create-ailk 0.5.0 → 0.6.1

package/templates/apps/web/app/[locale]/(auth)/__tests__/password-reset.test.tsx

@@ -0,0 +1,515 @@
+/**
+ * @file password-reset.test.tsx — AC-2's scorer (#5962).
+ *
+ * The three pages' branch matrix, rendered against a mocked `auth-env` — the
+ * idiom the sibling `auth-pages.test.tsx` and `sign-in/__tests__/page.test.tsx`
+ * already use.
+ *
+ * "Never a 404" is STRUCTURAL rather than asserted here: the three segments
+ * exist as files, so Next resolves them whatever the predicate says. What this
+ * suite asserts is that each resolves to a real card in every branch.
+ *
+ * The seventh case is the one a page-render assertion would miss entirely:
+ * `forgot-password-card` must pass a NON-EMPTY, ABSOLUTE `redirectTo`. Better
+ * Auth rejects an empty `callbackURL` on the token route, so without it every
+ * emitted reset link dead-ends at an error page while the page itself looks
+ * perfectly correct.
+ */
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+const mockIsResetAvailable = jest.fn();
+const mockResetSendConfigured = jest.fn();
+const mockGetActiveProviderIds = jest.fn();
+const mockIsSignUpOpen = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
+jest.mock("../../../../lib/auth-env", () => ({
+  __esModule: true,
+  getActiveProviderIds: () => mockGetActiveProviderIds(),
+  isSignUpOpen: () => mockIsSignUpOpen(),
+  isResetAvailable: () => mockIsResetAvailable(),
+  resetSendConfigured: () => mockResetSendConfigured(),
+}));
+
+const mockRequestPasswordReset = jest.fn();
+const mockResetPassword = jest.fn();
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({
+    requestPasswordReset: (...args: unknown[]) =>
+      mockRequestPasswordReset(...args),
+    resetPassword: (...args: unknown[]) => mockResetPassword(...args),
+    signIn: { social: jest.fn(), email: jest.fn() },
+  }),
+}));
+
+/**
+ * #6068 AC-1 exercises `createAuth()`'s `onPasswordReset` callback, so the
+ * three Better Auth entry points it touches are stubbed the way the sibling
+ * `apps/web/__tests__/auth/password-reset-config.test.ts` stubs them — the
+ * real ESM-only module never loads under the Jest CJS preset, and `betterAuth`
+ * returning `{ options }` is what makes the wired callback reachable at all.
+ */
+jest.mock("better-auth", () => ({
+  betterAuth: (options: unknown) => ({ options }),
+}));
+
+jest.mock("better-auth/adapters/prisma", () => ({
+  prismaAdapter: () => ({ id: "mock-prisma-adapter" }),
+}));
+
+jest.mock("better-auth/next-js", () => ({
+  nextCookies: () => ({ id: "next-cookies" }),
+}));
+
+/**
+ * The signer seam. `buildAuthEmailRequest` has exactly one external
+ * dependency — `node:crypto`'s `createHmac` — so a throwing `createHmac` is a
+ * throwing `buildAuthEmailRequest` reached through the real call path, with no
+ * stub standing in for the function under test. Every other member is the real
+ * one, and the default implementation below is the real `createHmac`, so only
+ * the case that opts in sees a failure.
+ */
+const mockCreateHmac = jest.fn();
+jest.mock("node:crypto", () => {
+  const actual = jest.requireActual("node:crypto");
+  return {
+    ...actual,
+    createHmac: (...args: unknown[]) => mockCreateHmac(...args),
+  };
+});
+
+import en from "../../../../messages/en.json";
+import { createAuth } from "../../../../auth";
+import ForgotPasswordPage from "../forgot-password/page";
+import ResetPasswordPage from "../reset-password/page";
+import { ResetPasswordCard } from "../reset-password/reset-password-card";
+import SignInPage from "../sign-in/page";
+import VerifyEmailPage from "../verify-email/page";
+
+const ORIGINAL_ENV = process.env;
+
+/** The slice of Better Auth's options object #6068 AC-1 reads. */
+type AuthOptionsUnderTest = {
+  emailAndPassword?: {
+    onPasswordReset?: (args: {
+      user: { id: string; email: string };
+    }) => Promise<void>;
+  };
+};
+
+/**
+ * `NonNullable` on BOTH levels, exactly as the sibling config suite does it:
+ * the inner one strips the `| undefined` off the optional `prisma` member,
+ * without which `exactOptionalPropertyTypes: true` rejects the assignment.
+ */
+type AuthPrisma = NonNullable<
+  NonNullable<Parameters<typeof createAuth>[0]>["prisma"]
+>;
+
+async function renderForgot(): Promise<void> {
+  render(await ForgotPasswordPage({ params: Promise.resolve({ locale: "en" }) }));
+}
+
+async function renderReset(
+  query: Record<string, string> = {},
+): Promise<void> {
+  render(
+    await ResetPasswordPage({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve(query),
+    }),
+  );
+}
+
+async function renderVerify(
+  query: Record<string, string> = {},
+): Promise<void> {
+  render(
+    await VerifyEmailPage({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve(query),
+    }),
+  );
+}
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV, BETTER_AUTH_URL: "https://site.example" };
+  jest.clearAllMocks();
+  mockIsResetAvailable.mockReturnValue(true);
+  mockResetSendConfigured.mockReturnValue(true);
+  mockGetActiveProviderIds.mockReturnValue(["email"]);
+  mockIsSignUpOpen.mockReturnValue(false);
+  mockRequestPasswordReset.mockResolvedValue({ data: {}, error: null });
+  mockResetPassword.mockResolvedValue({ data: {}, error: null });
+  // The real signer by default — only the #6068 case below makes it throw.
+  mockCreateHmac.mockImplementation((...args: unknown[]) =>
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- forwarding an untyped rest to the real overloaded builtin
+    (jest.requireActual("node:crypto") as any).createHmac(...args),
+  );
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+// ── The six states AC-2 names ───────────────────────────────────────────────
+
+describe("/forgot-password", () => {
+  it("renders the forgot form when reset is available", async () => {
+    await renderForgot();
+    expect(screen.getByTestId("auth-email")).toBeInTheDocument();
+  });
+
+  it("renders the not-available state — never a 404 — when it is not", async () => {
+    mockResetSendConfigured.mockReturnValue(false);
+    await renderForgot();
+    expect(screen.getByTestId("forgot-password-page")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.forgotUnavailableBody,
+    );
+    expect(screen.queryByTestId("auth-email")).not.toBeInTheDocument();
+  });
+});
+
+describe("/reset-password", () => {
+  it("renders the password fields when it carries a token", async () => {
+    await renderReset({ token: "tok_live" });
+    expect(screen.getByTestId("auth-password")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-confirm-password")).toBeInTheDocument();
+  });
+
+  it("renders the expired-token state — and NO password field — on ?error", async () => {
+    await renderReset({ error: "INVALID_TOKEN" });
+    expect(screen.getByTestId("reset-token-error")).toBeInTheDocument();
+    expect(
+      screen.getByRole("heading", { name: en.auth.resetExpiredHeading }),
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-password")).not.toBeInTheDocument();
+  });
+
+  it("renders its own not-available copy when reset is off", async () => {
+    mockResetSendConfigured.mockReturnValue(false);
+    await renderReset({ token: "tok_live" });
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.resetUnavailableBody,
+    );
+    expect(screen.queryByTestId("auth-password")).not.toBeInTheDocument();
+  });
+});
+
+describe("/verify-email", () => {
+  it("renders the sent terminus with no ?error", async () => {
+    await renderVerify();
+    expect(screen.getByTestId("auth-sent-body")).toBeInTheDocument();
+  });
+
+  it("renders the expired-token state on ?error", async () => {
+    await renderVerify({ error: "TOKEN_EXPIRED" });
+    expect(screen.getByTestId("verify-token-error")).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-sent-body")).not.toBeInTheDocument();
+  });
+});
+
+// ── The flag-alone configuration: intent set, send impossible ──────────────
+
+describe("the flag alone does not open either page", () => {
+  /**
+   * `AILK_AUTH_PASSWORD_RESET=1` with a send conjunct missing is a real
+   * deployment state, and it is the one a flag-only predicate reads as
+   * "available". On the request page that renders a live form whose only
+   * possible outcome is the error card; on the consume page it renders a live
+   * password field over a POST Better Auth still serves. Both pages key on
+   * `resetSendConfigured()` so neither can be reached in that state.
+   */
+  beforeEach(() => {
+    mockIsResetAvailable.mockReturnValue(true);
+    mockResetSendConfigured.mockReturnValue(false);
+  });
+
+  it("/forgot-password renders not-available, not the form", async () => {
+    await renderForgot();
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.forgotUnavailableBody,
+    );
+    expect(screen.queryByTestId("auth-email")).not.toBeInTheDocument();
+  });
+
+  it("/reset-password renders not-available even carrying a live token", async () => {
+    await renderReset({ token: "tok_live" });
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.resetUnavailableBody,
+    );
+    expect(screen.queryByTestId("auth-password")).not.toBeInTheDocument();
+  });
+});
+
+// ── The seventh case: the redirectTo a render assertion cannot see ──────────
+
+describe("the forgot island's requestPasswordReset call", () => {
+  it("passes a non-empty, ABSOLUTE, same-origin redirectTo", async () => {
+    const user = userEvent.setup();
+    await renderForgot();
+
+    await user.type(screen.getByTestId("auth-email"), "person@example.com");
+    await user.click(screen.getByTestId("auth-submit"));
+
+    await waitFor(() => expect(mockRequestPasswordReset).toHaveBeenCalled());
+    const [args] = mockRequestPasswordReset.mock.calls[0];
+    expect(args.email).toBe("person@example.com");
+    expect(args.redirectTo).toBe("https://site.example/reset-password");
+    // Absolute: originCheck compares an ORIGIN, and an empty callbackURL makes
+    // Better Auth reject the emitted link outright.
+    expect(args.redirectTo.startsWith("https://")).toBe(true);
+  });
+
+  it("swaps to the sent intent only on success", async () => {
+    const user = userEvent.setup();
+    await renderForgot();
+
+    await user.type(screen.getByTestId("auth-email"), "person@example.com");
+    await user.click(screen.getByTestId("auth-submit"));
+
+    await waitFor(() =>
+      expect(screen.getByTestId("auth-sent-body")).toBeInTheDocument(),
+    );
+  });
+
+  it("shows the error state — never 'check your email' — when the server refuses", async () => {
+    mockRequestPasswordReset.mockResolvedValue({
+      error: { code: "RESET_PASSWORD_DISABLED" },
+    });
+    const user = userEvent.setup();
+    await renderForgot();
+
+    await user.type(screen.getByTestId("auth-email"), "person@example.com");
+    await user.click(screen.getByTestId("auth-submit"));
+
+    await waitFor(() =>
+      expect(screen.getByText(en.auth.resetRequestFailed)).toBeInTheDocument(),
+    );
+    // The whole point: a site that cannot send never claims it did.
+    expect(screen.queryByTestId("auth-sent-body")).not.toBeInTheDocument();
+  });
+});
+
+describe("the reset island's resetPassword call", () => {
+  it("sends the token in the body and routes to sign-in on success", async () => {
+    // The island directly, so the post-reset navigation is observable —
+    // jsdom's `window.location` is read-only, which is why the component takes
+    // an injectable `navigate` at all.
+    const navigate = jest.fn();
+    const user = userEvent.setup();
+    render(
+      <ResetPasswordCard
+        token="tok_live"
+        signInHref="/sign-in"
+        labels={{
+          resetHeading: en.auth.resetHeading,
+          resetSubmit: en.auth.resetSubmit,
+          newPassword: en.auth.newPassword,
+          confirmPassword: en.auth.confirmPassword,
+          backToSignIn: en.auth.backToSignIn,
+        }}
+        errorLabels={{
+          resetFailed: en.auth.resetFailed,
+          invalidToken: en.auth.resetExpiredSubhead,
+          mismatch: en.auth.passwordMismatch,
+        }}
+        navigate={navigate}
+      />,
+    );
+
+    await user.type(screen.getByTestId("auth-password"), "a-long-enough-pw");
+    await user.type(
+      screen.getByTestId("auth-confirm-password"),
+      "a-long-enough-pw",
+    );
+    await user.click(screen.getByTestId("auth-submit"));
+
+    await waitFor(() => expect(mockResetPassword).toHaveBeenCalled());
+    expect(mockResetPassword.mock.calls[0][0]).toEqual({
+      newPassword: "a-long-enough-pw",
+      token: "tok_live",
+    });
+    await waitFor(() => expect(navigate).toHaveBeenCalledWith("/sign-in"));
+  });
+
+  it("refuses mismatched passwords without calling the server", async () => {
+    const user = userEvent.setup();
+    await renderReset({ token: "tok_live" });
+
+    await user.type(screen.getByTestId("auth-password"), "a-long-enough-pw");
+    await user.type(screen.getByTestId("auth-confirm-password"), "different-pw");
+    await user.click(screen.getByTestId("auth-submit"));
+
+    await waitFor(() =>
+      expect(screen.getByText(en.auth.passwordMismatch)).toBeInTheDocument(),
+    );
+    expect(mockResetPassword).not.toHaveBeenCalled();
+  });
+
+  it("treats an absent token as an expired one, and does not call the server", async () => {
+    const user = userEvent.setup();
+    await renderReset({});
+
+    await user.type(screen.getByTestId("auth-password"), "a-long-enough-pw");
+    await user.type(
+      screen.getByTestId("auth-confirm-password"),
+      "a-long-enough-pw",
+    );
+    await user.click(screen.getByTestId("auth-submit"));
+
+    await waitFor(() =>
+      expect(
+        screen.getByText(en.auth.resetExpiredSubhead),
+      ).toBeInTheDocument(),
+    );
+    expect(mockResetPassword).not.toHaveBeenCalled();
+  });
+});
+
+// ── #6068 AC-1: a throwing signer cannot reject onPasswordReset ─────────────
+
+/**
+ * The reset has ALREADY SUCCEEDED by the time `onPasswordReset` runs: the new
+ * password is written and the presented token is consumed. A rejection here is
+ * therefore not "the reset failed" — it is a 500 handed to a visitor whose
+ * password DID change, over a token they can no longer retry with.
+ *
+ * `sendPasswordChangedNotice` carries a "never throws by construction"
+ * invariant, and before #6068 that invariant had a hole: `dispatch()` built
+ * and SIGNED the request OUTSIDE its own try, so anything `buildAuthEmailRequest`
+ * threw propagated all the way out. #6061 made this callback unconditional, so
+ * it now runs in degraded configurations — exactly where a signer is most
+ * likely to be unhappy.
+ *
+ * The signer's one external dependency is `node:crypto`'s `createHmac`, so a
+ * throwing `createHmac` IS a throwing `buildAuthEmailRequest`, reached through
+ * the real call path rather than a stubbed-out seam.
+ */
+describe("onPasswordReset survives a throwing buildAuthEmailRequest (#6068)", () => {
+  const user = { id: "usr_reset", email: "person@example.com" };
+
+  function onPasswordResetUnderTest(deleteMany: jest.Mock): (args: {
+    user: { id: string; email: string };
+  }) => Promise<void> {
+    // `unknown` on the way in, exactly as the sibling config suite does it, so
+    // the stub needs ONE assertion rather than a double one.
+    const prismaStub: unknown = { verification: { deleteMany } };
+    const auth = createAuth({ prisma: prismaStub as AuthPrisma });
+    // The `betterAuth` mock above returns `{ options }` rather than a real
+    // instance, so the declared return type is not the runtime shape. There is
+    // no boundary type to fix: the double assertion IS the mock seam — the
+    // same seam, and the same justification, as the sibling config suite.
+    // eslint-disable-next-line no-restricted-syntax -- see above.
+    const { options } = auth as unknown as { options: AuthOptionsUnderTest };
+    const callback = options.emailAndPassword?.onPasswordReset;
+    // Guarded rather than asserted inline: without it the cases below would
+    // read `undefined(...)` and fail with a TypeError instead of a diagnosis.
+    if (!callback) throw new Error("onPasswordReset was not wired");
+    return callback;
+  }
+
+  beforeEach(() => {
+    // Past `dispatch()`'s `not_configured` early return — without a secret the
+    // signer is never reached and the case would pass vacuously.
+    process.env.AUTH_EMAIL_WEBHOOK_SECRET = "whsec_test";
+    process.env.AUTH_EMAIL_FROM = "noreply@site.example";
+    mockCreateHmac.mockImplementation(() => {
+      throw new Error("signer unavailable");
+    });
+  });
+
+  it("resolves rather than rejecting — the completed reset is not turned into a 500", async () => {
+    const deleteMany = jest.fn().mockResolvedValue({ count: 1 });
+    await expect(
+      onPasswordResetUnderTest(deleteMany)({ user }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("still consumes the user's other outstanding reset tokens", async () => {
+    const deleteMany = jest.fn().mockResolvedValue({ count: 2 });
+    await onPasswordResetUnderTest(deleteMany)({ user });
+    // The sibling invalidation runs BEFORE the notice, so a notice that threw
+    // would leave it done-but-unreported; what it may never do is leave the
+    // caller with a rejected promise over work that already landed.
+    expect(deleteMany).toHaveBeenCalledWith({
+      where: {
+        value: user.id,
+        identifier: { startsWith: "reset-password:" },
+      },
+    });
+  });
+});
+
+// ── #6068 AC-2: the flag-alone config, read through the REAL predicate ──────
+
+/**
+ * The sibling "the flag alone does not open either page" block above drives
+ * the two reset pages through the MOCKED predicate — it asserts the pages
+ * branch correctly once `resetSendConfigured()` has already answered false.
+ * This block asserts the answer itself, and the third affordance: with
+ * `AILK_AUTH_PASSWORD_RESET=1` and `AUTH_EMAIL_WEBHOOK_SECRET` unset — intent
+ * set, transport missing, every other conjunct satisfied — the REAL
+ * `resetSendConfigured()` is what decides, and `/sign-in` must render no
+ * "Forgot password?" link while `/forgot-password` renders its not-available
+ * card. A flag-keyed link in this state is the dangling link #6018 shipped to
+ * prevent and #6061 left behind on this one surface.
+ *
+ * The module mock stays (the two pages share it with the whole file); its
+ * members are re-bound here to `jest.requireActual`'s real implementations, so
+ * the env vars below — not a `mockReturnValue` — are what the pages read.
+ */
+describe("the flag alone hides the /sign-in forgot link (#6068 AC-2)", () => {
+  const realAuthEnv = jest.requireActual<
+    typeof import("../../../../lib/auth-env")
+  >("../../../../lib/auth-env");
+
+  beforeEach(() => {
+    mockIsResetAvailable.mockImplementation(() => realAuthEnv.isResetAvailable());
+    mockResetSendConfigured.mockImplementation(() =>
+      realAuthEnv.resetSendConfigured(),
+    );
+    mockGetActiveProviderIds.mockImplementation(() =>
+      realAuthEnv.getActiveProviderIds(),
+    );
+
+    // Every conjunct of `resetSendConfigured()` satisfied EXCEPT the send
+    // secret: the operator meant to offer reset and the relay cannot sign.
+    process.env.AILK_AUTH_PASSWORD_RESET = "1";
+    process.env.AUTH_EMAIL_SERVER = "smtp://mail.example";
+    process.env.AUTH_EMAIL_FROM = "noreply@site.example";
+    process.env.BETTER_AUTH_URL = "https://site.example";
+    process.env.BETTER_AUTH_SECRET = "test-secret";
+    delete process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+  });
+
+  it("is a state the two predicates genuinely disagree about", () => {
+    // Without this the two cases below could pass for the wrong reason — a
+    // config neither predicate calls available proves nothing about which one
+    // an affordance keys on.
+    expect(realAuthEnv.isResetAvailable()).toBe(true);
+    expect(realAuthEnv.resetSendConfigured()).toBe(false);
+  });
+
+  it("/sign-in renders the password form and NO forgot link", async () => {
+    render(
+      await SignInPage({
+        params: Promise.resolve({ locale: "en" }),
+        searchParams: Promise.resolve({}),
+      }),
+    );
+    // The card itself is live — this is a hidden affordance, not a dead page.
+    expect(screen.getByTestId("auth-password")).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-forgot")).toBeNull();
+  });
+
+  it("/forgot-password renders the not-available card", async () => {
+    await renderForgot();
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.forgotUnavailableBody,
+    );
+    expect(screen.queryByTestId("auth-email")).not.toBeInTheDocument();
+  });
+});

package/templates/apps/web/app/[locale]/(auth)/forgot-password/forgot-password-card.tsx

@@ -0,0 +1,89 @@
+"use client"; // Better Auth's client call (requestPasswordReset) + the sent/error state
+
+/**
+ * ForgotPasswordCard — `/forgot-password`'s client island (#5962).
+ *
+ * #5963 shipped this page as a static `forgot` intent with no `onSubmit`, so
+ * the form was a deliberate no-op. This island is what makes it work.
+ *
+ * `redirectTo` IS MANDATORY, and that is not a detail. Better Auth builds the
+ * emailed link's `callbackURL` from it, and `/reset-password/:token` REJECTS an
+ * empty `callbackURL` outright — so without it every emitted reset link would
+ * dead-end at an error page and the whole flow would be unreachable while
+ * looking configured.
+ *
+ * It is absolute and same-origin, resolved SERVER-side from `BETTER_AUTH_URL`
+ * and handed down as a prop — never from `window.location`, which is the value
+ * an attacker influences and the one the pinned `trustedOrigins` exists to stop
+ * trusting.
+ *
+ * The card swaps to the `sent` intent only on a SUCCESSFUL response, which is
+ * what keeps "check your email" honest on a site whose transport is missing:
+ * the server refuses, and the visitor sees the error state instead.
+ *
+ * The success copy is identical for a known and an unknown address — the whole
+ * point of the endpoint's constant body — so this component must never branch
+ * its rendering on anything the response says about the address.
+ */
+
+import { AuthCard, type AuthCardLabels } from "@working-theory/ui/blocks";
+import { createAuthClient } from "better-auth/react";
+import type { ReactElement } from "react";
+import { useState } from "react";
+
+const authClient = createAuthClient();
+
+export interface ForgotPasswordCardProps {
+  /** Absolute same-origin URL of `/reset-password`, resolved server-side. */
+  resetUrl: string;
+  /** Href for the card footer's "Back to sign in". */
+  signInHref: string;
+  /** Translated AuthCard labels (resolved server-side by the page). */
+  labels: AuthCardLabels;
+  /** Translated error copy. */
+  errorLabels: { requestFailed: string };
+}
+
+export function ForgotPasswordCard({
+  resetUrl,
+  signInHref,
+  labels,
+  errorLabels,
+}: ForgotPasswordCardProps): ReactElement {
+  const [sent, setSent] = useState(false);
+  const [sentTo, setSentTo] = useState("");
+  const [errors, setErrors] = useState<{ email?: string }>({});
+
+  const submit = async (email: string): Promise<void> => {
+    setErrors({});
+    // A network-level failure rejects; a refusal (the method disabled, the
+    // rate limit tripped) resolves with `{ error }`. Both land on the same
+    // message — neither may hint at whether the address exists.
+    const failed = await authClient
+      .requestPasswordReset({ email, redirectTo: resetUrl })
+      .then(
+        (res) => Boolean(res?.error),
+        () => true,
+      );
+
+    if (failed) {
+      setErrors({ email: errorLabels.requestFailed });
+      return;
+    }
+    setSentTo(email);
+    setSent(true);
+  };
+
+  return (
+    <div className="flex flex-col gap-4" data-testid="forgot-password-page">
+      <AuthCard
+        intent={sent ? "sent" : "forgot"}
+        signInHref={signInHref}
+        labels={labels}
+        {...(sent ? { sentTo } : {})}
+        onSubmit={(data) => void submit(data.email)}
+        errors={errors}
+      />
+    </div>
+  );
+}