How to build a secure password reset flow in Next.js (the short version)

Last month I reviewed a friend's side project. He had 200 paying users, Stripe set up, a working dashboard. The password reset flow sent a reset token in a query string, stored it in plain text in Postgres, and never expired it. Anyone who read the database could take over any account, permanently. He had written it in 2 hours. It looked fine. That is the problem with reset flows. They look fine until someone reads them carefully. Here is a version that does not embarrass you, followed by the sa