@plutocms/supabase 0.0.1-alpha.8 → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,98 @@
+# Changelog
+
+## [0.1.0](https://github.com/plutocms/supabase/compare/v0.0.1-alpha.17...v0.1.0) (2026-09-03)
+
+
+### Features
+
+* add @plutocms/pluto ([1a324df](https://github.com/plutocms/supabase/commit/1a324dfa810f80f1628f30cbd68099b57f5c8edc))
+* add account verification page with success message and navigation to dashboard ([e2ad283](https://github.com/plutocms/supabase/commit/e2ad283b1f909c3726b9a35b370239394611a405))
+* add authentication pages for login and signup ([19dc7ee](https://github.com/plutocms/supabase/commit/19dc7ee8593615d10853bea8eeeb2fa653e621d5))
+* add cookie alias in nuxt configuration and remove overrides from package.json ([6d825b9](https://github.com/plutocms/supabase/commit/6d825b98b6b4b8c26a34904c13b851115578b81c))
+* add default formatter and format on save settings for Vue and Tailwind CSS ([4227a8c](https://github.com/plutocms/supabase/commit/4227a8c66522377fcc3ee087a2a53d471aefd410))
+* add generateSupabaseTypes function and integrate it into nuxt config hooks ([566a249](https://github.com/plutocms/supabase/commit/566a2490646cc736b74c160a78a11e73f435c1a6))
+* add GitHub Actions workflow for release automation ([ad44026](https://github.com/plutocms/supabase/commit/ad44026ede875ae4987637a9086817867618b436))
+* add NavbarAdmin component with user settings and navigation links ([6f41c20](https://github.com/plutocms/supabase/commit/6f41c201aa925946a94153765d452b1fa0adcee2))
+* add nitro externals configuration for supabase-js ([cc48bc1](https://github.com/plutocms/supabase/commit/cc48bc1cf44d1d8d22e407624965ff0cc26de2c2))
+* add read access policy for profiles table ([f1dec29](https://github.com/plutocms/supabase/commit/f1dec291280e89963ee7a10b53ab09b87aa49d8d))
+* add setup wizard for supabase DB configuration ([432ac3a](https://github.com/plutocms/supabase/commit/432ac3a07dccf80bb1e71a0b423862a4f2435e8e))
+* add supabase types for database schema and operations ([7641086](https://github.com/plutocms/supabase/commit/764108666b0f80c49432f792c56f5e79ef88fc41))
+* add user API endpoints for fetching profiles ([53bfbe8](https://github.com/plutocms/supabase/commit/53bfbe87f51311eec2a95bc644d6cae58e20dd7f))
+* added `plutocms/utils` layer ([2e37ec7](https://github.com/plutocms/supabase/commit/2e37ec7513b9e72be4b5b776dac88482531a95d7))
+* added auth middleware moved from core layer ([d8a1260](https://github.com/plutocms/supabase/commit/d8a12606c4ce667284691dd33e919ee7a81833e9))
+* added base setup layout ([7a4a95d](https://github.com/plutocms/supabase/commit/7a4a95da1cc27bcdf3966752c00e81beffc27463))
+* added settings and media pages ([b7e079e](https://github.com/plutocms/supabase/commit/b7e079eb1325e56ef10b1998d4e5f15805d4db51))
+* added sidebar actions ([e156c95](https://github.com/plutocms/supabase/commit/e156c95ef792928ce0c0a7ab9a0d8b7789643963))
+* **agent:** added `supabase-postgres-best-practices` skill ([7dcf5e7](https://github.com/plutocms/supabase/commit/7dcf5e71094618aaa32fbb77ab3f3114b0ea8492))
+* **agent:** added antfu/nuxt and nuxt/ui skills ([a7d7d41](https://github.com/plutocms/supabase/commit/a7d7d4124e181b61a1fd17fefe46d7088759dc8b))
+* allow access to /admin/confirm route for unauthenticated users ([5420f3a](https://github.com/plutocms/supabase/commit/5420f3a33154f6a47133373cfe7fc1b4ee48d75a))
+* allow overriding the pluto and utils layer paths via env vars ([f1bc3bf](https://github.com/plutocms/supabase/commit/f1bc3bfee5a73fdc79a0c97d7076d0a8eaf223c7))
+* **auth:** added signup API endpoint to /api/auth ([7a70396](https://github.com/plutocms/supabase/commit/7a70396ef3723a6750a950ee4fd89fadfb2fa824))
+* **auth:** forgot password ([5a0dea9](https://github.com/plutocms/supabase/commit/5a0dea9a5bb8892bb564bae4243a47ee8d7af4b4))
+* **auth:** implement password reset flow with PKCE code exchange ([26efcff](https://github.com/plutocms/supabase/commit/26efcffbbc40a7c96b072447111563a82b99484f))
+* **config:** remove TypeScript error suppression for Supabase module in development mode ([8388dfa](https://github.com/plutocms/supabase/commit/8388dfa51ccf57a66083510226924bbcc62e6e45))
+* created `supabase-storage` layer ([0cb46f6](https://github.com/plutocms/supabase/commit/0cb46f63bbbd0c3f826c22373c22cc6b16e28c5c))
+* **database:** add healthcheck type and update settings enums ([5db65c5](https://github.com/plutocms/supabase/commit/5db65c54090058e7138ceaa58932462d3de92be0))
+* **database:** update healthcheck structure with config_name and config_value ([9b8258e](https://github.com/plutocms/supabase/commit/9b8258ef7e41314932d8a42270088dc01fd5aaf4))
+* **deps:** added `postgres` ([047ed55](https://github.com/plutocms/supabase/commit/047ed556312b8853e6a54ebb5088f62f555e80f4))
+* enhance CI and release workflows with improved checks and configurations ([09c32a1](https://github.com/plutocms/supabase/commit/09c32a1e507a3b531cdc09b8185f6f978f3ab689))
+* enhance settings and profiles schema with enum type and additional policies ([c2cd441](https://github.com/plutocms/supabase/commit/c2cd441dff521e32e7a90b419e73a4f9cd964c0b))
+* enhance signup and auth flows with user feedback toasts for success and error messages ([3c66b5e](https://github.com/plutocms/supabase/commit/3c66b5e5dba8c8938971588b5791d1bef2b72e83))
+* enhance signup flow with email verification message and user guidance ([de762bf](https://github.com/plutocms/supabase/commit/de762bf1b7e3d9c933ad7f6d0e9a2adb577b7124))
+* **eslint:** update ESLint rules for Vue component formatting ([cf056de](https://github.com/plutocms/supabase/commit/cf056de70462ee20ac37fcc048bf8dbfe6183e47))
+* extend nuxt configuration with plutocms/utils ([c00445d](https://github.com/plutocms/supabase/commit/c00445d497a171c0a7805fa652bfeb1b17e36f5c))
+* get route middleware conditions from a single source ([4046518](https://github.com/plutocms/supabase/commit/4046518128486e96a125080aba96f6141c630a7d))
+* implement admin account creation in setup wizard and update signup process ([220e864](https://github.com/plutocms/supabase/commit/220e86493728df98ddff93b32985680fa883726d))
+* implement pluto migrations module with schema tracking and migration execution ([a778055](https://github.com/plutocms/supabase/commit/a778055b5de12e73dc69ab9fe4a99f267f83f886))
+* import domainFromUrl in NavbarAdmin component ([772490a](https://github.com/plutocms/supabase/commit/772490a4c6f4522d6932e5121bd105ab7f48ef00))
+* improved typecheck ([54f333b](https://github.com/plutocms/supabase/commit/54f333bd99e34f04b308ea4340a03b187a605091))
+* improved typecheck ([69c2ef9](https://github.com/plutocms/supabase/commit/69c2ef914221dd70508708eb7fd38855a89745ff))
+* make email, username, display name, password, and confirm password fields required in signup form ([8e63080](https://github.com/plutocms/supabase/commit/8e6308058724bf0a8a93c5381c6cfccd979bc517))
+* pass route to `useAuth` for improved navigation ([e6a911a](https://github.com/plutocms/supabase/commit/e6a911a2a0c258c4b9271c019ee706952d1cef1d))
+* restructure nuxt configuration for development and production environments ([0831553](https://github.com/plutocms/supabase/commit/08315533b991adbc3c806866177320eb71c90424))
+* **schema:** refactor healthcheck logic by creating a dedicated table and enum type ([c6b9758](https://github.com/plutocms/supabase/commit/c6b975889628b48c3558adf1f5b7877f7de77aae))
+* **schema:** refactor settings and create dedicated healthcheck table ([1adf585](https://github.com/plutocms/supabase/commit/1adf5855ae69204afe14905cc814e2cffbf67c12))
+* **setup:** add connection string input to setup wizard and update API payload ([0696957](https://github.com/plutocms/supabase/commit/0696957d3e4741cb42248b6ec47c04959ffda084))
+* **setup:** implement first-time-setup-check ([8963510](https://github.com/plutocms/supabase/commit/8963510b6ea81bc2485140d941779b469fda043b))
+* Supabase DB Setup Wizard ([b452aa7](https://github.com/plutocms/supabase/commit/b452aa783d742e639bba48de8ef3cfdce21d47bd))
+* update database schema with new healthcheck and pluto_migrations tables, and adjust enums ([0a69684](https://github.com/plutocms/supabase/commit/0a696845a049af6422a148195728ef58efda398e))
+* update ESLint configuration to ignore markdown files and additional directories ([9fb56c2](https://github.com/plutocms/supabase/commit/9fb56c26be93c0cb319f5f0138592fda88249694))
+* update nuxt configuration for improved environment handling and module management ([8a61ebc](https://github.com/plutocms/supabase/commit/8a61ebcc4b2e73ca9185856bd2a0972cf7235969))
+* update signup process to use username and display name, and improve admin account handling ([af07ade](https://github.com/plutocms/supabase/commit/af07ade3416554c5870a2bef5caf82b4a263a807))
+
+
+### Bug Fixes
+
+* add update policy for authenticated users on healthcheck and update profiles table structure ([12e2b35](https://github.com/plutocms/supabase/commit/12e2b353951fdde92b44ce5d207dcd2bc0f2414f))
+* added condition to auth middleware ([5d8ca9c](https://github.com/plutocms/supabase/commit/5d8ca9caac2d4f85b8eb496ae3f99d95df7b220b))
+* auto-install pluto layer dependencies ([7aa4afe](https://github.com/plutocms/supabase/commit/7aa4afe1c873b423a8924e410cb00ef4bd09268e))
+* better Signup flow ([b1253bb](https://github.com/plutocms/supabase/commit/b1253bb122f6bd068895323aa2fca6cd934bede6))
+* call password reset on the client-side ([86afa79](https://github.com/plutocms/supabase/commit/86afa792fe8a0f153ff2bca8ece243c849ed15b0))
+* change log level from success to info when generating Supabase types ([e664c00](https://github.com/plutocms/supabase/commit/e664c0076bacd644e1cd2233505ae9a20b3e82ca))
+* enhance SQL statement splitting and execution ([19434d5](https://github.com/plutocms/supabase/commit/19434d599306d36d82be2a231087044611efec09))
+* ensure enum types and policies are created only if they do not exist in schema.sql ([15c9ed8](https://github.com/plutocms/supabase/commit/15c9ed80571fd039463f8997ae607ce37eec6786))
+* ensure success property is typed as const in healthcheck response ([dc54a8e](https://github.com/plutocms/supabase/commit/dc54a8e2d3620c831001148ca64d2182d95c8b97))
+* extend pluto core layer ([2344a49](https://github.com/plutocms/supabase/commit/2344a4903ec7d5a8f51afc130bf2c78539f2937e))
+* handle error response for healthcheck settings retrieval ([4c2eb37](https://github.com/plutocms/supabase/commit/4c2eb37af2b104626696e2ea8ff08aaa4901e9d7))
+* handle sign-up errors and return user data on successful registration ([8f22de1](https://github.com/plutocms/supabase/commit/8f22de1d90affff5b72febf6bc5f240c35c7357a))
+* improve conditional checks in setup-check middleware ([a54d9cf](https://github.com/plutocms/supabase/commit/a54d9cfe59ba9001b1d9160ca0b16a7dd08cd596))
+* improve type definition for route in auth middleware ([c34632b](https://github.com/plutocms/supabase/commit/c34632b680e1e883f496e59201c6cec70412c510))
+* prevent logout for users on the admin setup page ([2cc4f71](https://github.com/plutocms/supabase/commit/2cc4f71608f90c4c8fdb335ebb868e0caf4e0062))
+* redirect to Wizard if fetch fails ([5c679e3](https://github.com/plutocms/supabase/commit/5c679e31ed5e66704af3560c8c58213cb2222284))
+* refactor user and session handling in `useAuth` ([a3b4ac0](https://github.com/plutocms/supabase/commit/a3b4ac0f5df4b5d39a01bcad8e6481288144b9b4))
+* reorder import statements in typegen.ts for consistency ([1097e64](https://github.com/plutocms/supabase/commit/1097e64bfa47ee4b4624d813424b6f3a189edea2))
+* return the logout function on auth route middleware ([cbf138e](https://github.com/plutocms/supabase/commit/cbf138e404cdef54fa3ca14369ed057b4be35fba))
+* scan pluto layer components for tailwind class generation ([67c40d4](https://github.com/plutocms/supabase/commit/67c40d473b35e670714850a22a08dd684d423d71))
+* show display name and username, and enhance GitHub link label ([578a290](https://github.com/plutocms/supabase/commit/578a29058d2bf9d4d168c465287b10d9da59d452))
+* simplify enum type creation for settings and healthcheck in schema.sql ([fa7849b](https://github.com/plutocms/supabase/commit/fa7849bee6fd7cc87519e4f3e3c80c460f615a92))
+* streamline database setup logic and correct SQL update statement ([7b1e692](https://github.com/plutocms/supabase/commit/7b1e6929ba3fd43782f1d95108c4f25be56d0cfd))
+* update @plutocms/pluto and @plutocms/utils to latest alpha versions ([634d940](https://github.com/plutocms/supabase/commit/634d9403b5d7f670e20aa5a56cd7c71facd12d06))
+* update @plutocms/pluto to version 0.0.1-alpha.4 in package.json and bun.lock ([5b0c1d7](https://github.com/plutocms/supabase/commit/5b0c1d769ff619ead8513cf00a216b85172dc232))
+* update module extensions to use correct package format ([ec62068](https://github.com/plutocms/supabase/commit/ec620685728c7d0f8113c488d3fbc0e9b1299f5b))
+* update package name to include scope [@plutocms](https://github.com/plutocms) ([0e2ffc5](https://github.com/plutocms/supabase/commit/0e2ffc5b8eef3c6b52994cf2d391aca04283724d))
+* updated string utils path ([abcfbf3](https://github.com/plutocms/supabase/commit/abcfbf3143ef623984fc656dad988e2e23830ce1))
+
+
+### Miscellaneous Chores
+
+* **ci:** migrate to release-please for automated releases ([8c3b7e9](https://github.com/plutocms/supabase/commit/8c3b7e933a167cdafae5d24eab7c13a881d1eee7))

package/README.md

@@ -35,9 +35,7 @@ bun add @nuxtjs/supabase supabase
 ```ts
 // nuxt.config.ts
 export default defineNuxtConfig({
-  extends: [
-    ['github:plutocms/supabase', { install: true }],
-  ],
+  extends: [['github:plutocms/supabase', { install: true }]],
 })
 ```
 
@@ -55,7 +53,7 @@ The layer includes API routes for interacting with Supabase services, such as au
 
 - GET `/api/settings`
 - POST `/api/settings/update`
-- POST `/api/signup`
+- POST `/api/auth/signup`
 
 ### Types
 

package/app/assets/css/tailwind.css

@@ -0,0 +1,5 @@
+@import '@nuxt/ui' source(none);
+@import 'tailwindcss' source(none);
+
+@source '../../../node_modules/.c12/*/app/**';
+@source '@plutocms/pluto/app/**/*';

package/app/components/navbar/NavbarAdmin.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import type { DropdownMenuItem } from '@nuxt/ui'
+import { domainFromUrl } from '#imports'
 
 const host = useRequestURL().host
 
@@ -24,7 +25,7 @@ const maybeDevUrl = computed(() => {
 const items = ref<DropdownMenuItem[][]>([
   [
     {
-      label: `${user.value?.first_name} ${user.value?.last_name}` || '',
+      label: `${user.value?.display_name} (${user.value?.username})` || 'User',
       avatar: {
         icon: 'lucide:user',
         class: 'bg-green-600',
@@ -53,7 +54,7 @@ const items = ref<DropdownMenuItem[][]>([
 
   [
     {
-      label: 'GitHub',
+      label: 'Pluto on GitHub',
       icon: 'i-simple-icons-github',
       type: 'link',
       to: 'https://github.com/ojvribeiro/pluto',
@@ -135,7 +136,7 @@ defineShortcuts(extractShortcuts(items.value))
           <UDropdownMenu
             :items="items"
             :ui="{
-              content: 'w-48',
+              content: 'w-64',
             }"
             :modal="false"
           >
@@ -148,7 +149,7 @@ defineShortcuts(extractShortcuts(items.value))
                     root: 'rounded-xl',
                     icon: 'text-white text-lg',
                   }"
-                  :alt="user?.first_name || ''"
+                  :alt="user?.value?.display_name || 'User Avatar'"
                   size="sm"
                   icon="lucide:user"
                   class="bg-green-600"
@@ -157,7 +158,7 @@ defineShortcuts(extractShortcuts(items.value))
                 <span
                   class="light:text-zinc-800 text-sm font-bold dark:text-white"
                 >
-                  {{ user?.first_name }}
+                  {{ user?.display_name.split(' ')[0] || 'User' }}
                 </span>
               </div>
             </button>

package/app/composables/auth.ts

@@ -1,10 +1,15 @@
-import type { RouteLocationNormalizedGeneric } from 'vue-router'
+import type {
+  RouteLocationNormalizedGeneric,
+  RouteLocationRaw,
+} from 'vue-router'
 
 interface PlutoSupabaseAuthOptions {
   route?: RouteLocationNormalizedGeneric
 }
 
 export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
+  const toast = useToast()
+
   const supabase = useSupabaseClient()
   const supabaseSession = useSupabaseSession()
 
@@ -14,6 +19,15 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
   const isLoggedIn = computed<boolean>(() => !!supabaseSession.value)
   const isSubmitting = ref<boolean>(false)
 
+  const allowedUnauthenticatedPaths: RouteLocationRaw[] = [
+    '/admin/login',
+    '/admin/signup',
+    '/admin/confirm',
+    '/admin/setup',
+    '/admin/forgot-password',
+    '/admin/update-password',
+  ]
+
   interface LoginForm {
     email: string
     password: string
@@ -23,7 +37,7 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
     isSubmitting.value = true
 
     try {
-      const { error } = await supabase.auth.signInWithPassword({
+      const { data, error } = await supabase.auth.signInWithPassword({
         email: form.email,
         password: form.password,
       })
@@ -31,11 +45,34 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
       if (error) {
         console.error(`Error signing in user: ${error?.message}`)
 
+        toast.add({
+          title: 'Could not log in',
+          description: error?.message,
+          icon: 'lucide:circle-x',
+          color: 'error',
+        })
+
         isSubmitting.value = false
 
         return
       }
 
+      if (data.user && data.user.user_metadata.is_admin) {
+        // Set the first_setup flag in the healthcheck table to false
+        const { error: healthcheckError } = await supabase
+          .from('healthcheck')
+          .update({ config_value: 'false' })
+          .eq('config_name', 'first_setup')
+
+        if (healthcheckError) {
+          return {
+            success: false,
+            message: healthcheckError.message,
+            error: healthcheckError,
+          }
+        }
+      }
+
       return navigateTo(
         (authOptions?.route?.query.redirect as string) ?? '/admin/home'
       )
@@ -60,6 +97,12 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
 
     if (options?.showToast) {
       console.warn(`User logged out`)
+
+      toast.add({
+        title: 'Logged out successfully',
+        icon: 'lucide:check',
+        color: 'success',
+      })
     }
 
     if (options?.redirectTo) {
@@ -69,6 +112,82 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
     if (authOptions?.route && authOptions.route.path.startsWith('/admin')) {
       return navigateTo('/admin/login')
     }
+
+    return navigateTo('/admin/login')
+  }
+
+  async function requestPasswordReset(email: string) {
+    isSubmitting.value = true
+
+    try {
+      const { error } = await supabase.auth.resetPasswordForEmail(email, {
+        redirectTo: `${window.location.origin}/admin/update-password`,
+      })
+
+      if (error) {
+        toast.add({
+          title: 'Could not send reset email',
+          description: error.message,
+          icon: 'lucide:circle-x',
+          color: 'error',
+        })
+
+        return { success: false }
+      }
+
+      return { success: true }
+    } catch (error) {
+      toast.add({
+        title: 'Could not send reset email',
+        description:
+          error instanceof Error ? error.message : 'An unknown error occurred.',
+        icon: 'lucide:circle-x',
+        color: 'error',
+      })
+
+      return { success: false }
+    } finally {
+      isSubmitting.value = false
+    }
+  }
+
+  async function updatePassword(password: string) {
+    isSubmitting.value = true
+
+    try {
+      const { error } = await supabase.auth.updateUser({ password })
+
+      if (error) {
+        toast.add({
+          title: 'Could not update password',
+          description: error.message,
+          icon: 'lucide:circle-x',
+          color: 'error',
+        })
+
+        return { success: false }
+      }
+
+      toast.add({
+        title: 'Password updated successfully',
+        icon: 'lucide:check',
+        color: 'success',
+      })
+
+      return { success: true }
+    } catch (error) {
+      toast.add({
+        title: 'Could not update password',
+        description:
+          error instanceof Error ? error.message : 'An unknown error occurred.',
+        icon: 'lucide:circle-x',
+        color: 'error',
+      })
+
+      return { success: false }
+    } finally {
+      isSubmitting.value = false
+    }
   }
 
   return {
@@ -77,5 +196,8 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
     user,
     login,
     logout,
+    requestPasswordReset,
+    updatePassword,
+    allowedUnauthenticatedPaths,
   }
 }

package/app/middleware/auth.ts

@@ -1,9 +1,14 @@
+import type { RouteLocationNormalizedGeneric } from 'vue-router'
+
 export default defineNuxtRouteMiddleware(async (to, from) => {
-  const { isLoggedIn, logout } = await useAuth({ route: to })
+  const { isLoggedIn, logout, allowedUnauthenticatedPaths } = await useAuth({
+    route: to as RouteLocationNormalizedGeneric,
+  })
 
   if (
     isLoggedIn.value &&
-    (to.path === '/admin/login' || to.path === '/admin/signup')
+    allowedUnauthenticatedPaths.includes(to.path) &&
+    to.path !== '/admin/update-password'
   ) {
     return navigateTo(
       to.query.redirect
@@ -15,13 +20,15 @@ export default defineNuxtRouteMiddleware(async (to, from) => {
   if (
     !isLoggedIn.value &&
     to.path.startsWith('/admin') &&
-    to.path !== '/admin/signup' &&
-    to.path !== '/admin/login'
+    !allowedUnauthenticatedPaths.includes(to.path)
   ) {
     if (from.query.redirect) {
-      logout({ redirectTo: from.query.redirect as string, showToast: true })
+      return logout({
+        redirectTo: from.query.redirect as string,
+        showToast: true,
+      })
     } else {
-      logout()
+      return logout()
     }
   }
 })

package/app/middleware/setup-check.ts

@@ -1,32 +1,36 @@
-export default defineNuxtRouteMiddleware(async (to, from) => {
-  if (to.path !== '/admin/setup' && to.path.startsWith('/admin')) {
-    try {
-      const data = await $fetch('/api/settings/first_setup')
+export default defineNuxtRouteMiddleware(async (to, _from) => {
+  if (!to.path.startsWith('/admin')) {
+    return
+  }
 
-      if (!data.success) {
-        return navigateTo('/admin/setup')
-      }
+  try {
+    const data = await $fetch('/api/settings/first_setup')
 
-      if (
-        data.is_first_setup === true &&
-        from.path.startsWith('/admin') &&
-        to.path !== '/admin/setup'
-      ) {
+    if (!data.success) {
+      // Cannot determine setup state — send to setup page
+      if (to.path !== '/admin/setup') {
         return navigateTo('/admin/setup')
       }
+      return
+    }
 
-      if (
-        data.is_first_setup === false &&
-        from.path.startsWith('/admin') &&
-        to.path === '/admin/setup'
-      ) {
-        return navigateTo('/')
+    if (data.is_first_setup) {
+      // Setup not done yet — only allow the setup page
+      if (to.path !== '/admin/setup') {
+        return navigateTo('/admin/setup')
       }
-    } catch (error) {
-      if (import.meta.dev) {
-        console.error('Error checking first setup status:', error)
+    } else {
+      // Setup already done — block access to setup page
+      if (to.path === '/admin/setup') {
+        return navigateTo('/admin/login')
       }
+    }
+  } catch (error) {
+    if (import.meta.dev) {
+      console.error('Error checking first setup status:', error)
+    }
 
+    if (to.path !== '/admin/setup') {
       return navigateTo('/admin/setup')
     }
   }

package/app/pages/admin/(auth)/confirm.vue

@@ -0,0 +1,38 @@
+<script setup lang="ts">
+definePageMeta({
+  layout: 'auth',
+})
+
+useHead({
+  title: 'Account Verification',
+})
+</script>
+
+<template>
+  <div class="grid h-full place-items-center">
+    <UCard class="w-100">
+      <div class="space-y-6 py-10">
+        <div class="text-center space-y-4">
+          <hgroup class="flex flex-col gap-y-1">
+            <span class="text-5xl">
+              <UIcon name="lucide:mail-check" class="inline-block" />
+            </span>
+
+            <h1 class="text-3xl font-bold">Account verified!</h1>
+          </hgroup>
+
+          <p>
+            Your account has been successfully verified. You can now start using
+            the Dashboard.
+          </p>
+
+          <div class="flex items-center justify-center gap-x-4">
+            <UButton to="/admin" color="primary" icon="lucide:layout-dashboard">
+              Go to Dashboard
+            </UButton>
+          </div>
+        </div>
+      </div>
+    </UCard>
+  </div>
+</template>

package/app/pages/admin/(auth)/forgot-password.vue

@@ -0,0 +1,88 @@
+<script setup lang="ts">
+definePageMeta({
+  layout: 'auth',
+})
+
+useHead({
+  title: 'Forgot Password',
+})
+
+const { isSubmitting, requestPasswordReset } = await useAuth()
+
+const email = ref('')
+const isEmailSent = ref(false)
+
+async function submitForm() {
+  const result = await requestPasswordReset(email.value)
+
+  if (result.success) {
+    isEmailSent.value = true
+  }
+}
+</script>
+
+<template>
+  <div class="grid h-full place-items-center">
+    <UCard class="w-100">
+      <div v-if="isEmailSent" class="space-y-6 py-10">
+        <div class="text-center space-y-4">
+          <hgroup class="flex flex-col gap-y-1">
+            <span class="text-5xl">
+              <UIcon name="lucide:mail" class="inline-block" />
+            </span>
+
+            <h1 class="text-3xl font-bold">Check your inbox</h1>
+          </hgroup>
+
+          <p>
+            If an account exists for <strong>{{ email }}</strong
+            >, a password reset link has been sent. Check your email and follow
+            the link.
+          </p>
+
+          <div class="flex items-center justify-center">
+            <UButton variant="link" to="/admin/login" class="px-0">
+              Back to Login
+            </UButton>
+          </div>
+        </div>
+      </div>
+
+      <form v-else @submit.prevent="submitForm">
+        <div class="flex flex-col gap-y-6">
+          <hgroup class="flex flex-col gap-y-1">
+            <h1 class="text-3xl font-bold">Forgot Password</h1>
+            <p class="text-sm text-muted">
+              Enter your email and we'll send you a reset link.
+            </p>
+          </hgroup>
+
+          <UFormField label="Email">
+            <UInput
+              v-model="email"
+              placeholder="victor@example.com"
+              type="email"
+              class="w-full"
+              autocomplete="email"
+              required
+            />
+          </UFormField>
+
+          <div class="flex items-center justify-between gap-x-4">
+            <UFormField>
+              <UButton :loading="isSubmitting" type="submit" icon="lucide:send">
+                Send Reset Link
+              </UButton>
+            </UFormField>
+
+            <UFormField>
+              <UButton variant="link" to="/admin/login" class="px-0">
+                Back to Login
+              </UButton>
+            </UFormField>
+          </div>
+        </div>
+      </form>
+    </UCard>
+  </div>
+</template>

package/app/pages/admin/(auth)/login.vue

@@ -67,7 +67,7 @@ function submitForm() {
             </UFormField>
           </div>
 
-          <div>
+          <div class="flex items-center justify-between">
             <UButton
               variant="link"
               icon="lucide:arrow-left"
@@ -76,6 +76,10 @@ function submitForm() {
             >
               Back to Home
             </UButton>
+
+            <UButton variant="link" to="/admin/forgot-password" class="px-0">
+              Forgot password?
+            </UButton>
           </div>
         </div>
       </form>