feat(auth): forgot password + reset password page#37
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 18 minutes and 59 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Note
|
| Cohort / File(s) | Summary |
|---|---|
Auth page (initiate reset) client/src/app/auth/page.tsx |
Adds "forgot" mode and sent state, handleForgotPassword calling supabase.auth.resetPasswordForEmail, conditional UI for forgot flow (hides OAuth/divider), "Forgot password?" toggle, and sent/check-email confirmation. |
Reset password page (confirm & update) client/src/app/auth/reset-password/page.tsx |
New page: reads code from URL, calls supabase.auth.exchangeCodeForSession, shows checking/invalid/ready states; ready state renders password + confirm form with validation, toggles, submits via supabase.auth.updateUser, navigates to /app on success. |
Sequence Diagram(s)
sequenceDiagram
actor User
participant AuthPage as Auth Page
participant Supabase as Supabase Auth
participant Email as Email Service
participant ResetPage as Reset Password Page
User->>AuthPage: Click "Forgot password?"
AuthPage->>AuthPage: Switch to forgot mode
User->>AuthPage: Submit email
AuthPage->>Supabase: resetPasswordForEmail(email, {redirectTo})
Supabase->>Email: Send reset link (code)
Email-->>User: Reset email with link
User->>ResetPage: Open link (code in URL)
ResetPage->>Supabase: exchangeCodeForSession(code)
Supabase-->>ResetPage: Valid / Invalid
alt Valid
User->>ResetPage: Enter new password & submit
ResetPage->>Supabase: updateUser({ password })
Supabase-->>ResetPage: Password updated
ResetPage->>ResetPage: Navigate to /app
else Invalid
ResetPage->>User: Show invalid/expired message + link to auth
end
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
- M7: Supabase Auth #11: Modifies the same auth UI / Supabase auth flows and touches
client/src/app/auth/page.tsx.
🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage | Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (2 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly and concisely describes the main changes: adding forgot password functionality and a new reset password page. |
| Description check | ✅ Passed | The description covers all required template sections with detailed explanations of changes, correctly identifies the type as a new feature, and completes all checklist items except manual browser testing. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
p2.8-forgot-password
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@client/src/app/auth/reset-password/page.tsx`:
- Around line 34-52: Add a password confirmation field and validate it in
handleSubmit: introduce local state for confirmPassword and its setter (e.g.,
confirmPassword, setConfirmPassword) and add a confirmation input in the form
next to the existing password input; in handleSubmit (before calling
createClient() / supabase.auth.updateUser) check that confirmPassword ===
password and if not call setError("Passwords do not match") and return; keep
existing setLoading/setError flow and only proceed to createClient() and call
supabase.auth.updateUser({ password }) when the confirmation matches.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 0edd40cb-c590-421a-b2f4-861edd35097c
📒 Files selected for processing (2)
client/src/app/auth/page.tsxclient/src/app/auth/reset-password/page.tsx
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@client/src/app/auth/reset-password/page.tsx`:
- Around line 20-33: The useEffect block calls
supabase.auth.exchangeCodeForSession(code) only with .then(...), so if the
promise rejects the component never updates status and remains stuck; update the
code in the useEffect (around createClient and exchangeCodeForSession) to handle
rejections by adding a .catch(...) or using async/await with try/catch and
ensure setStatus("invalid") (and optional logging) is called on error, keeping
the existing setStatus("invalid") for the no-code branch and the setStatus(error
? "invalid" : "ready") logic for successful resolves.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5024a4a4-7f50-4adc-98c2-1ffc863db61a
📒 Files selected for processing (1)
client/src/app/auth/reset-password/page.tsx
1 participant
Summary
resetPasswordForEmail, shows "check your email" confirmation/auth/reset-passwordpage — extracts the?code=from the Supabase email link, callsexchangeCodeForSessionclient-side (PKCE), then lets the user set a new password viaupdateUser/auth/reset-passwordwithout a valid code shows an "invalid/expired" error immediately — prevents logged-in users from accessing the form without a real reset flowType of change
Checklist
npm run build)npx tsc --noEmit)npm run lint)Note
https://recallsave.vercel.app/auth/reset-passwordmust be added to Authentication → URL Configuration → Redirect URLs in the Supabase dashboard before testing on production.🤖 Generated with Claude Code
Summary by CodeRabbit