Merge remote-tracking branch 'origin/main' into dev/mypage

frontend/lib/features/admin/presentation/create_user_screen.dart

@@ -108,12 +108,28 @@ class _CreateUserScreenState extends State<CreateUserScreen> {
 
     setState(() => _isLoading = true);
 
+    String loginId = _loginIdController.text.trim();
+    if (!loginId.contains('@')) {
+      loginId = loginId.replaceAll(RegExp(r'[-\s]'), '');
+      if (loginId.startsWith('010')) {
+        loginId = '+82${loginId.substring(1)}';
+      }
+    }
+
+    String? phone = _phoneController.text.trim().isEmpty ? null : _phoneController.text.trim();
+    if (phone != null && !phone.contains('@')) {
+      phone = phone.replaceAll(RegExp(r'[-\s]'), '');
+      if (phone.startsWith('010')) {
+        phone = '+82${phone.substring(1)}';
+      }
+    }
+
     try {
       await AuthProxyService.createUser(
-        loginId: _loginIdController.text.trim(),
+        loginId: loginId,
         adminPassword: _verifiedAdminPassword!,
         email: _emailController.text.trim().isEmpty ? null : _emailController.text.trim(),
-        phone: _phoneController.text.trim().isEmpty ? null : _phoneController.text.trim(),
+        phone: phone,
         displayName: _nameController.text.trim().isEmpty ? null : _nameController.text.trim(),
       );
 

frontend/lib/features/admin/presentation/user_management_screen.dart

@@ -205,13 +205,22 @@ class _UserManagementScreenState extends State<UserManagementScreen> with Single
     if (confirm != true) return;
 
     setState(() => _isLoading = true);
+
+    String? phone = phoneController.text.trim().isEmpty ? null : phoneController.text.trim();
+    if (phone != null && !phone.contains('@')) {
+      phone = phone.replaceAll(RegExp(r'[-\s]'), '');
+      if (phone.startsWith('010')) {
+        phone = '+82${phone.substring(1)}';
+      }
+    }
+
     try {
       await AuthProxyService.updateUserDetails(
         adminPassword: _verifiedAdminPassword!,
         loginId: loginId,
         displayName: nameController.text.trim(),
         email: emailController.text.trim(),
-        phone: phoneController.text.trim(),
+        phone: phone,
       );
       _showSuccess("User updated successfully");
       _loadUsers(query: _searchController.text);
@@ -228,12 +237,29 @@ class _UserManagementScreenState extends State<UserManagementScreen> with Single
     if (_verifiedAdminPassword == null) return;
 
     setState(() => _isLoading = true);
+
+    String loginId = _createLoginIdController.text.trim();
+    if (!loginId.contains('@')) {
+      loginId = loginId.replaceAll(RegExp(r'[-\s]'), '');
+      if (loginId.startsWith('010')) {
+        loginId = '+82${loginId.substring(1)}';
+      }
+    }
+
+    String? phone = _createPhoneController.text.trim().isEmpty ? null : _createPhoneController.text.trim();
+    if (phone != null && !phone.contains('@')) {
+      phone = phone.replaceAll(RegExp(r'[-\s]'), '');
+      if (phone.startsWith('010')) {
+        phone = '+82${phone.substring(1)}';
+      }
+    }
+
     try {
       await AuthProxyService.createUser(
-        loginId: _createLoginIdController.text.trim(),
+        loginId: loginId,
         adminPassword: _verifiedAdminPassword!,
         email: _createEmailController.text.trim().isEmpty ? null : _createEmailController.text.trim(),
-        phone: _createPhoneController.text.trim().isEmpty ? null : _createPhoneController.text.trim(),
+        phone: phone,
         displayName: _createNameController.text.trim().isEmpty ? null : _createNameController.text.trim(),
       );
 

frontend/lib/features/auth/presentation/forgot_password_screen.dart

@@ -0,0 +1,121 @@
+import 'package:flutter/material.dart';
+import 'package:google_fonts/google_fonts.dart';
+import '../../../core/services/auth_proxy_service.dart';
+
+class ForgotPasswordScreen extends StatefulWidget {
+  const ForgotPasswordScreen({super.key});
+
+  @override
+  State<ForgotPasswordScreen> createState() => _ForgotPasswordScreenState();
+}
+
+class _ForgotPasswordScreenState extends State<ForgotPasswordScreen> {
+  final TextEditingController _loginIdController = TextEditingController();
+  bool _isLoading = false;
+
+  Future<void> _handlePasswordReset() async {
+    final input = _loginIdController.text.trim();
+    if (input.isEmpty) {
+      _showError("이메일 또는 휴대폰 번호를 입력해주세요.");
+      return;
+    }
+
+    String loginId = input;
+    if (!input.contains('@')) {
+      // Format phone number if it's not an email
+      loginId = input.replaceAll(RegExp(r'[-\s]'), '');
+      if (loginId.startsWith('010')) {
+        loginId = '+82${loginId.substring(1)}';
+      }
+    }
+
+    setState(() => _isLoading = true);
+
+    try {
+      await AuthProxyService.initiatePasswordReset(loginId);
+      if (mounted) {
+        ScaffoldMessenger.of(context).showSnackBar(
+          const SnackBar(
+            content: Text("비밀번호 재설정 링크가 전송되었습니다. 이메일 또는 SMS를 확인해주세요."),
+            backgroundColor: Colors.green,
+          ),
+        );
+        Navigator.of(context).pop();
+      }
+    } catch (e) {
+      if (mounted) {
+        _showError("전송에 실패했습니다: ${e.toString()}");
+      }
+    } finally {
+      if (mounted) {
+        setState(() => _isLoading = false);
+      }
+    }
+  }
+
+  void _showError(String message) {
+    ScaffoldMessenger.of(context).showSnackBar(
+      SnackBar(content: Text(message), backgroundColor: Colors.red),
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(
+        title: const Text("비밀번호 재설정"),
+        centerTitle: true,
+      ),
+      body: Center(
+        child: Container(
+          constraints: const BoxConstraints(maxWidth: 400),
+          padding: const EdgeInsets.all(24),
+          child: Column(
+            mainAxisAlignment: MainAxisAlignment.center,
+            crossAxisAlignment: CrossAxisAlignment.stretch,
+            children: [
+              Text(
+                "비밀번호를 잊으셨나요?",
+                style: GoogleFonts.outfit(
+                  fontSize: 28,
+                  fontWeight: FontWeight.bold,
+                ),
+                textAlign: TextAlign.center,
+              ),
+              const SizedBox(height: 16),
+              const Text(
+                "계정과 연결된 이메일 주소 또는 휴대폰 번호를 입력하시면, 비밀번호를 재설정할 수 있는 링크를 보내드립니다.",
+                textAlign: TextAlign.center,
+                style: TextStyle(color: Colors.grey),
+              ),
+              const SizedBox(height: 40),
+              TextField(
+                controller: _loginIdController,
+                decoration: const InputDecoration(
+                  labelText: "이메일 또는 휴대폰 번호",
+                  border: OutlineInputBorder(),
+                  prefixIcon: Icon(Icons.person_outline),
+                ),
+                onSubmitted: (_) => _handlePasswordReset(),
+              ),
+              const SizedBox(height: 24),
+              FilledButton(
+                onPressed: _isLoading ? null : _handlePasswordReset,
+                style: FilledButton.styleFrom(
+                  minimumSize: const Size.fromHeight(50),
+                ),
+                child: _isLoading
+                    ? const SizedBox(
+                        height: 20,
+                        width: 20,
+                        child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white),
+                      )
+                    : const Text("재설정 링크 전송"),
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}

frontend/lib/features/auth/presentation/login_screen.dart

@@ -12,6 +12,7 @@ import '../../../core/services/audit_service.dart';
 import '../../../core/services/web_auth_integration.dart';
 import '../../../core/services/auth_proxy_service.dart';
 import '../../../core/notifiers/auth_notifier.dart';
+import './forgot_password_screen.dart';
 
 class LoginScreen extends ConsumerStatefulWidget {
   final String? verificationToken;
@@ -24,9 +25,9 @@ class LoginScreen extends ConsumerStatefulWidget {
 class _LoginScreenState extends ConsumerState<LoginScreen>
     with SingleTickerProviderStateMixin {
   late TabController _tabController;
-  final TextEditingController _idController = TextEditingController();
-  final TextEditingController _smsCodeController = TextEditingController(); // Keep if needed for verification inputs later? Actually not used in link flow.
-  bool _smsSent = false;
+  final TextEditingController _linkIdController = TextEditingController();
+  final TextEditingController _passwordLoginIdController = TextEditingController();
+  final TextEditingController _passwordController = TextEditingController();
   String? _redirectUrl;
 
   // QR Login Variables
@@ -40,7 +41,8 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
   @override
   void initState() {
     super.initState();
-    _tabController = TabController(length: 2, vsync: this);
+    // 탭 컨트롤러: 3개 탭, 기본 선택은 두 번째 탭("로그인 링크")
+    _tabController = TabController(length: 3, vsync: this, initialIndex: 1);
     _tabController.addListener(_handleTabSelection);
     
     // Check for tokens (Path Parameter or Legacy Query Parameter)
@@ -92,9 +94,10 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
   }
 
   void _handleTabSelection() {
-    if (_tabController.index == 1 && _qrPendingRef == null) {
+    // QR 탭 (세 번째 탭, index 2)이 선택되었을 때 QR 플로우 시작
+    if (_tabController.index == 2 && _qrPendingRef == null) {
       _startQrFlow();
-    } else if (_tabController.index != 1) {
+    } else if (_tabController.index != 2) {
       _stopQrPolling();
     }
   }
@@ -230,28 +233,65 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
     }
   }
 
-  void _showSuccessDialog() {
-    showDialog(
-      context: context,
-      barrierDismissible: false,
-      builder: (context) => const AlertDialog(
-        title: Text("Authentication Successful"),
-        content: Text("You can close this tab and return to the application."),
-      ),
-    );
-  }
-
   @override
   void dispose() {
     _stopQrPolling();
     _tabController.dispose();
-    _idController.dispose();
-    _smsCodeController.dispose();
+    _linkIdController.dispose();
+    _passwordLoginIdController.dispose();
+    _passwordController.dispose();
     super.dispose();
   }
 
-  Future<void> _handleLogin() async {
-    final input = _idController.text.trim();
+  // 이메일/비밀번호 로그인 처리
+  Future<void> _handlePasswordLogin() async {
+    final input = _passwordLoginIdController.text.trim();
+    final password = _passwordController.text.trim();
+    if (input.isEmpty || password.isEmpty) {
+      _showError("이메일(또는 전화번호)와 비밀번호를 모두 입력해주세요.");
+      return;
+    }
+
+    String loginId = input;
+    if (!input.contains('@')) {
+      // Format phone number if it's not an email
+      loginId = input.replaceAll(RegExp(r'[-\s]'), '');
+      if (loginId.startsWith('010')) {
+        loginId = '+82${loginId.substring(1)}';
+      }
+    }
+
+    // 로딩 인디케이터 표시
+    showDialog(
+      context: context,
+      barrierDismissible: false,
+      builder: (context) => const Center(child: CircularProgressIndicator()),
+    );
+
+    try {
+      final res = await AuthProxyService.loginWithPassword(loginId, password);
+      final jwt = res['sessionJwt'];
+      if (jwt != null && mounted) {
+        Navigator.of(context).pop(); // 로딩 닫기
+        
+        final displayName = _getLoginIdFromJwt(jwt);
+        final dummyUser = DescopeUser(
+          'unknown', [], 0, displayName, null, '', false, '', false, {}, '', '', '', false, 'enabled', [], [], [],
+        );
+        final session = DescopeSession.fromJwt(jwt, jwt, dummyUser);
+        Descope.sessionManager.manageSession(session);
+        
+        _onLoginSuccess(jwt);
+      }
+    } catch (e) {
+      if (mounted) Navigator.of(context).pop(); // 로딩 닫기
+      _showError("로그인 실패: ${e.toString().replaceFirst("Exception: ", "")}");
+    }
+  }
+
+  // 로그인 링크 전송 처리
+  Future<void> _handleLinkLogin() async {
+    final input = _linkIdController.text.trim();
     if (input.isEmpty) return;
 
     String loginId = input;
@@ -340,26 +380,8 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
             
             final displayName = _getLoginIdFromJwt(jwt);
             // Descope SDK 세션 강제 주입
-            // Note: DescopeUser in 0.9.11 requires 18 positional arguments.
             final dummyUser = DescopeUser(
-              'unknown', // userId
-              [],        // loginIds
-              0,         // createdAt
-              displayName,    // name
-              null,      // picture (Uri?)
-              '',        // email
-              false,     // isVerifiedEmail
-              '',        // phone
-              false,     // isVerifiedPhone
-              {},        // customAttributes
-              '',        // givenName
-              '',        // middleName
-              '',        // familyName
-              false,     // hasPassword
-              'enabled', // status
-              [],        // roleNames
-              [],        // ssoAppIds
-              [],        // oauthProviders (List<String>)
+              'unknown', [], 0, displayName, null, '', false, '', false, {}, '', '', '', false, 'enabled', [], [], [],
             );
             final session = DescopeSession.fromJwt(jwt, jwt, dummyUser);
             Descope.sessionManager.manageSession(session);
@@ -397,38 +419,25 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
 
   void _logTokenDetails(String jwt) {
     try {
-      // JWT는 세 부분(Header, Payload, Signature)이 '.'으로 구분된 문자열입니다. 이를 분리합니다.
       final parts = jwt.split('.');
-      // 세 부분으로 정확히 나뉘지 않았다면 유효한 JWT가 아니므로 중단합니다.
       if (parts.length != 3) return;
 
-      // JWT의 두 번째 부분(Payload)은 Base64Url로 인코딩된 JSON 데이터입니다.
-      // 1. Base64Url 문자열을 디코딩하여 바이트 배열로 변환합니다.
-      //    normalize()는 Base64 패딩(=) 문제를 처리해줍니다.
       final decodedPayload = base64Url.decode(base64Url.normalize(parts[1]));
-      // 2. 바이트 배열을 UTF-8 형식의 일반 문자열(JSON)로 변환합니다.
       final payloadJson = utf8.decode(decodedPayload);
-      // 3. JSON 문자열을 Dart에서 사용할 수 있는 Map 객체로 변환합니다.
       final data = json.decode(payloadJson) as Map<String, dynamic>;
       
-      // [FIX] 'exp'는 int 또는 double일 수 있으므로, 안전하게 num으로 처리합니다.
       final accessExpValue = data['exp'] as num?;
-      // 'exp' (Expiration Time) 필드는 Access Token의 만료 시간을 나타냅니다. Unix 타임스탬프(초 단위) 값입니다.
-      // 이 값을 Dart의 DateTime 객체로 변환합니다. (1000을 곱해 밀리초 단위로 만듦)
       final accessExp = accessExpValue != null
           ? DateTime.fromMillisecondsSinceEpoch(accessExpValue.toInt() * 1000)
           : 'N/A';
-      // 'rexp' (Refresh Expiration) 필드는 Descope가 사용하는 커스텀 필드로, Refresh Token의 만료 시간을 ISO 8601 형식의 문자열로 나타냅니다.
       final refreshExp = data['rexp'] ?? 'N/A';
 
-      // 확인된 만료 시간 정보들을 디버그 콘솔에 출력합니다.
       debugPrint("""
       [Auth] Session Token Details ---
         - Access Token Expires: $accessExp
         - Refresh Token Expires: $refreshExp
       """);
     } catch (e) {
-      // JWT를 해석하는 과정에서 오류가 발생하면 콘솔에 에러를 출력합니다.
       debugPrint("[Auth] Failed to decode or log token details: $e");
     }
   }
@@ -438,7 +447,6 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
     
     _logTokenDetails(token);
 
-    // [FIX] 감사 로그에 실제 사용자 ID를 전송하기 위해 토큰에서 ID를 추출합니다.
     final userId = _getUserIdFromJwt(token);
 
     // Record Audit Log
@@ -449,16 +457,12 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
       details: "User logged in via Baron SSO",
     );
 
-    // 1. Handle Popup Flow (Highest Priority for child windows)
-    // If opened as a popup (has opener), we notify and try to close.
+    // 1. Handle Popup Flow
     if (WebAuthIntegration.isPopup()) {
       debugPrint("[Auth] Popup detected. Notifying opener and attempting to close.");
       WebAuthIntegration.sendLoginSuccess(token);
-      
-      // We don't 'return' here to allow a fallback if window.close() is blocked,
-      // but in most cases WebAuthIntegration.sendLoginSuccess will close the window.
     } else {
-      // 2. Handle Redirect Flow (Only if NOT a popup)
+      // 2. Handle Redirect Flow
       if (_redirectUrl != null && _redirectUrl!.isNotEmpty) {
         debugPrint("[Auth] Redirecting standalone window to: $_redirectUrl");
         final target = "$_redirectUrl?token=$token";
@@ -468,7 +472,6 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
     }
 
     // 3. Standalone mode / Fallback
-    // If it's a standard login, or if a popup's window.close() was blocked by the browser.
     debugPrint("[Auth] Login success. Navigating to root.");
     AuthNotifier.instance.notify();
     if (mounted) {
@@ -505,7 +508,8 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                       TabBar(
                         controller: _tabController,
                         tabs: const [
-                          Tab(text: "로그인"),
+                          Tab(text: "비밀번호"),
+                          Tab(text: "로그인 링크"),
                           Tab(text: "QR 코드"),
                         ],
                       ),
@@ -516,24 +520,72 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                         child: TabBarView(
                           controller: _tabController,
                           children: [
-                            // Unified Login Form
+                            // 1. 이메일/비밀번호 로그인 폼
                             Padding(
                               padding: const EdgeInsets.only(top: 16.0),
                               child: Column(
                                 children: [
                                   TextField(
-                                    controller: _idController,
+                                    controller: _passwordLoginIdController,
+                                    decoration: const InputDecoration(
+                                      labelText: "이메일 또는 휴대폰 번호",
+                                      border: OutlineInputBorder(),
+                                      prefixIcon: Icon(Icons.person_outline),
+                                    ),
+                                    onSubmitted: (_) => _handlePasswordLogin(),
+                                  ),
+                                  const SizedBox(height: 16),
+                                  TextField(
+                                    controller: _passwordController,
+                                    obscureText: true,
+                                    decoration: const InputDecoration(
+                                      labelText: "비밀번호",
+                                      border: OutlineInputBorder(),
+                                      prefixIcon: Icon(Icons.lock_outline),
+                                    ),
+                                    onSubmitted: (_) => _handlePasswordLogin(),
+                                  ),
+                                  const SizedBox(height: 24),
+                                  FilledButton(
+                                    onPressed: _handlePasswordLogin,
+                                    style: FilledButton.styleFrom(
+                                      minimumSize: const Size.fromHeight(50),
+                                    ),
+                                    child: const Text("로그인"),
+                                  ),
+                                   const SizedBox(height: 16),
+                                   TextButton(
+                                    onPressed: () {
+                                      Navigator.of(context).push(
+                                        MaterialPageRoute(
+                                          builder: (context) => const ForgotPasswordScreen(),
+                                        ),
+                                      );
+                                    },
+                                    child: const Text("비밀번호를 잊으셨나요?"),
+                                  )
+                                ],
+                              ),
+                            ),
+                            
+                            // 2. 로그인 링크 전송 폼
+                            Padding(
+                              padding: const EdgeInsets.only(top: 16.0),
+                              child: Column(
+                                children: [
+                                  TextField(
+                                    controller: _linkIdController,
                                     decoration: const InputDecoration(
                                       labelText: "이메일 또는 휴대폰 번호",
                                       hintText: "",
                                       border: OutlineInputBorder(),
                                       prefixIcon: Icon(Icons.person_outline),
                                     ),
-                                    onSubmitted: (_) => _handleLogin(),
+                                    onSubmitted: (_) => _handleLinkLogin(),
                                   ),
                                   const SizedBox(height: 24),
                                   FilledButton(
-                                    onPressed: _handleLogin,
+                                    onPressed: _handleLinkLogin,
                                     style: FilledButton.styleFrom(
                                       minimumSize: const Size.fromHeight(50),
                                     ),
@@ -560,7 +612,7 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                               ),
                             ),
 
-                            // QR Login View
+                            // 3. QR 로그인 뷰
                             Column(
                               mainAxisAlignment: MainAxisAlignment.center,
                               crossAxisAlignment: CrossAxisAlignment.center,

frontend/lib/features/auth/presentation/reset_password_screen.dart

@@ -0,0 +1,273 @@
+import 'package:flutter/material.dart';
+import 'package:google_fonts/google_fonts.dart';
+import 'package:go_router/go_router.dart';
+import '../../../core/services/auth_proxy_service.dart';
+
+class ResetPasswordScreen extends StatefulWidget {
+  final String? loginId; // Now receiving loginId
+  const ResetPasswordScreen({super.key, this.loginId});
+
+  @override
+  State<ResetPasswordScreen> createState() => _ResetPasswordScreenState();
+}
+
+class _ResetPasswordScreenState extends State<ResetPasswordScreen> {
+  final TextEditingController _passwordController = TextEditingController();
+  final TextEditingController _confirmPasswordController = TextEditingController();
+  final _formKey = GlobalKey<FormState>();
+  bool _isLoading = false;
+  String? _loginId;
+  String? _token;
+  bool _isPasswordObscured = true;
+  bool _isConfirmPasswordObscured = true;
+  Map<String, dynamic>? _policy;
+  bool _isPolicyLoading = false;
+
+  @override
+  void initState() {
+    super.initState();
+    // 1. Get loginId from GoRouter state if available
+    _loginId = widget.loginId;
+
+    // 2. Fallback to URI query parameter if not available via router
+    if (_loginId == null || _loginId!.isEmpty) {
+    final uri = Uri.base;
+    _loginId = uri.queryParameters['loginId'];
+  }
+
+  // 토큰도 함께 읽어놓는다.
+  final uri = Uri.base;
+  _token = uri.queryParameters['token'];
+
+    _loadPolicy();
+  }
+
+  Future<void> _loadPolicy() async {
+    setState(() {
+      _isPolicyLoading = true;
+    });
+    try {
+      final policy = await AuthProxyService.fetchPasswordPolicy();
+      if (mounted) {
+        setState(() {
+          _policy = policy;
+        });
+      }
+    } catch (_) {
+      // 실패해도 기본 검증 로직 사용
+    } finally {
+      if (mounted) {
+        setState(() {
+          _isPolicyLoading = false;
+        });
+      }
+    }
+  }
+
+  Future<void> _handlePasswordReset() async {
+    if (_formKey.currentState?.validate() != true) return;
+    if ((_loginId == null || _loginId!.isEmpty) && (_token == null || _token!.isEmpty)) {
+      _showError("유효하지 않은 재설정 링크입니다. (loginId/token 누락)");
+      return;
+    }
+
+    setState(() => _isLoading = true);
+
+    try {
+      await AuthProxyService.completePasswordReset(
+        loginId: _loginId,
+        token: _token,
+        newPassword: _passwordController.text,
+      );
+
+      if (mounted) {
+        ScaffoldMessenger.of(context).showSnackBar(
+          const SnackBar(
+            content: Text("비밀번호가 성공적으로 변경되었습니다. 다시 로그인해주세요."),
+            backgroundColor: Colors.green,
+          ),
+        );
+        context.go('/login');
+      }
+    } catch (e) {
+      if (mounted) {
+        _showError("비밀번호 변경에 실패했습니다: ${e.toString()}");
+      }
+    } finally {
+      if (mounted) {
+        setState(() => _isLoading = false);
+      }
+    }
+  }
+
+  void _showError(String message) {
+    ScaffoldMessenger.of(context).showSnackBar(
+      SnackBar(content: Text(message), backgroundColor: Colors.red),
+    );
+  }
+
+  String _buildPolicyDescription() {
+    if (_isPolicyLoading) {
+      return "비밀번호 정책을 불러오는 중입니다...";
+    }
+    final minLength = (_policy?['minLength'] as int?) ?? 8;
+    final requiresLower = _policy?['lowercase'] ?? true;
+    final requiresUpper = _policy?['uppercase'] ?? true;
+    final requiresNumber = _policy?['number'] ?? true;
+    final requiresSymbol = _policy?['nonAlphanumeric'] ?? true;
+
+    final parts = <String>["최소 ${minLength}자 이상"];
+    if (requiresLower) parts.add("소문자 1개 이상");
+    if (requiresUpper) parts.add("대문자 1개 이상");
+    if (requiresNumber) parts.add("숫자 1개 이상");
+    if (requiresSymbol) parts.add("특수문자 1개 이상");
+
+    return parts.join(", ");
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(
+        title: const Text("새 비밀번호 설정"),
+        centerTitle: true,
+      ),
+      body: Center(
+        child: Container(
+          constraints: const BoxConstraints(maxWidth: 400),
+          padding: const EdgeInsets.all(24),
+          child: (_loginId == null || _loginId!.isEmpty) && (_token == null || _token!.isEmpty)
+              ? _buildInvalidTokenView()
+              : Form(
+                  key: _formKey,
+                  child: Column(
+                    mainAxisAlignment: MainAxisAlignment.center,
+                    crossAxisAlignment: CrossAxisAlignment.stretch,
+                    children: [
+                      Text(
+                        "새로운 비밀번호 설정",
+                        style: GoogleFonts.outfit(
+                          fontSize: 28,
+                          fontWeight: FontWeight.bold,
+                        ),
+                        textAlign: TextAlign.center,
+                      ),
+                      const SizedBox(height: 16),
+                      Text(
+                        _buildPolicyDescription(),
+                        textAlign: TextAlign.center,
+                        style: const TextStyle(color: Colors.grey),
+                      ),
+                      const SizedBox(height: 40),
+                      TextFormField(
+                        controller: _passwordController,
+                        obscureText: _isPasswordObscured,
+                        decoration: InputDecoration(
+                          labelText: "새 비밀번호",
+                          border: const OutlineInputBorder(),
+                          prefixIcon: const Icon(Icons.lock_outline),
+                          suffixIcon: IconButton(
+                            icon: Icon(
+                              _isPasswordObscured ? Icons.visibility_off : Icons.visibility,
+                            ),
+                            onPressed: () {
+                              setState(() {
+                                _isPasswordObscured = !_isPasswordObscured;
+                              });
+                            },
+                          ),
+                        ),
+                        validator: (value) {
+                          final val = value ?? "";
+                          if (val.isEmpty) {
+                            return '비밀번호를 입력해주세요.';
+                          }
+                          final minLength = (_policy?['minLength'] as int?) ?? 8;
+                          if (val.length < minLength) {
+                            return '비밀번호는 최소 $minLength자 이상이어야 합니다.';
+                          }
+                          if ((_policy?['lowercase'] ?? true) && !RegExp(r'(?=.*[a-z])').hasMatch(val)) {
+                            return '최소 1개 이상의 소문자를 포함해야 합니다.';
+                          }
+                          if ((_policy?['uppercase'] ?? true) && !RegExp(r'(?=.*[A-Z])').hasMatch(val)) {
+                            return '최소 1개 이상의 대문자를 포함해야 합니다.';
+                          }
+                          if ((_policy?['number'] ?? true) && !RegExp(r'(?=.*\d)').hasMatch(val)) {
+                            return '최소 1개 이상의 숫자를 포함해야 합니다.';
+                          }
+                          if ((_policy?['nonAlphanumeric'] ?? true) && !RegExp(r'(?=.*[\W_])').hasMatch(val)) {
+                            return '최소 1개 이상의 특수문자를 포함해야 합니다.';
+                          }
+                          return null;
+                        },
+                      ),
+                      const SizedBox(height: 16),
+                      TextFormField(
+                        controller: _confirmPasswordController,
+                        obscureText: _isConfirmPasswordObscured,
+                        decoration: InputDecoration(
+                          labelText: "새 비밀번호 확인",
+                          border: const OutlineInputBorder(),
+                          prefixIcon: const Icon(Icons.lock_outline),
+                          suffixIcon: IconButton(
+                            icon: Icon(
+                              _isConfirmPasswordObscured ? Icons.visibility_off : Icons.visibility,
+                            ),
+                            onPressed: () {
+                              setState(() {
+                                _isConfirmPasswordObscured = !_isConfirmPasswordObscured;
+                              });
+                            },
+                          ),
+                        ),
+                        validator: (value) {
+                          if (value != _passwordController.text) {
+                            return '비밀번호가 일치하지 않습니다.';
+                          }
+                          return null;
+                        },
+                      ),
+                      const SizedBox(height: 24),
+                      FilledButton(
+                        onPressed: _isLoading ? null : _handlePasswordReset,
+                        style: FilledButton.styleFrom(
+                          minimumSize: const Size.fromHeight(50),
+                        ),
+                        child: _isLoading
+                            ? const SizedBox(
+                                height: 20,
+                                width: 20,
+                                child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white),
+                              )
+                            : const Text("비밀번호 변경"),
+                      ),
+                    ],
+                  ),
+                ),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildInvalidTokenView() {
+    return const Center(
+      child: Column(
+        mainAxisAlignment: MainAxisAlignment.center,
+        children: [
+          Icon(Icons.error_outline, color: Colors.red, size: 60),
+          SizedBox(height: 16),
+          Text(
+            "유효하지 않은 링크입니다.",
+            style: TextStyle(fontSize: 18, fontWeight: FontWeight.bold),
+            textAlign: TextAlign.center,
+          ),
+          SizedBox(height: 8),
+          Text(
+            "비밀번호 재설정 링크가 만료되었거나 잘못되었습니다. 다시 시도해주세요.",
+            textAlign: TextAlign.center,
+          ),
+        ],
+      ),
+    );
+  }
+}