fix(auth): wire the full reset-password flow (#151)#171
Merged
Conversation
Password recovery was broken — the Forgot Password link was a dead placeholder with no recovery routes. This builds the standard Supabase reset flow end-to-end: - /forgot-password: email input calling resetPasswordForEmail, always shows a generic "if that email exists" message to prevent account enumeration - /reset-password: new password + confirm inputs calling updateUser, using the session established by the shared /auth/confirm route - Wire the sign-in Forgot Password link to /forgot-password - Add i18n keys for both flows Co-authored-by: Cursor <cursoragent@cursor.com>
68d1e95 to
2f887bc
Compare
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #151. Password recovery was broken — the Forgot Password link on the sign-in page was a dead
href="#"placeholder, and there were no recovery routes. This builds the standard Supabase password-reset flow end-to-end./forgot-password— single email input that callssupabase.auth.resetPasswordForEmail(email, { redirectTo: \${APP_URL}/auth/confirm?next=/reset-password` })`. Always shows a generic "If that email exists, we've sent a reset link" message regardless of email validity, to prevent account enumeration./reset-password— new password + confirm inputs that callsupabase.auth.updateUser({ password }). The session is already established by the shared/auth/confirmroute (sameverifyOtppath that powers invite acceptance, see fix(invite): switch to verifyOtp + /auth/confirm — invite mails use hash-flow, not PKCE #129), soupdateUserworks directly. Signs the user out and redirects to/sign-inon success.sign-in-form.tsxfromhref="#"to<Link href="/forgot-password">.errors.passwordMismatch.Manual config (done outside the repo)
{{ .RedirectTo }}&token_hash={{ .TokenHash }}&type=recovery.NEXT_PUBLIC_APP_URLconfirmed set (used byredirectTo).Test plan
/sign-in→ lands on/forgot-password/reset-passwordwith an active session (no/sign-updetour)/invite/<token>(shared/auth/confirmroute)tsc --noEmit+eslintclean (0 errors)Made with Cursor