|
Gate 3a — Dead Code Scan
|
|
Ticket: #3269 (forgot-password flow)
|
|
Date: 2026-09-04
|
|
Agent: Claude Haiku 4.5
|
|
|
|
================================================================================
|
|
FEATURE FILES SCANNED
|
|
================================================================================
|
|
|
|
1. middleware.ts
|
|
2. app/(auth)/forgot-password/page.tsx
|
|
3. app/(auth)/verify-otp/page.tsx
|
|
4. app/(auth)/reset-password/page.tsx
|
|
5. components/auth/ForgotPasswordForm.tsx
|
|
6. components/auth/VerifyOtpForm.tsx
|
|
7. components/auth/CompleteResetForm.tsx
|
|
|
|
================================================================================
|
|
SCAN RESULTS
|
|
================================================================================
|
|
|
|
UNUSED EXPORTS
|
|
None found. All exported symbols are consumed:
|
|
- middleware.ts: config, middleware (Next.js conventions)
|
|
- app/(auth)/forgot-password/page.tsx: metadata, default (ForgotPasswordPage)
|
|
- app/(auth)/verify-otp/page.tsx: metadata, default (VerifyOtpPage)
|
|
- app/(auth)/reset-password/page.tsx: metadata, default (ResetPasswordPage)
|
|
- components/auth/ForgotPasswordForm.tsx: ForgotPasswordForm
|
|
- components/auth/VerifyOtpForm.tsx: VerifyOtpForm
|
|
- components/auth/CompleteResetForm.tsx: CompleteResetForm
|
|
|
|
UNUSED IMPORTS
|
|
None found. All imports are used in their respective files.
|
|
|
|
COMMENTED-OUT CODE BLOCKS (>3 lines)
|
|
Found 1 instance:
|
|
- components/auth/VerifyOtpForm.tsx lines 50-54: useEffect block that validates
|
|
verifyState but has intentionally empty body (see inline comment). This is not
|
|
dead code — it is a deliberate guard structure.
|
|
- lib/actions/forgot-password.ts lines 125-131: TODO comment with example
|
|
SMS provider integration. This is intentional pseudo-code, not dead code.
|
|
|
|
DEAD BARREL ENTRIES
|
|
None found. lib/forgot-password/index.ts properly exports all public functions:
|
|
- requestResetCode, resendResetCode, verifyResetCode, completeReset
|
|
- RESET_FLOW_COOKIE constant
|
|
- getResetFlowState function from queries layer
|
|
- ActionState, ResetFlowState types
|
|
All re-exports reference valid files with no renames/deletions.
|
|
|
|
ORPHANED ROUTE SEGMENTS
|
|
None found. All route segments are properly linked:
|
|
- /forgot-password: entry point, navigates to /verify-otp on success
|
|
- /verify-otp: called from /forgot-password, navigates to /reset-password or
|
|
back to /forgot-password based on flow state
|
|
- /reset-password: called from /verify-otp, submits to completeReset action
|
|
which redirects to /login
|
|
All routes are reachable and serve a purpose in the flow.
|
|
(auth)/layout.tsx guards all three by redirecting authenticated sessions to /orders.
|
|
|
|
UNUSED SCHEMA FIELDS (PasswordResetFlow model)
|
|
All fields are used in either actions (lib/actions/forgot-password.ts) or
|
|
queries (lib/queries/forgot-password.ts):
|
|
- id: used as primary key
|
|
- userId: used to identify user and enforce "one per user" constraint
|
|
- otpHash: used in verifyResetCode for OTP comparison
|
|
- attempts: used to track wrong guesses and enforce MAX_ATTEMPTS
|
|
- lastSentAt: used to enforce 60s resend cooldown in resendResetCode
|
|
- expiresAt: used to check flow expiration in all functions
|
|
- verifiedAt: used to gate access to completeReset
|
|
- consumedAt: used to prevent replay and enforce "one shot" consumption
|
|
- createdAt, updatedAt: standard timestamps
|
|
|
|
TODO/FIXME COMMENTS
|
|
Found 1 FIXME:
|
|
- lib/actions/forgot-password.ts line 125: TODO comment about SMS provider
|
|
integration (MSG91/Twilio/AWS SNS). This is intentional — SMS dispatch is
|
|
a stub pending infrastructure decision per file header.
|
|
|
|
================================================================================
|
|
SUMMARY
|
|
================================================================================
|
|
|
|
Status: PASS ✓
|
|
|
|
No dead code found. All exports are consumed, all imports are used, all routes
|
|
are linked and reachable, all schema fields are actively used in the data layer.
|
|
|
|
The TODO comment in lib/actions/forgot-password.ts line 125 is intentional
|
|
infrastructure scaffolding, not a blocker.
|
|
|
|
Files to be committed: 0 (no changes made)
|
|
Removed items: [] (nothing to remove)
|
|
|
|
================================================================================
|