@checkstack/auth-backend 0.4.21 → 0.4.22

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @checkstack/auth-backend
 
+## 0.4.22
+
+### Patch Changes
+
+- 32d52c6: Fix and improve password reset flow + email branding:
+
+  - **Fix**: password reset emails were failing with "Malformed password reset URL: missing token parameter". Better-auth puts the reset token in the URL path (`/reset-password/{token}`), not as a `?token=` query param, so the previous URL-parsing logic always failed. Now uses the `token` argument better-auth passes to `sendResetPassword` directly.
+  - **UX**: the reset password page now validates the token on load via a new anonymous `validateResetToken` endpoint, so users see "Invalid Link" / "Link Expired" before typing a password rather than after submitting. Tokens are 24-char nanoid-style values (~143 bits of entropy), so exposing validity does not enable enumeration.
+  - **Fix**: transactional notifications were hardcoded to `importance: "critical"`, causing password reset emails to display a misleading "CRITICAL" badge. The `sendTransactional` contract now accepts an optional `importance` field that defaults to `"info"`.
+  - **Branding**: redesigned the email layout (`wrapInEmailLayout`) with a Checkstack-style engineering aesthetic — dark header with grid pattern, monospace importance badge, hardened CTA button (Outlook VML fallback + explicit text color), and force-light color scheme to prevent client auto-inversion from breaking text legibility.
+
+- Updated dependencies [32d52c6]
+- Updated dependencies [32d52c6]
+- Updated dependencies [32d52c6]
+- Updated dependencies [32d52c6]
+- Updated dependencies [32d52c6]
+  - @checkstack/notification-common@1.0.0
+  - @checkstack/backend-api@0.14.0
+  - @checkstack/auth-common@0.6.4
+  - @checkstack/command-backend@0.1.22
+
 ## 0.4.21
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-backend",
-  "version": "0.4.21",
+  "version": "0.4.22",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
@@ -15,9 +15,9 @@
   },
   "dependencies": {
     "@checkstack/auth-common": "0.6.3",
-    "@checkstack/backend-api": "0.13.0",
-    "@checkstack/notification-common": "0.2.9",
-    "@checkstack/command-backend": "0.1.20",
+    "@checkstack/backend-api": "0.13.1",
+    "@checkstack/notification-common": "0.3.0",
+    "@checkstack/command-backend": "0.1.21",
     "better-auth": "^1.4.7",
     "drizzle-orm": "^0.45.0",
     "hono": "^4.12.14",
@@ -31,6 +31,7 @@
     "@checkstack/scripts": "0.1.2",
     "@checkstack/tsconfig": "0.0.5",
     "@types/node": "^20.0.0",
+    "drizzle-kit": "^0.31.10",
     "typescript": "^5.0.0"
   }
 }

package/src/index.ts

@@ -651,22 +651,12 @@ export default createBackendPlugin({
               disableSignUp: !registrationAllowed,
               minPasswordLength: 8,
               maxPasswordLength: 128,
-              sendResetPassword: async ({ user, url }) => {
+              sendResetPassword: async ({ user, token }) => {
                 // Send password reset notification via all enabled strategies
                 // Using void to prevent timing attacks revealing email existence
                 const notificationClient = rpcClient.forPlugin(NotificationApi);
-                const frontendUrl = baseUrl;
-                // SECURITY: Use URL parsing instead of brittle string splitting
-                const parsedUrl = new URL(url);
-                const resetToken = parsedUrl.searchParams.get("token");
-                if (!resetToken) {
-                  throw new APIError("BAD_REQUEST", {
-                    message:
-                      "Malformed password reset URL: missing token parameter",
-                  });
-                }
-                const resetUrl = `${frontendUrl}/auth/reset-password?token=${encodeURIComponent(
-                  resetToken,
+                const resetUrl = `${baseUrl}/auth/reset-password?token=${encodeURIComponent(
+                  token,
                 )}`;
 
                 void notificationClient.sendTransactional({

package/src/router.ts

@@ -665,6 +665,26 @@ export const createAuthRouter = (
   // ONBOARDING ENDPOINTS
   // ==========================================================================
 
+  const validateResetToken = os.validateResetToken.handler(
+    async ({ input }) => {
+      const [record] = await internalDb
+        .select({ expiresAt: schema.verification.expiresAt })
+        .from(schema.verification)
+        .where(
+          eq(schema.verification.identifier, `reset-password:${input.token}`),
+        )
+        .limit(1);
+
+      if (!record) {
+        return { valid: false, reason: "invalid" as const };
+      }
+      if (record.expiresAt.getTime() <= Date.now()) {
+        return { valid: false, reason: "expired" as const };
+      }
+      return { valid: true };
+    },
+  );
+
   const getOnboardingStatus = os.getOnboardingStatus.handler(async () => {
     // Check if any users exist in the database
     const users = await internalDb
@@ -1942,6 +1962,7 @@ export const createAuthRouter = (
     setRegistrationStatus,
     getOnboardingStatus,
     completeOnboarding,
+    validateResetToken,
     getCurrentUserProfile,
     updateCurrentUser,
     getAnonymousAccessRules,