@poly-x/next 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/server.cjs

@@ -160,10 +160,55 @@ function createAuthHandlers(handlersConfig = {}) {
 			await client.setPassword({
 				userId: proof.userId,
 				newPassword,
-				confirmPassword
+				confirmPassword,
+				ticket: proof.ticket
 			});
 			return attempt(newPassword);
 		},
+		async forgotPassword(request) {
+			const config = resolveNextConfig(handlersConfig);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const email = typeof payload.email === "string" ? payload.email.trim() : "";
+			if (!email) return Response.json({ status: "invalid_request" }, { status: 400 });
+			try {
+				await buildServerAuthClient(config).requestPasswordReset({ email });
+			} catch {}
+			return Response.json({ status: "accepted" });
+		},
+		async resetPassword(request) {
+			const config = resolveNextConfig(handlersConfig);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const token = typeof payload.token === "string" ? payload.token : "";
+			const newPassword = typeof payload.newPassword === "string" ? payload.newPassword : "";
+			const confirmPassword = typeof payload.confirmPassword === "string" ? payload.confirmPassword : void 0;
+			if (!token) return Response.json({ status: "invalid_request" }, { status: 400 });
+			if (newPassword.length < MIN_PASSWORD_LENGTH) return Response.json({
+				status: "weak_password",
+				minLength: MIN_PASSWORD_LENGTH
+			}, { status: 400 });
+			if (confirmPassword !== void 0 && newPassword !== confirmPassword) return Response.json({ status: "password_mismatch" }, { status: 400 });
+			switch (await buildServerAuthClient(config).resetPassword({
+				token,
+				newPassword
+			})) {
+				case "ok": return Response.json({ status: "success" });
+				case "weak_password": return Response.json({
+					status: "weak_password",
+					minLength: MIN_PASSWORD_LENGTH
+				}, { status: 400 });
+				default: return Response.json({ status: "invalid_or_expired" }, { status: 400 });
+			}
+		},
 		async callback(request) {
 			const config = resolveNextConfig(handlersConfig);
 			const url = new URL(request.url);

package/dist/server.d.cts

@@ -80,10 +80,40 @@ interface AuthHandlers {
    * The browser never sees the code, the tokens, or the credentials after POST.
    */
   authenticate(request: Request): Promise<Response>;
+  /**
+   * The `<ForgotPassword/>` BFF endpoint: reads `{email}`, adds this app's publishable
+   * key, and asks poly-auth to email a reset link server-side. Always relays a uniform
+   * `accepted` — it never reveals whether the account exists.
+   */
+  forgotPassword(request: Request): Promise<Response>;
+  /**
+   * The `<ResetPassword/>` BFF endpoint: reads `{token, newPassword}` and redeems the
+   * opaque single-use token. `success` on completion; `invalid_or_expired` otherwise.
+   */
+  resetPassword(request: Request): Promise<Response>;
   callback(request: Request): Promise<Response>;
   refresh(request: Request): Promise<Response>;
   signout(request: Request): Promise<Response>;
 }
+/** The JSON the `forgotPassword` handler returns — always uniform (no enumeration). */
+type ForgotPasswordResult = {
+  status: "accepted";
+} | {
+  status: "invalid_request";
+};
+/** The JSON the `resetPassword` handler returns — the `<ResetPassword/>` form branches on `status`. */
+type ResetPasswordResult = {
+  status: "success";
+} | {
+  status: "weak_password";
+  minLength: number;
+} | {
+  status: "password_mismatch";
+} | {
+  status: "invalid_or_expired";
+} | {
+  status: "invalid_request";
+};
 /** The JSON the `authenticate` handler returns — the `<SignIn/>` form branches on `status`. */
 type AuthenticateResult = {
   status: "success";
@@ -109,4 +139,4 @@ type AuthenticateResult = {
 };
 declare function createAuthHandlers(handlersConfig?: AuthHandlersConfig): AuthHandlers;
 //#endregion
-export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, type NextServerConfig, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };
+export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, ForgotPasswordResult, type NextServerConfig, ResetPasswordResult, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };

package/dist/server.d.mts

@@ -80,10 +80,40 @@ interface AuthHandlers {
    * The browser never sees the code, the tokens, or the credentials after POST.
    */
   authenticate(request: Request): Promise<Response>;
+  /**
+   * The `<ForgotPassword/>` BFF endpoint: reads `{email}`, adds this app's publishable
+   * key, and asks poly-auth to email a reset link server-side. Always relays a uniform
+   * `accepted` — it never reveals whether the account exists.
+   */
+  forgotPassword(request: Request): Promise<Response>;
+  /**
+   * The `<ResetPassword/>` BFF endpoint: reads `{token, newPassword}` and redeems the
+   * opaque single-use token. `success` on completion; `invalid_or_expired` otherwise.
+   */
+  resetPassword(request: Request): Promise<Response>;
   callback(request: Request): Promise<Response>;
   refresh(request: Request): Promise<Response>;
   signout(request: Request): Promise<Response>;
 }
+/** The JSON the `forgotPassword` handler returns — always uniform (no enumeration). */
+type ForgotPasswordResult = {
+  status: "accepted";
+} | {
+  status: "invalid_request";
+};
+/** The JSON the `resetPassword` handler returns — the `<ResetPassword/>` form branches on `status`. */
+type ResetPasswordResult = {
+  status: "success";
+} | {
+  status: "weak_password";
+  minLength: number;
+} | {
+  status: "password_mismatch";
+} | {
+  status: "invalid_or_expired";
+} | {
+  status: "invalid_request";
+};
 /** The JSON the `authenticate` handler returns — the `<SignIn/>` form branches on `status`. */
 type AuthenticateResult = {
   status: "success";
@@ -109,4 +139,4 @@ type AuthenticateResult = {
 };
 declare function createAuthHandlers(handlersConfig?: AuthHandlersConfig): AuthHandlers;
 //#endregion
-export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, type NextServerConfig, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };
+export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, ForgotPasswordResult, type NextServerConfig, ResetPasswordResult, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };

package/dist/server.mjs

@@ -159,10 +159,55 @@ function createAuthHandlers(handlersConfig = {}) {
 			await client.setPassword({
 				userId: proof.userId,
 				newPassword,
-				confirmPassword
+				confirmPassword,
+				ticket: proof.ticket
 			});
 			return attempt(newPassword);
 		},
+		async forgotPassword(request) {
+			const config = resolveNextConfig(handlersConfig);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const email = typeof payload.email === "string" ? payload.email.trim() : "";
+			if (!email) return Response.json({ status: "invalid_request" }, { status: 400 });
+			try {
+				await buildServerAuthClient(config).requestPasswordReset({ email });
+			} catch {}
+			return Response.json({ status: "accepted" });
+		},
+		async resetPassword(request) {
+			const config = resolveNextConfig(handlersConfig);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const token = typeof payload.token === "string" ? payload.token : "";
+			const newPassword = typeof payload.newPassword === "string" ? payload.newPassword : "";
+			const confirmPassword = typeof payload.confirmPassword === "string" ? payload.confirmPassword : void 0;
+			if (!token) return Response.json({ status: "invalid_request" }, { status: 400 });
+			if (newPassword.length < MIN_PASSWORD_LENGTH) return Response.json({
+				status: "weak_password",
+				minLength: MIN_PASSWORD_LENGTH
+			}, { status: 400 });
+			if (confirmPassword !== void 0 && newPassword !== confirmPassword) return Response.json({ status: "password_mismatch" }, { status: 400 });
+			switch (await buildServerAuthClient(config).resetPassword({
+				token,
+				newPassword
+			})) {
+				case "ok": return Response.json({ status: "success" });
+				case "weak_password": return Response.json({
+					status: "weak_password",
+					minLength: MIN_PASSWORD_LENGTH
+				}, { status: 400 });
+				default: return Response.json({ status: "invalid_or_expired" }, { status: 400 });
+			}
+		},
 		async callback(request) {
 			const config = resolveNextConfig(handlersConfig);
 			const url = new URL(request.url);

package/dist/styles.css

@@ -339,6 +339,77 @@
 	opacity: 0.85;
 }
 
+/* --- Recovery confirmation states (ForgotPassword / ResetPassword) ------- */
+
+.polyx-signin__header--center {
+	align-items: center;
+	text-align: center;
+}
+
+.polyx-signin__status-icon {
+	display: inline-flex;
+	align-items: center;
+	justify-content: center;
+	width: 3rem;
+	height: 3rem;
+	margin-bottom: 0.25rem;
+	border-radius: 999px;
+}
+
+.polyx-signin__status-icon svg {
+	width: 1.5rem;
+	height: 1.5rem;
+}
+
+.polyx-signin__status-icon--brand {
+	color: var(--polyx-brand);
+	background: color-mix(in srgb, var(--polyx-brand) 12%, transparent);
+}
+
+.polyx-signin__status-icon--danger {
+	color: var(--polyx-danger);
+	background: var(--polyx-danger-bg);
+}
+
+/* The entered email, emphasized inside the confirmation copy. */
+.polyx-signin__email {
+	color: var(--polyx-fg);
+	font-weight: 600;
+	word-break: break-all;
+}
+
+/* Secondary text-link actions under a confirmation screen — quieter than the CTA. */
+.polyx-signin__actions {
+	display: flex;
+	flex-direction: column;
+	align-items: center;
+	gap: 0.75rem;
+	margin-top: 1.5rem;
+}
+
+.polyx-signin__link {
+	padding: 0;
+	font: inherit;
+	font-size: 0.875rem;
+	font-weight: 500;
+	color: var(--polyx-brand);
+	background: none;
+	border: none;
+	cursor: pointer;
+	text-decoration: none;
+}
+
+.polyx-signin__link:hover {
+	color: var(--polyx-brand-hover);
+	text-decoration: underline;
+}
+
+.polyx-signin__link:focus-visible {
+	outline: none;
+	border-radius: 2px;
+	box-shadow: 0 0 0 3px var(--polyx-ring);
+}
+
 /* --- Workspace picker ---------------------------------------------------- */
 
 .polyx-signin__tenants {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.7",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.5",
-    "@poly-x/react": "0.1.0-alpha.5"
+    "@poly-x/core": "0.1.0-alpha.7",
+    "@poly-x/react": "0.1.0-alpha.7"
   },
   "peerDependencies": {
     "next": ">=14",