+            else
+            {
+                <span>Sign In</span>
+                <svg style="width: 1rem; height: 1rem;" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M13 7l5 5m0 0l-5 5m5-5H6"/>
+                </svg>
+            }
+        </button>
+    </div>
+
+    @if (IdentityOptions.Value.SsoFirebase.IsUsed)
+    {
+        <div class="divider-or"><span>Or continue with</span></div>
+
+        <button class="btn-google" type="button" disabled="@isProcessing" @onclick="HandleFirebaseGoogleLogin">
+            <svg viewBox="0 0 24 24" fill="currentColor">
+                <path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 01-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z"/>
+                <path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
+                <path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/>
+                <path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/>
+            </svg>
+            Sign in with Google
+        </button>
+    }
+</MudForm>
+
+<div class="auth-footer">
+    Don't have an account?
+    <a class="auth-link" href="/account/register">Create one</a>
+</div>
+
+@code {
+    private MudForm form = default!;
+    private bool success;
+    private bool isProcessing;
+    private bool showPassword;
+    private bool rememberMe;
+    private LoginModel model = new();
+
+    private async Task<bool> ValidateForm(EditContext context) => await Task.FromResult(true);
+
+    private async Task HandleLogin()
+    {
+        await form.Validate();
+        if (!success) return;
+        isProcessing = true;
+        StateHasChanged();
+
+        var result = await JSRuntime.InvokeAsync<ApiJSRuntimeResponse>("apiAccountSignIn", model.Email, model.Password, rememberMe);
+        ProcessLoginResult(result);
+    }
+
+    private async Task HandleFirebaseGoogleLogin()
+    {
+        isProcessing = true;
+        StateHasChanged();
+
+        var firebaseUser = await JSRuntime.InvokeAsync<FirebaseUserResponse>("signInWithGoogle");
+
+        if (firebaseUser == null || string.IsNullOrEmpty(firebaseUser.Email))
+        {
+            Snackbar.Add("Google Sign-In failed or cancelled.", Severity.Error);
+            isProcessing = false;
+            return;
+        }
+
+        var checkResult = await JSRuntime.InvokeAsync<ActiveCheckResponse>("apiCheckActiveUser", firebaseUser.Email);
+        bool openForPublic = IdentityOptions.Value.SsoFirebase.OpenForPublic;
+
+        if (checkResult.Exists)
+        {
+            if (checkResult.IsActive)
+            {
+                await ExecuteSsoSignIn(firebaseUser.Email);
+            }
+            else
+            {
+                Snackbar.Add("Account is registered but not active.", Severity.Warning);
+                isProcessing = false;
+            }
+        }
+        else
+        {
+            var registerResult = await JSRuntime.InvokeAsync<ApiJSRuntimeResponse>(
+                "apiAccountSignUpSso",
+                firebaseUser.Email,
+                firebaseUser.Email,
+                openForPublic
+            );
+
+            if (registerResult.Status == 200)
+            {
+                if (openForPublic)
+                {
+                    await ExecuteSsoSignIn(firebaseUser.Email);
+                }
+                else
+                {
+                    Snackbar.Add("Registration successful. Please wait for admin approval.", Severity.Info);
+                    isProcessing = false;
+                }
+            }
+            else
+            {
+                Snackbar.Add("Failed to auto-register account.", Severity.Error);
+                isProcessing = false;
+            }
+        }
+    }
+
+    private async Task ExecuteSsoSignIn(string email)
+    {
+        var result = await JSRuntime.InvokeAsync<ApiJSRuntimeResponse>("apiAccountSsoSignIn", email);
+        ProcessLoginResult(result);
+    }
+
+    private void ProcessLoginResult(ApiJSRuntimeResponse result)
+    {
+        if (result.Status == 200)
+        {
+            Snackbar.Add(result.Title ?? "Login successful!", Severity.Success);
+            Task.Run(async () =>
+            {
+                await Task.Delay(500);
+                Navigation.NavigateTo("/home", forceLoad: true);
+            });
+        }
+        else
+        {
+            Snackbar.Add(result.Title ?? "Sign in failed.", Severity.Error);
+            isProcessing = false;
+        }
+        StateHasChanged();
+    }
+
+    private class ApiJSRuntimeResponse { public int? Status { get; set; } public string? Title { get; set; } public string? Message { get; set; } }
+    private class FirebaseUserResponse { public string? Email { get; set; } }
+    private class ActiveCheckResponse { public bool Exists { get; set; } public bool IsActive { get; set; } }
+    private class LoginModel { public string Email { get; set; } = ""; public string Password { get; set; } = ""; }
+}
+
+<script>
+    window.apiAccountSignIn = async (email, password, rememberMe) => {
+        try {
+            const response = await fetch('/api/account/signin', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email, password, rememberMe }),
+                credentials: 'include'
+            });
+            const result = await response.json();
+            return { status: response.status, title: result.title };
+        } catch (error) {
+            return { status: 500, title: 'Network error' };
+        }
+    };
+
+    window.apiCheckActiveUser = async (email) => {
+        try {
+            const response = await fetch(`/api/account/active-user-exists?email=${encodeURIComponent(email)}`);
+            return await response.json();
+        } catch (error) {
+            return { exists: false, isActive: false };
+        }
+    };
+
+    window.apiAccountSignUpSso = async (email, fullName, isOpenForPublic) => {
+        try {
+            const response = await fetch('/api/account/signup', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: email,
+                    fullName: fullName,
+                    password: 'SSO_AUTO_GENERATED_PASSWORD_123!',
+                    isActive: isOpenForPublic,
+                    emailConfirmed: isOpenForPublic
+                })
+            });
+            const result = await response.json();
+            return { status: response.status, message: result.message };
+        } catch (error) {
+            return { status: 500 };
+        }
+    };
+
+    window.apiAccountSsoSignIn = async (email) => {
+        try {
+            const response = await fetch(`/api/account/signin-sso?email=${encodeURIComponent(email)}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include'
+            });
+            const result = await response.json();
+            return { status: response.status, title: result.title };
+        } catch (error) {
+            return { status: 500, title: 'SSO Network error' };
+        }
+    };
+</script>
@@ -0,0 +1,74 @@
+using Indotalent.ConfigFrontEnd.Service;
+using Indotalent.Data.Entities;
+using Indotalent.Infrastructure.Authentication.Identity;
+using MediatR;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Extensions.Options;
+
+namespace Indotalent.Features.Account.Login.Cqrs;
+
+public class LoginRequest
+{
+    public string Email { get; set; } = string.Empty;
+    public string Password { get; set; } = string.Empty;
+    public bool RememberMe { get; set; }
+}
+
+public class LoginResponse
+{
+    public bool Succeeded { get; set; }
+    public string Message { get; set; } = string.Empty;
+    public bool IsNotAllowed { get; set; }
+    public string? Token { get; set; }
+    public string? RefreshToken { get; set; }
+}
+
+public record LoginCommand(LoginRequest Data) : IRequest<LoginResponse>;
+
+public class LoginHandler : IRequestHandler<LoginCommand, LoginResponse>
+{
+    private readonly SignInManager<ApplicationUser> _signInManager;
+    private readonly UserManager<ApplicationUser> _userManager;
+    private readonly JwtSettingsModel _jwtSettings;
+
+    public LoginHandler(
+        SignInManager<ApplicationUser> signInManager,
+        UserManager<ApplicationUser> userManager,
+        IOptions<JwtSettingsModel> jwtSettings)
+    {
+        _signInManager = signInManager;
+        _userManager = userManager;
+        _jwtSettings = jwtSettings.Value;
+    }
+
+    public async Task<LoginResponse> Handle(LoginCommand request, CancellationToken cancellationToken)
+    {
+        var user = await _userManager.FindByEmailAsync(request.Data.Email);
+        if (user == null) return new LoginResponse { Succeeded = false, Message = "Invalid credentials" };
+
+        var result = await _signInManager.PasswordSignInAsync(user, request.Data.Password, request.Data.RememberMe, false);
+
+        if (result.Succeeded)
+        {
+            var token = JwtService.GenerateNewJwt(user, _jwtSettings);
+
+            var refreshToken = Guid.NewGuid().ToString().Replace("-", "");
+
+            user.RefreshToken = refreshToken;
+            user.LastLoginAt = DateTime.Now;
+            await _userManager.UpdateAsync(user);
+
+            return new LoginResponse
+            {
+                Succeeded = true,
+                Message = "Login successful",
+                Token = token,
+                RefreshToken = refreshToken
+            };
+        }
+
+        return new LoginResponse { Succeeded = false, Message = "Invalid credentials" };
+    }
+
+
+}
@@ -0,0 +1,212 @@
+@page "/account/logout"
+@layout AuthenticationLayout
+
+@using Indotalent.Shared.Consts
+@using Microsoft.JSInterop
+@inject IJSRuntime JSRuntime
+@inject NavigationManager Navigation
+@inject ISnackbar Snackbar
+
+<PageTitle>Sign Out - @GlobalConsts.AppInitial</PageTitle>
+
+<style>
+    /* ===== LOGOUT CONTAINER ===== */
+    .logout-container {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        text-align: center;
+    }
+
+    .logout-icon-wrapper {
+        display: flex;
+        justify-content: center;
+        margin-bottom: 1.5rem;
+    }
+
+    .logout-icon-circle {
+        width: 4.5rem;
+        height: 4.5rem;
+        border-radius: 50%;
+        background: rgba(139, 92, 246, 0.1);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+    }
+
+    .logout-icon-circle svg {
+        width: 2.25rem;
+        height: 2.25rem;
+        color: #8B5CF6;
+    }
+
+    .logout-title {
+        font-size: 1.5rem;
+        font-weight: 700;
+        color: #1E293B;
+        margin: 0 0 0.25rem 0;
+    }
+
+    .logout-desc {
+        font-size: 0.875rem;
+        color: #64748B;
+        margin: 0 0 2rem 0;
+    }
+
+    /* ===== BUTTONS ===== */
+    .btn-signout {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.5rem;
+        padding: 0.75rem 1.75rem;
+        background: #8B5CF6;
+        color: #ffffff;
+        font-size: 0.875rem;
+        font-weight: 600;
+        border-radius: 0.5rem;
+        transition: all 0.2s;
+        cursor: pointer;
+        border: none;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+    }
+
+    .btn-signout:hover:not(:disabled) {
+        background: #7C3AED;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(139, 92, 246, 0.3);
+    }
+
+    .btn-signout:disabled {
+        opacity: 0.7;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+    }
+
+    .btn-cancel {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        padding: 0.75rem 1.75rem;
+        background: transparent;
+        color: #94A3B8;
+        font-size: 0.875rem;
+        font-weight: 600;
+        border-radius: 0.5rem;
+        transition: all 0.2s;
+        cursor: pointer;
+        border: none;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+        margin-top: 0.75rem;
+        text-decoration: none;
+    }
+
+    .btn-cancel:hover:not(:disabled) {
+        color: #64748B;
+        background: rgba(148, 163, 184, 0.08);
+    }
+
+    .btn-cancel:disabled {
+        opacity: 0.5;
+        cursor: not-allowed;
+    }
+
+    /* ===== SPINNER ANIMATION ===== */
+    @@keyframes spin {
+        to { transform: rotate(360deg); }
+    }
+
+    .spinner {
+        animation: spin 1s linear infinite;
+    }
+</style>
+
+<div class="logout-container">
+    <div class="logout-icon-wrapper">
+        <div class="logout-icon-circle">
+            <svg fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M15.75 9V5.25A2.25 2.25 0 0013.5 3h-6a2.25 2.25 0 00-2.25 2.25v13.5A2.25 2.25 0 007.5 21h6a2.25 2.25 0 002.25-2.25V15m3 0l3-3m0 0l-3-3m3 3H9"/>
+            </svg>
+        </div>
+    </div>
+
+    <h2 class="logout-title">Sign Out</h2>
+    <p class="logout-desc">Are you sure you want to sign out of your account?</p>
+
+    <button class="btn-signout" type="button" disabled="@isLoggingOut" @onclick="Logout">
+        @if (isLoggingOut)
+        {
+            <svg class="spinner" style="width: 1rem; height: 1rem;" fill="none" viewBox="0 0 24 24">
+                <circle style="opacity: 0.25;" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"/>
+                <path style="opacity: 0.75;" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"/>
+            </svg>
+            <span>Processing...</span>
+        }
+        else
+        {
+            <span>Sign Out</span>
+        }
+    </button>
+
+    <a class="btn-cancel" href="/">
+        Cancel
+    </a>
+</div>
+
+@code {
+    private bool isLoggingOut;
+
+    private async Task Logout()
+    {
+        isLoggingOut = true;
+        StateHasChanged();
+
+        var result = await JSRuntime.InvokeAsync<ApiJSRuntimeResponse>("apiAccountLogout");
+
+        if (result.Status == 200)
+        {
+            Snackbar.Add("Successfully signed out!", Severity.Success);
+            await Task.Delay(500);
+            Navigation.NavigateTo("/", forceLoad: true);
+        }
+        else
+        {
+            Snackbar.Add(result.Title ?? "Failed to logout.", Severity.Error);
+            await Task.Delay(500);
+        }
+
+        isLoggingOut = false;
+        StateHasChanged();
+    }
+
+    private class ApiJSRuntimeResponse
+    {
+        public int? Status { get; set; }
+        public string? Title { get; set; }
+    }
+}
+
+<script>
+    window.apiAccountLogout = async () => {
+        try {
+            const response = await fetch('/api/account/signout', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                credentials: 'include'
+            });
+            if (!response.ok) {
+                throw new Error('Unknown error occurred');
+            }
+            return { status: 200, title: 'Success user logout' };
+        } catch (error) {
+            return { status: 500, title: 'Server / Network error' };
+        }
+    };
+</script>
@@ -0,0 +1,280 @@
+@page "/account/register"
+@layout AuthenticationLayout
+
+@using Indotalent.Shared.Consts
+@using Microsoft.JSInterop
+@inject IJSRuntime JSRuntime
+@inject ISnackbar Snackbar
+@inject NavigationManager Navigation
+@inject IConfiguration Configuration
+
+<PageTitle>Sign Up - @GlobalConsts.AppInitial</PageTitle>
+
+<style>
+    /* ===== PAGE HEADER ===== */
+    .page-header {
+        text-align: center;
+        margin-bottom: 2rem;
+    }
+
+    .page-header h2 {
+        font-size: 1.5rem;
+        font-weight: 700;
+        color: #1E293B;
+        margin: 0 0 0.25rem 0;
+    }
+
+    .page-header p {
+        font-size: 0.875rem;
+        color: #94A3B8;
+        margin: 0;
+    }
+
+    /* ===== FORM LABEL ===== */
+    .form-label {
+        display: block;
+        font-size: 0.8125rem;
+        font-weight: 600;
+        color: #475569;
+        margin-bottom: 0.375rem;
+    }
+
+    /* ===== SUBMIT BUTTON ===== */
+    .btn-submit {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.5rem;
+        padding: 0.75rem 1.75rem;
+        background: #8B5CF6;
+        color: #ffffff;
+        font-size: 0.875rem;
+        font-weight: 600;
+        border-radius: 0.5rem;
+        transition: all 0.2s;
+        cursor: pointer;
+        border: none;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+    }
+
+    .btn-submit:hover:not(:disabled) {
+        background: #7C3AED;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(139, 92, 246, 0.3);
+    }
+
+    .btn-submit:disabled {
+        opacity: 0.7;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+    }
+
+    /* ===== SPINNER ANIMATION ===== */
+    @@keyframes spin {
+        to { transform: rotate(360deg); }
+    }
+
+    .spinner {
+        animation: spin 1s linear infinite;
+    }
+
+    /* ===== FOOTER ===== */
+    .auth-link {
+        color: #8B5CF6;
+        font-size: 0.875rem;
+        font-weight: 600;
+        text-decoration: none;
+        cursor: pointer;
+        transition: color 0.2s;
+    }
+
+    .auth-link:hover {
+        color: #7C3AED;
+        text-decoration: underline;
+    }
+
+    .auth-footer {
+        margin-top: 1.5rem;
+        text-align: center;
+        font-size: 0.875rem;
+        color: #64748B;
+    }
+</style>
+
+<div class="page-header">
+    <h2>Sign Up</h2>
+    <p>Please register your account</p>
+</div>
+
+<MudForm @ref="form" @bind-IsValid="@success" Validation="@(new Func<EditContext, Task<bool>>(ValidateForm))">
+
+    <div style="display: flex; flex-direction: column; gap: 1rem;">
+        <div>
+            <label class="form-label" for="fullname-field">Full Name</label>
+            <MudTextField T="string"
+                          @bind-Value="model.FullName"
+                          Variant="Variant.Outlined"
+                          Placeholder="Enter your full name"
+                          Margin="Margin.Dense"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Person"
+                          Required="true"
+                          For="@(() => model.FullName)"
+                          id="fullname-field" />
+        </div>
+
+        <div>
+            <label class="form-label" for="email-field">Email Address</label>
+            <MudTextField T="string"
+                          @bind-Value="model.Email"
+                          Variant="Variant.Outlined"
+                          Placeholder="Enter your email"
+                          Margin="Margin.Dense"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Email"
+                          Required="true"
+                          For="@(() => model.Email)"
+                          id="email-field" />
+        </div>
+
+        <div>
+            <label class="form-label" for="password-field">Password</label>
+            <MudTextField T="string"
+                          @bind-Value="model.Password"
+                          Variant="Variant.Outlined"
+                          Placeholder="Create a password"
+                          Margin="Margin.Dense"
+                          InputType="@(showPassword ? InputType.Text : InputType.Password)"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Lock"
+                          AdornmentEndIcon="@(showPassword ? Icons.Material.Filled.Visibility : Icons.Material.Filled.VisibilityOff)"
+                          OnAdornmentEndClick="() => showPassword = !showPassword"
+                          Required="true"
+                          For="@(() => model.Password)"
+                          id="password-field" />
+        </div>
+
+        <button class="btn-submit" type="button" disabled="@(!success || isProcessing)" @onclick="HandleRegister">
+            @if (isProcessing)
+            {
+                <svg class="spinner" style="width: 1rem; height: 1rem;" fill="none" viewBox="0 0 24 24">
+                    <circle style="opacity: 0.25;" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"/>
+                    <path style="opacity: 0.75;" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"/>
+                </svg>
+                <span>Processing...</span>
+            }
+            else
+            {
+                <span>Create Account</span>
+            }
+        </button>
+    </div>
+</MudForm>
+
+<div class="auth-footer">
+    Already have an account?
+    <a class="auth-link" href="/account/login">Sign In</a>
+</div>
+
+@code {
+    private MudForm form = default!;
+    private bool success;
+    private bool isProcessing;
+    private bool showPassword;
+
+    private RegisterModel model = new();
+
+    private class RegisterModel
+    {
+        public string FullName { get; set; } = "";
+        public string Email { get; set; } = "";
+        public string Password { get; set; } = "";
+    }
+
+    private async Task<bool> ValidateForm(EditContext context)
+    {
+        return await Task.FromResult(true);
+    }
+
+    private async Task HandleRegister()
+    {
+        await form.Validate();
+
+        if (!success) return;
+
+        isProcessing = true;
+        StateHasChanged();
+
+        var result = await JSRuntime.InvokeAsync<ApiJSRuntimeResponse>("apiAccountRegister", model.FullName, model.Email, model.Password);
+
+        if (result.Status == 200)
+        {
+            var requireConfirmation = Configuration.GetValue<bool>("IdentitySettings:SignIn:RequireConfirmedAccount");
+
+            if (requireConfirmation)
+            {
+                Snackbar.Add("Registration successful! Please check your email to confirm your account.", Severity.Info);
+            }
+            else
+            {
+                Snackbar.Add("Registration successful! You can now sign in.", Severity.Success);
+            }
+
+            await Task.Delay(500);
+            Navigation.NavigateTo("/account/login");
+        }
+        else
+        {
+            Snackbar.Add(result.Title ?? "Registration failed", Severity.Error);
+        }
+
+        isProcessing = false;
+        StateHasChanged();
+    }
+
+    private class ApiJSRuntimeResponse
+    {
+        public int? Status { get; set; }
+        public string? Title { get; set; }
+    }
+}
+
+<script>
+    window.apiAccountRegister = async (fullName, email, password) => {
+        try {
+            const response = await fetch('/api/account/signup', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({ fullName, email, password })
+            });
+
+            const data = await response.json();
+
+            if (response.ok) {
+                return { status: 200, title: 'Success account registration' };
+            } else {
+                let errorMessage = data.title || data.message || 'Registration failed';
+
+                if (data.errors) {
+                    if (Array.isArray(data.errors) && data.errors.length > 0) {
+                        errorMessage = data.errors[0];
+                    } else if (typeof data.errors === 'object') {
+                        const firstKey = Object.keys(data.errors)[0];
+                        if (firstKey) {
+                            errorMessage = data.errors[firstKey][0];
+                        }
+                    }
+                }
+
+                return { status: response.status, title: errorMessage };
+            }
+        } catch (error) {
+            return { status: 500, title: 'Server / Network error' };
+        }
+    };
+</script>
@@ -0,0 +1,106 @@
+using Indotalent.Data.Entities;
+using Indotalent.Infrastructure.Authorization.Identity;
+using MediatR;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.WebUtilities;
+using System.Text;
+
+namespace Indotalent.Features.Account.Register.Cqrs;
+
+public class CreateUserRequest
+{
+    public string FullName { get; set; } = string.Empty;
+    public string Email { get; set; } = string.Empty;
+    public string Password { get; set; } = string.Empty;
+    public bool IsActive { get; set; } = true;
+    public bool EmailConfirmed { get; set; } = false;
+}
+
+public class CreateUserResponse
+{
+    public string? Id { get; set; }
+    public string? Email { get; set; }
+}
+
+public record CreateUserCommand(CreateUserRequest Data) : IRequest<CreateUserResponse>;
+
+public class RegisterHandler : IRequestHandler<CreateUserCommand, CreateUserResponse>
+{
+    private readonly UserManager<ApplicationUser> _userManager;
+    private readonly IEmailSender<ApplicationUser> _emailSender;
+    private readonly IConfiguration _configuration;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public RegisterHandler(
+        UserManager<ApplicationUser> userManager,
+        IEmailSender<ApplicationUser> emailSender,
+        IConfiguration configuration,
+        IHttpContextAccessor httpContextAccessor)
+    {
+        _userManager = userManager;
+        _emailSender = emailSender;
+        _configuration = configuration;
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public async Task<CreateUserResponse> Handle(CreateUserCommand request, CancellationToken cancellationToken)
+    {
+        var user = new ApplicationUser
+        {
+            UserName = request.Data.Email,
+            Email = request.Data.Email,
+            FullName = request.Data.FullName,
+            IsActive = request.Data.IsActive,
+            EmailConfirmed = request.Data.EmailConfirmed,
+        };
+
+        var result = await _userManager.CreateAsync(user, request.Data.Password);
+
+        if (!result.Succeeded)
+        {
+            var errors = result.Errors.Select(x => x.Description).ToList();
+            throw new Exception(string.Join(", ", errors));
+        }
+
+        var rolesToAdd = ApplicationRoles.AllRoles
+            .Where(role => role != ApplicationRoles.Admin)
+            .ToList();
+
+        if (rolesToAdd.Any())
+        {
+            await _userManager.AddToRolesAsync(user, rolesToAdd);
+        }
+
+        var requireConfirmation = _configuration.GetValue<bool>("IdentitySettings:SignIn:RequireConfirmedAccount");
+
+        if (requireConfirmation)
+        {
+            var code = await _userManager.GenerateEmailConfirmationTokenAsync(user);
+            code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
+
+            var requestHttp = _httpContextAccessor.HttpContext?.Request;
+            var scheme = requestHttp?.Scheme ?? "https";
+            var host = requestHttp?.Host.Value ?? "localhost:8080";
+
+            var callbackUrl = $"{scheme}://{host}/account/confirm-email?userId={user.Id}&code={code}";
+
+            var message = $@"
+                <div style=""font-family: Arial, sans-serif;"">
+                    <h3>Welcome, {user.FullName}!</h3>
+                    <p>Please confirm your account by clicking the link below:</p>
+                    <p><a href=""{callbackUrl}"" style=""color: #2196F3; font-weight: bold; text-decoration: underline;"">Confirm Account</a></p>
+                    <br/>
+                    <p style=""font-size: 0.8em; color: #666;"">If the link doesn't work, copy and paste this URL into your browser:</p>
+                    <p style=""font-size: 0.8em; color: #666;"">{callbackUrl}</p>
+                </div>";
+
+            await _emailSender.SendConfirmationLinkAsync(user, user.Email!, message);
+        }
+
+        return new CreateUserResponse
+        {
+            Id = user.Id,
+            Email = user.Email
+        };
+    }
+}
@@ -0,0 +1,221 @@
+@page "/account/reset-password"
+@layout AuthenticationLayout
+@using Indotalent.Shared.Consts
+@using Microsoft.JSInterop
+@inject IJSRuntime JSRuntime
+@inject ISnackbar Snackbar
+@inject NavigationManager Navigation
+
+<PageTitle>Reset Password - @GlobalConsts.AppInitial</PageTitle>
+
+<style>
+    /* ===== PAGE HEADER ===== */
+    .page-header {
+        text-align: center;
+        margin-bottom: 2rem;
+    }
+
+    .page-header h2 {
+        font-size: 1.5rem;
+        font-weight: 700;
+        color: #1E293B;
+        margin: 0 0 0.25rem 0;
+    }
+
+    .page-header p {
+        font-size: 0.875rem;
+        color: #94A3B8;
+        margin: 0;
+        line-height: 1.5;
+    }
+
+    /* ===== FORM LABEL ===== */
+    .form-label {
+        display: block;
+        font-size: 0.8125rem;
+        font-weight: 600;
+        color: #475569;
+        margin-bottom: 0.375rem;
+    }
+
+    /* ===== SUBMIT BUTTON ===== */
+    .btn-submit {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 0.5rem;
+        padding: 0.75rem 1.75rem;
+        background: #8B5CF6;
+        color: #ffffff;
+        font-size: 0.875rem;
+        font-weight: 600;
+        border-radius: 0.5rem;
+        transition: all 0.2s;
+        cursor: pointer;
+        border: none;
+        width: 100%;
+        font-family: "Poppins", sans-serif;
+        height: 48px;
+    }
+
+    .btn-submit:hover:not(:disabled) {
+        background: #7C3AED;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(139, 92, 246, 0.3);
+    }
+
+    .btn-submit:disabled {
+        opacity: 0.7;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+    }
+
+    /* ===== SPINNER ANIMATION ===== */
+    @@keyframes spin {
+        to { transform: rotate(360deg); }
+    }
+
+    .spinner {
+        animation: spin 1s linear infinite;
+    }
+</style>
+
+<div class="page-header">
+    <h2>Create New Password</h2>
+    <p>Please enter your new password below.</p>
+</div>
+
+<MudForm @ref="form" @bind-IsValid="@success">
+
+    <div style="display: flex; flex-direction: column; gap: 1rem;">
+        <div>
+            <label class="form-label" for="new-password-field">New Password</label>
+            <MudTextField T="string"
+                          @bind-Value="model.NewPassword"
+                          Variant="Variant.Outlined"
+                          Placeholder="Enter new password"
+                          Margin="Margin.Dense"
+                          InputType="@(showPassword ? InputType.Text : InputType.Password)"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Lock"
+                          AdornmentEndIcon="@(showPassword ? Icons.Material.Filled.Visibility : Icons.Material.Filled.VisibilityOff)"
+                          OnAdornmentEndClick="() => showPassword = !showPassword"
+                          Required="true"
+                          id="new-password-field" />
+        </div>
+
+        <div>
+            <label class="form-label" for="confirm-password-field">Confirm New Password</label>
+            <MudTextField T="string"
+                          @bind-Value="model.ConfirmPassword"
+                          Variant="Variant.Outlined"
+                          Placeholder="Repeat new password"
+                          Margin="Margin.Dense"
+                          InputType="@(showPassword ? InputType.Text : InputType.Password)"
+                          Adornment="Adornment.Start"
+                          AdornmentIcon="@Icons.Material.Filled.Lock"
+                          Required="true"
+                          Validation="@(new Func<string, string?>(PasswordMatch))"
+                          id="confirm-password-field" />
+        </div>
+
+        <button class="btn-submit" type="button" disabled="@(!success || isProcessing)" @onclick="HandleResetPassword">
+            @if (isProcessing)
+            {
+                <svg class="spinner" style="width: 1rem; height: 1rem;" fill="none" viewBox="0 0 24 24">
+                    <circle style="opacity: 0.25;" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"/>
+                    <path style="opacity: 0.75;" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"/>
+                </svg>
+                <span>Resetting...</span>
+            }
+            else
+            {
+                <span>Reset Password</span>
+            }
+        </button>
+    </div>
+</MudForm>
+
+@code {
+    [SupplyParameterFromQuery] public string? userId { get; set; }
+    [SupplyParameterFromQuery] public string? code { get; set; }
+
+    private MudForm form = default!;
+    private bool success;
+    private bool isProcessing;
+    private bool showPassword;
+    private ResetModel model = new();
+
+    private class ResetModel
+    {
+        public string NewPassword { get; set; } = "";
+        public string ConfirmPassword { get; set; } = "";
+    }
+
+    private string? PasswordMatch(string arg)
+    {
+        if (model.NewPassword != arg) return "Passwords do not match";
+        return null;
+    }
+
+    private async Task HandleResetPassword()
+    {
+        await form.Validate();
+        if (!success) return;
+
+        if (string.IsNullOrEmpty(userId) || string.IsNullOrEmpty(code))
+        {
+            Snackbar.Add("Invalid reset token or user ID.", Severity.Error);
+            return;
+        }
+
+        isProcessing = true;
+        StateHasChanged();
+
+        var result = await JSRuntime.InvokeAsync<ApiResponse>("apiResetPassword", userId, code, model.NewPassword);
+
+        if (result.Status == 200)
+        {
+            Snackbar.Add("Password reset successful! You can now sign in.", Severity.Success);
+            await Task.Delay(500);
+            Navigation.NavigateTo("/account/login");
+        }
+        else
+        {
+            Snackbar.Add(result.Title ?? "Failed to reset password", Severity.Error);
+        }
+
+        isProcessing = false;
+        StateHasChanged();
+    }
+
+    private class ApiResponse
+    {
+        public int Status { get; set; }
+        public string? Title { get; set; }
+    }
+}
+
+<script>
+    window.apiResetPassword = async (userId, code, newPassword) => {
+        try {
+            const response = await fetch('/api/account/reset-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ userId, code, newPassword })
+            });
+
+            if (response.ok) {
+                return { status: 200, title: 'Success' };
+            } else {
+                const data = await response.json();
+                let msg = 'Failed to reset password';
+                if (data.errors && data.errors.length > 0) msg = data.errors[0];
+                return { status: response.status, title: msg };
+            }
+        } catch (error) {
+            return { status: 500, title: 'Network error' };
+        }
+    };
+</script>
@@ -0,0 +1,51 @@
+using Indotalent.Data.Entities;
+using MediatR;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.WebUtilities;
+using System.Text;
+
+namespace Indotalent.Features.Account.ResetPassword.Cqrs;
+
+public class ResetPasswordRequest
+{
+    public string UserId { get; set; } = string.Empty;
+    public string Code { get; set; } = string.Empty;
+    public string NewPassword { get; set; } = string.Empty;
+}
+
+public class ResetPasswordResponse
+{
+    public string Message { get; set; } = string.Empty;
+}
+
+public record ResetPasswordCommand(ResetPasswordRequest Data) : IRequest<ResetPasswordResponse>;
+
+public class ResetPasswordHandler : IRequestHandler<ResetPasswordCommand, ResetPasswordResponse>
+{
+    private readonly UserManager<ApplicationUser> _userManager;
+
+    public ResetPasswordHandler(UserManager<ApplicationUser> userManager)
+    {
+        _userManager = userManager;
+    }
+
+    public async Task<ResetPasswordResponse> Handle(ResetPasswordCommand request, CancellationToken cancellationToken)
+    {
+        var user = await _userManager.FindByIdAsync(request.Data.UserId);
+        if (user == null)
+        {
+            throw new Exception("User not found.");
+        }
+
+        var decodedCode = Encoding.UTF8.GetString(WebEncoders.Base64UrlDecode(request.Data.Code));
+        var result = await _userManager.ResetPasswordAsync(user, decodedCode, request.Data.NewPassword);
+
+        if (!result.Succeeded)
+        {
+            var errors = result.Errors.Select(x => x.Description).ToList();
+            throw new Exception(string.Join(", ", errors));
+        }
+
+        return new ResetPasswordResponse { Message = "Password has been reset successfully." };
+    }
+}
@@ -0,0 +1,7 @@
+@using MudBlazor
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Web
+@using System.ComponentModel.DataAnnotations
+
+@inject NavigationManager Navigation
+@inject ISnackbar Snackbar