Fix/forgot password 404 #253#288
Conversation
|
@amarakaushik8-debug is attempting to deploy a commit to the vishnukothakapu's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
More reviews will be available in 39 minutes and 8 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR implements a complete password reset feature: adds a ChangesPassword Reset Feature
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
app/api/auth/forgot-password/route.ts (1)
24-26: ⚡ Quick winConsider cleaning up existing tokens before creating a new one.
When a user requests multiple password resets, old tokens accumulate in the database. Deleting previous tokens for the same email prevents DB bloat and ensures only the latest token is valid.
♻️ Suggested fix
+ // Remove any existing tokens for this email + await prisma.passwordResetToken.deleteMany({ where: { email } }); + await prisma.passwordResetToken.create({ data: { email, token, expires }, });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@app/api/auth/forgot-password/route.ts` around lines 24 - 26, Before creating a new password reset token, remove any existing tokens for that email to prevent accumulation: call prisma.passwordResetToken.deleteMany({ where: { email } }) (or wrap deleteMany + create in prisma.$transaction([...]) for atomicity) immediately before prisma.passwordResetToken.create({ data: { email, token, expires } }) in the forgot-password route handler so only the newest token remains valid.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app/api/auth/reset-password/route.ts`:
- Around line 10-12: The current check only verifies token and password
truthiness; update the validation in the reset handler to enforce a minimum
password length (e.g., >= 8). Specifically, after extracting token and password,
change the existing conditional that uses (!token || !password) to also check
password.length and return NextResponse.json({ error: "Password too short" }, {
status: 400 }) when it fails; keep the same token missing behavior via the token
variable and NextResponse usage so the handler rejects weak passwords early.
In `@app/forgot-password/page.tsx`:
- Around line 38-40: Update the JSX text nodes that contain unescaped
apostrophes in the forgot-password page: find the <p
className="text-muted-foreground"> elements that render "If that email exists,
we've sent a password reset link." and the other paragraph rendering "we'll" and
replace raw apostrophes with HTML entities (use ' for '), so the displayed
text becomes "we've" and "we'll" to satisfy ESLint's
unescaped-entities rule.
- Around line 17-24: Wrap the fetch in a try-catch-finally inside the submit
handler (the function that calls fetch in app/forgot-password/page.tsx) so
network or JSON parse errors are caught and loading is always cleared;
specifically, call fetch(...) and then await res.json() inside a try block,
check res.ok and handle non-2xx responses, catch any thrown error to set an
error state or show a message, and move setLoading(false) into a finally block
so loading cannot remain true after failures (refer to the const res = await
fetch(...) / const data = await res.json(); setLoading(false); sequence).
In `@app/reset-password/page.tsx`:
- Around line 26-33: The fetch call in app/reset-password/page.tsx that posts to
"/api/auth/reset-password" is not wrapped in try/catch, so network errors or
non-JSON responses can never reach the setLoading(false) line; wrap the
fetch/response parsing in a try block and move setLoading(false) to a finally
block so loading is always cleared, and in the catch set an error state (or
handle it) instead of letting the exception bubble. Specifically, update the
block around the fetch call and the subsequent await res.json() (the code using
token, password, const res = await fetch(...), const data = await res.json(),
and setLoading) to: perform fetch and check res.ok, attempt to parse JSON inside
a guarded try, handle parse failures gracefully, set an error message on
failure, and ensure setLoading(false) runs in finally.
- Around line 10-15: When the page reads the token from searchParams (const
token = searchParams.get("token")), handle the case token === null immediately:
set an error state (use setError with a user-friendly message like "Missing or
invalid reset token"), prevent rendering or disable the form/submit by using
that error state (and ensure loading/ success flows don't proceed), and avoid
calling the reset submit handler when token is null. Implement this by adding a
useEffect that checks token on mount and sets setError(true) / setError("...")
(or returns early from the component rendering) so components referencing
password, confirm, loading, success do not attempt a submission without a valid
token.
---
Nitpick comments:
In `@app/api/auth/forgot-password/route.ts`:
- Around line 24-26: Before creating a new password reset token, remove any
existing tokens for that email to prevent accumulation: call
prisma.passwordResetToken.deleteMany({ where: { email } }) (or wrap deleteMany +
create in prisma.$transaction([...]) for atomicity) immediately before
prisma.passwordResetToken.create({ data: { email, token, expires } }) in the
forgot-password route handler so only the newest token remains valid.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8527630a-3f6f-4855-89f3-94e3b38c0462
📒 Files selected for processing (6)
app/api/auth/app/api/auth/reset-password/route.tsapp/api/auth/forgot-password/route.tsapp/api/auth/reset-password/route.tsapp/forgot-password/page.tsxapp/reset-password/page.tsxprisma/schema.prisma
|
@vishnukothakapu please review it #288 |
|
@vishnukothakapu I would like this to be approved under GSSoC'26 pls |
vishnukothakapu
added
level:beginner
gssoc:approved
type:feature
type:bug
and removed
type:feature
labels
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Critical Issues (must fix before merge)
diff --git a/app/api/auth/app/api/auth/reset-password/route.ts b/app/api/auth/app/api/auth/reset-password/route.ts This path app/api/auth/app/api/auth/reset-password/ is a doubled nested path -obviously a mistake. This creates a useless empty file and a junk directory. It needs to be deleted from the PR.
CSRF attacks :a malicious site could trigger password resets for arbitrary users Need to add CSRF token validation (at minimum for reset-password), or use the existing middleware pattern.
Flood a user's inbox with reset emails
const token = crypto.randomBytes(32).toString("hex"); If the database is ever compromised, an attacker gets all valid reset tokens.
Lines 89-93 have completely broken indentation :the return and if blocks jump from 4-space indent to 2-space indent. This suggests copy-paste errors. Minor Issues (should fix)
The forgot-password route imports: Need to verify this function exists and accepts the { to, subject, html } signature used here. If the codebase's email utility has a different API, this will crash at runtime.
fix and lmk. |
|
Sure will review and let you know |
|
Hi @ArshiBansal, The build is currently failing with the following TypeScript error: Type error: File '/vercel/path0/app/api/auth/app/api/auth/reset-password/route.ts' is not a module.It looks like the route file may have one of the following issues:
Could you please review the After fixing the issue, please push the updated changes. Thanks! |
|
@vishnukothakapu yea sure |
4 participants
Program Description
I would like this to be approved under GSSoC'26.
What does this PR do?
Implements the forgot password and reset password flow. Previously, clicking
"Forgot Password?" on the login page returned a 404 error because the route
and pages did not exist. This PR creates the full password reset flow including
UI pages, API routes, database model, and email delivery.
Related Issue
Closes #253
Type of Change
How to Test
Get Startedand click "Forgot Password?"/loginand can log in with the new password.Screenshots (if UI change)
Before:-
https://github.com/user-attachments/assets/3a15542e-75e9-41df-811e-92995ed9ad28
Now:-
Forgot Password Page:
https://github.com/user-attachments/assets/5d59aa22-482e-46da-b79e-3feb55b9e052
Reset Password Page:
https://github.com/user-attachments/assets/a653227b-8a60-4e3b-99af-59ee22ea9f32
Reset Email:
https://github.com/user-attachments/assets/0e41bca5-43de-45f2-b73f-61e35236d6da
Checklist
Note for Maintainers
SMTP credentials need to be configured in production environment variables
(SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, EMAIL_FROM) for password reset
emails to be delivered.
Summary by CodeRabbit