{
  "version": "2.2.0",
  "name": "Password Reset Workflow",
  "description": "Initiate password reset via email with secure token",
  "trigger": {
    "type": "http",
    "method": "POST",
    "path": "/auth/forgot-password"
  },
  "nodes": [
    {
      "id": "apply_rate_limit",
      "type": "operation",
      "op": "rate_limit",
      "key": "{{ $json.email }}",
      "limit": 3,
      "window": 3600000
    },
    {
      "id": "validate_email",
      "type": "operation",
      "op": "validate",
      "input": "{{ $json }}",
      "rules": {
        "email": "required|email"
      }
    },
    {
      "id": "fetch_user",
      "type": "operation",
      "op": "database_read",
      "entity": "User",
      "params": {
        "filter": {
          "email": "{{ $json.email }}"
        }
      }
    },
    {
      "id": "check_user_exists",
      "type": "operation",
      "op": "condition",
      "condition": "{{ $steps.fetch_user.output !== null }}"
    },
    {
      "id": "generate_reset_token",
      "type": "operation",
      "op": "crypto",
      "operation": "generate_random_token",
      "length": 32
    },
    {
      "id": "hash_reset_token",
      "type": "operation",
      "op": "crypto",
      "operation": "sha256",
      "input": "{{ $steps.generate_reset_token.output }}"
    },
    {
      "id": "create_reset_request",
      "type": "operation",
      "op": "database_create",
      "entity": "PasswordResetToken",
      "data": {
        "userId": "{{ $steps.fetch_user.output.id }}",
        "token": "{{ $steps.hash_reset_token.output }}",
        "expiresAt": "{{ new Date(Date.now() + 60 * 60 * 1000).toISOString() }}"
      }
    },
    {
      "id": "send_reset_email",
      "type": "operation",
      "op": "email_send",
      "to": "{{ $json.email }}",
      "subject": "Reset your password",
      "template": "password_reset",
      "data": {
        "displayName": "{{ $steps.fetch_user.output.displayName }}",
        "resetLink": "{{ $env.APP_URL }}/auth/reset-password/{{ $steps.generate_reset_token.output }}",
        "expiresIn": "1 hour"
      }
    },
    {
      "id": "emit_event",
      "type": "action",
      "action": "emit_event",
      "event": "password_reset_requested",
      "channel": "{{ 'user:' + $steps.fetch_user.output.id }}",
      "data": {
        "email": "{{ $json.email }}"
      }
    },
    {
      "id": "return_success",
      "type": "action",
      "action": "http_response",
      "status": 200,
      "body": {
        "message": "If an account exists with that email, a password reset link has been sent."
      }
    }
  ]
}