feat(golf): premium password-reset flow — pages + branded email (#650) - #1019
Conversation
…650) Rebuild forgot-password and reset-password on the same illustrated auth chrome as the login redesign (#650) — CoastalScene/CourseScene, the HelmMark brand lockup, and the warm-cream form card — replacing the retired orb/glass look. Shared chrome is factored into a new GolfAuthShell so both pages (and future auth surfaces) stay pixel-matched to the login. - GolfAuthShell: LazyMotion + one scene per viewport (useMediaQuery swaps Coastal on desktop / Course on mobile, exactly like the login), the floating HelmMark lockup, the cream form card, a footer slot, and AuthPrimaryButton (the login's submit button with a bouncing-dot loading state). Built on the shared ui Input/Button primitives so the lint ratchet stays clean (no raw input/button, no bg-white). - forgot-password: shared Input + success ("Check your email") state; the hardened, rate-limited requestPasswordResetAction is preserved. - reset-password: recovery-session state machine preserved verbatim (getSession / exchangeCodeForSession / verifyOtp → verifying/ready/ invalid), PasswordStrengthIndicator, match/mismatch affordances, and danger-token error styling instead of raw red. tsc + eslint clean (0 warnings); full business suite (798 files / 7393 tests) green against these changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LSNMRp1FKhPsiPZ3K7pR3d
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The reset flow's web pages were premium, but the email Supabase sends on
resetPasswordForEmail() was its bare default template. Add a brand-matched
recovery email and wire it via config.toml so it's code-managed:
- supabase/templates/recovery.html — warm-parchment shell, the real
GolfHelm helm-wheel mark (hosted /helm-golf-logo-transparent.png, 200 in
prod) stacked above the live-text "GolfHelm" wordmark (so it still reads
if a client blocks images), cream card, helm-green CTA linking
{{ .ConfirmationURL }}, a plain-link fallback, 1-hour expiry, and a
didn't-request-this reassurance line. Email-client-safe: table layout,
inline styles, Outlook VML button, mobile media query.
- config.toml [auth.email.template.recovery] → subject + content_path.
Applied to the linked project on `supabase config push`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSNMRp1FKhPsiPZ3K7pR3d
njrini99-code
changed the title
|
Added the branded reset email (real GolfHelm helm-wheel mark) + |
…ical apply (#1022) Extends the branded recovery email (#1019) to the two remaining user-facing auth emails, and adds a safe way to apply all three to prod. - supabase/templates/confirmation.html + email_change.html — same warm GolfHelm shell (real helm-wheel mark, cream card, helm-green CTA) as recovery. email_change names the target address via {{ .NewEmail }} (a variable GoTrue supports only for that template). - config.toml — [auth.email.template.confirmation] + [.email_change]; the block now carries an explicit⚠️ warning NOT to `supabase config push` (that would push the dev site_url=127.0.0.1 and break prod). - scripts/apply-auth-email-templates.sh — applies ONLY the 6 mailer_* fields via the Management API PATCH /config/auth (the documented partial-update endpoint), reading subjects/paths from config.toml as the single source of truth. Backs up first, then PROVES it was surgical with a full before/after key diff (fails if any non-template field changed). Token via SUPABASE_ACCESS_TOKEN env only — never stored/printed; umask 077 + payload cleanup on the temp files. Adversarial review (3 agents) caught + fixed before ship: expiry copy was "24 hours" but otp_expiry=3600 governs all three links → corrected to "1 hour"; inline text-decoration:none on the buttons (webmail strips <style>); the surgical proof + secret-file hardening above. Field names, {{ .NewEmail }}, and the partial-PATCH behavior verified against the Supabase docs. shellcheck clean; all 3 templates render premium. Claude-Session: https://claude.ai/code/session_01LSNMRp1FKhPsiPZ3K7pR3d Co-authored-by: Fable Integrator <fable@helm.local> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
What
Rebuilds the GolfHelm forgot-password and reset-password pages on the same illustrated auth chrome as the approved login redesign (#650), replacing the retired orb/glass look. Requested alongside the settings audit: "ensure the password reset model is modern and premium."
How
GolfAuthShell(src/components/auth/GolfAuthShell.tsx) — factors the login's chrome into one reusable shell so both reset pages (and any future auth surface) stay pixel-matched:LazyMotion+ one scene per viewport (useMediaQueryswapsCoastalSceneon desktop /CourseSceneon mobile, exactly like the login)HelmMarkbrand lockup +Golf/Helmwordmarkrgba(255,253,245,0.94), 24px radius, inset-highlight shadow)AuthPrimaryButton(login's submit button with a bouncing-dot loading state)ui/Input+ui/Buttonprimitives → no raw input/button, nobg-white(lint ratchet clean)Input, success ("Check your email") state; the hardened, rate-limitedrequestPasswordResetActionis preserved.getSession/exchangeCodeForSession/verifyOtp→verifying/ready/invalid),PasswordStrengthIndicator, match/mismatch affordances, anddanger-token error styling instead of raw red.Verification
tsc+eslintclean (0 warnings) on all 3 files🤖 Generated with Claude Code