fix(auth): enforce email verification and fix password recovery flow

app/auth/callback/route.ts

@@ -6,38 +6,31 @@ import type { NextRequest } from "next/server"
 export async function GET(request: NextRequest) {
   const requestUrl = new URL(request.url)
   const code = requestUrl.searchParams.get("code")
+  const type = requestUrl.searchParams.get("type")
+
+  // For password recovery, pass the code to the client so it can exchange it
+  // directly — this triggers the PASSWORD_RECOVERY auth event client-side,
+  // which is required to gate the reset form properly.
+  if (type === "recovery" && code) {
+    return NextResponse.redirect(`${requestUrl.origin}/reset-password?code=${code}`)
+  }
 
   if (code) {
     const cookieStore = cookies()
     const supabase = createRouteHandlerClient({ cookies: () => cookieStore })
-    
+
     try {
-      // Exchange the code for a session
       await supabase.auth.exchangeCodeForSession(code)
-
-      // Check if this is an email verification
-      const type = requestUrl.searchParams.get("type")
-
+
       if (type === "email_confirmation") {
-        // Email verification - redirect to login with success message
-        return NextResponse.redirect(`https://intaroomv2.vercel.app/login?verified=true`)
-      }
-
-      if (type === "recovery") {
-        // Password recovery - redirect to reset password page
-        return NextResponse.redirect(`https://intaroomv2.vercel.app/reset-password`)
+        return NextResponse.redirect(`${requestUrl.origin}/login?verified=true`)
       }
-
-      // Regular auth callback - redirect to main app
-      return NextResponse.redirect(`https://intaroomv2.vercel.app/`)
-
-    } catch (error) {
-      console.error("Auth callback error:", error)
-      // If there's an error, redirect to login with error parameter
-      return NextResponse.redirect(`https://intaroomv2.vercel.app/login?error=auth_callback_failed`)
+
+      return NextResponse.redirect(`${requestUrl.origin}/`)
+    } catch {
+      return NextResponse.redirect(`${requestUrl.origin}/login?error=auth_callback_failed`)
     }
   }
 
-  // No code provided - redirect to login
-  return NextResponse.redirect(`https://intaroomv2.vercel.app/login?error=missing_auth_code`)
+  return NextResponse.redirect(`${requestUrl.origin}/login?error=missing_auth_code`)
 }

app/forgot-password/page.tsx

@@ -7,26 +7,22 @@ import { createClientComponentClient } from "@supabase/auth-helpers-nextjs"
 import Link from "next/link"
 import { supabaseUrl, supabaseAnonKey } from "@/app/env"
 
+const supabase = createClientComponentClient({ supabaseUrl, supabaseKey: supabaseAnonKey })
+
 export default function ForgotPasswordPage() {
   const [email, setEmail] = useState("")
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [success, setSuccess] = useState(false)
 
-  // Initialize Supabase client with explicit URL and key
-  const supabase = createClientComponentClient({
-    supabaseUrl,
-    supabaseKey: supabaseAnonKey,
-  })
-
   const handleResetPassword = async (e: React.FormEvent) => {
     e.preventDefault()
     setError(null)
     setLoading(true)
 
     try {
       const { error } = await supabase.auth.resetPasswordForEmail(email, {
-        redirectTo: `${window.location.origin}/reset-password`,
+        redirectTo: `${window.location.origin}/auth/callback?type=recovery`,
       })
 
       if (error) throw error
@@ -53,7 +49,6 @@ export default function ForgotPasswordPage() {
             <div className="bg-green-500/20 border border-green-500 text-white p-4 rounded-lg mb-6">
               <p className="text-center">Password reset email sent. Please check your inbox.</p>
             </div>
-
             <div className="text-center">
               <Link
                 href="/login"
@@ -66,16 +61,14 @@ export default function ForgotPasswordPage() {
         ) : (
           <form onSubmit={handleResetPassword}>
             <div className="space-y-4">
-              <div>
-                <input
-                  type="email"
-                  placeholder="Email"
-                  value={email}
-                  onChange={(e) => setEmail(e.target.value)}
-                  className="w-full px-4 py-3 rounded-full bg-transparent border border-white/30 text-white placeholder:text-white/70 focus:outline-none focus:border-white/50"
-                  required
-                />
-              </div>
+              <input
+                type="email"
+                placeholder="Email"
+                value={email}
+                onChange={(e) => setEmail(e.target.value)}
+                className="w-full px-4 py-3 rounded-full bg-transparent border border-white/30 text-white placeholder:text-white/70 focus:outline-none focus:border-white/50"
+                required
+              />
 
               <button
                 type="submit"
@@ -84,15 +77,15 @@ export default function ForgotPasswordPage() {
               >
                 {loading ? "Sending..." : "Reset Password"}
               </button>
+
+              <div className="text-center text-sm text-white">
+                <Link href="/login" className="hover:underline">
+                  Back to Login
+                </Link>
+              </div>
             </div>
           </form>
         )}
-
-        <div className="mt-4 text-center text-sm text-white">
-          <Link href="/login" className="hover:underline">
-            Back to Login
-          </Link>
-        </div>
       </div>
     </div>
   )