@checkstack/auth-common 0.6.3 → 0.6.4

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @checkstack/auth-common
 
+## 0.6.4
+
+### Patch Changes
+
+- 32d52c6: Fix and improve password reset flow + email branding:
+
+  - **Fix**: password reset emails were failing with "Malformed password reset URL: missing token parameter". Better-auth puts the reset token in the URL path (`/reset-password/{token}`), not as a `?token=` query param, so the previous URL-parsing logic always failed. Now uses the `token` argument better-auth passes to `sendResetPassword` directly.
+  - **UX**: the reset password page now validates the token on load via a new anonymous `validateResetToken` endpoint, so users see "Invalid Link" / "Link Expired" before typing a password rather than after submitting. Tokens are 24-char nanoid-style values (~143 bits of entropy), so exposing validity does not enable enumeration.
+  - **Fix**: transactional notifications were hardcoded to `importance: "critical"`, causing password reset emails to display a misleading "CRITICAL" badge. The `sendTransactional` contract now accepts an optional `importance` field that defaults to `"info"`.
+  - **Branding**: redesigned the email layout (`wrapInEmailLayout`) with a Checkstack-style engineering aesthetic — dark header with grid pattern, monospace importance badge, hardened CTA button (Outlook VML fallback + explicit text color), and force-light color scheme to prevent client auto-inversion from breaking text legibility.
+
 ## 0.6.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-common",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "type": "module",
   "exports": {
     ".": {
@@ -9,7 +9,7 @@
     }
   },
   "dependencies": {
-    "@checkstack/common": "0.6.5",
+    "@checkstack/common": "0.7.0",
     "@orpc/contract": "^1.13.14",
     "zod": "^4.0.0"
   },

package/src/rpc-contract.ts

@@ -152,6 +152,19 @@ export const authContract = {
     )
     .output(z.object({ success: z.boolean() })),
 
+  validateResetToken: proc({
+    operationType: "query",
+    userType: "anonymous",
+    access: [],
+  })
+    .input(z.object({ token: z.string().min(1).max(128) }))
+    .output(
+      z.object({
+        valid: z.boolean(),
+        reason: z.enum(["invalid", "expired"]).optional(),
+      }),
+    ),
+
   // ==========================================================================
   // AUTHENTICATED ENDPOINTS (userType: "authenticated")
   // ==========================================================================