@tribe-nest/forge 3.20.0 → 3.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tribe-nest/forge",
-  "version": "3.20.0",
+  "version": "3.21.0",
   "publishConfig": {
     "access": "public"
   },

package/src/data/queries/useAccountSettings.ts

@@ -69,13 +69,26 @@ export function useUpdateAccount() {
   });
 }
 
-/** Change the member's password. */
+/**
+ * Change the member's password.
+ *
+ * Tenant-scoped (`/public/sessions/password`), because that is where a fan's
+ * credential lives — see the note at the top of `useAuthActions.ts`. The global
+ * `/public/accounts/password` this used to call wrote a hash that login never
+ * reads: it returned 200, invalidated the session, and left the old password
+ * working.
+ *
+ * Requires an association-scoped session (the endpoint is behind
+ * `requireAssociation`). Every current login path mints one; a member still
+ * holding a pre-cutover account-scoped token gets a 401 and needs to sign in
+ * again — honest, where the old call was silently a no-op.
+ */
 export function useChangePassword() {
   const { client } = useForge();
 
   return useMutation<unknown, unknown, { currentPassword: string; newPassword: string }>({
     mutationFn: async (body) => {
-      const res = await client.put("/public/accounts/password", body);
+      const res = await client.put("/public/sessions/password", body);
       return res.data;
     },
   });

package/src/data/queries/useAuthActions.ts

@@ -2,26 +2,70 @@ import { useForge } from "../../provider/ForgeProvider";
 import { useMutation } from "@tanstack/react-query";
 
 // Stateless account actions (no session state) — kept out of PublicAuthContext.
+//
+// ## Why these hit `/public/sessions/*` and not `/public/accounts/*`
+//
+// A member's credential for a tenant lives on their `account_associations` row,
+// not on `accounts` — that is the hash `POST /public/sessions` checks at login
+// (see `resolveAssociationLogin` on the backend). `accounts.password` is the
+// CREATOR/admin-dashboard credential; for a fan it is at most a lazy-heal
+// fallback, gated on the account having some other relationship to the profile.
+//
+// These three calls used to point at the global `/public/accounts/*` endpoints,
+// which write `accounts.password`. Every one of them returned 200 and changed
+// nothing that login reads:
+//
+//   - "Change password" logged the member out (a credential change invalidates
+//     sessions), then refused the new password and kept accepting the old one.
+//   - "Forgot password" was worse: it reset a hash login never consults, so the
+//     member — who by definition no longer knows the old password — was locked
+//     out with a reset link that appeared to work.
+//
+// The tenant-scoped endpoints below are the ones the credential actually lives
+// behind, and they invalidate only this context's sessions.
 
-/** Request a password-reset email. */
+/**
+ * Request a password-reset email for this tenant.
+ *
+ * `profileId` comes from the provider (one deploy = one tenant); pass it
+ * explicitly only when rendering outside a pinned context.
+ */
 export function useForgotPassword() {
-  const { client } = useForge();
+  const { client, profileId } = useForge();
 
-  return useMutation<unknown, unknown, { email: string; origin?: string }>({
-    mutationFn: async ({ email, origin }) => {
-      const res = await client.post("/public/accounts/forgot-password", { email, origin });
+  return useMutation<unknown, unknown, { email: string; origin?: string; profileId?: string }>({
+    mutationFn: async ({ email, origin, profileId: overrideProfileId }) => {
+      const contextId = overrideProfileId ?? profileId;
+      if (!contextId) {
+        // Better than posting without it: the endpoint would 400 on schema
+        // validation and the form would show "something went wrong".
+        throw new Error("useForgotPassword: no profileId — pass one or render inside a ForgeProvider with profileId");
+      }
+      const res = await client.post("/public/sessions/forgot-password", {
+        profileId: contextId,
+        email,
+        // The reset link is built server-side from this, and the association
+        // endpoint requires it (the global one treated it as optional).
+        origin: origin ?? (typeof window !== "undefined" ? window.location.origin : undefined),
+      });
       return res.data;
     },
   });
 }
 
-/** Complete a password reset with the emailed token. */
+/**
+ * Complete a password reset with the emailed token.
+ *
+ * The token is looked up on the association row, so it must be redeemed against
+ * the same surface that issued it — a token minted by the hook above will not
+ * resolve on `/public/accounts/reset-password`, and vice versa.
+ */
 export function useResetPassword() {
   const { client } = useForge();
 
   return useMutation<unknown, unknown, { token: string; password: string }>({
     mutationFn: async ({ token, password }) => {
-      const res = await client.post("/public/accounts/reset-password", { token, password });
+      const res = await client.post("/public/sessions/reset-password", { token, password });
       return res.data;
     },
   });