user-feedback: clarify admin-triggered password recovery callbacks
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- next.js, supabase, typescript
- Domain
- authentication, documentation
Research direction
Start in SKILL.md under the Supabase Documentation section and review the password-recovery and SSR callback guidance. Done means the guidance distinguishes self-service PKCE from admin/server-triggered recovery, covers PASSWORD_RECOVERY and the configured callback format, and recommends waiting for async auth processing and validating with a real email callback or generated test link.
Written by the indexing model from the issue text.
Description
What happened
Task: Implement an admin-triggered “Send Password Reset” action in a Next.js App Router application using @supabase/ssr, while retaining the self-service forgot-password flow.
Skill said: The skill directed the agent to current Supabase documentation, but did not flag that a recovery request initiated by a server-side/admin client for another user cannot rely solely on a browser-held PKCE verifier. The first implementation only handled ?code=... with exchangeCodeForSession and then checked getSession().
Expected: The guidance should explicitly distinguish self-service PKCE recovery from admin/server-triggered recovery. A reset callback should handle the PASSWORD_RECOVERY auth event and the actual callback format in use, including an implicit URL fragment containing access/refresh tokens when no matching browser PKCE verifier exists. It should also avoid reporting “expired” before async callback processing completes.
Source
File: SKILL.md
Section: Supabase Documentation (password recovery / SSR callback implementation guidance)
Fix suggestion
Add a password-recovery note and example covering:
- Self-service recovery initiated in the same browser with PKCE: exchange the returned
code. - Admin/server-triggered recovery for a different browser/user: do not assume the recipient browser has the PKCE verifier; handle
PASSWORD_RECOVERYand/or the implicit fragment produced by the configured flow. - Subscribe to
onAuthStateChangebefore declaring the callback invalid, because session establishment is asynchronous. - Validate the flow with a real email callback or a generated test link, not only a TypeScript/build check.
- Dominant language
- TypeScript
- Stars
- 2.6k
- Forks
- 208
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/agent-skills
-
Difficulty 1/5 1-3 hours Newbie friendliness 90/100
supabase/agent-skills#586 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
supabase/agent-skills#585 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
supabase/agent-skills#583 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
supabase/agent-skills#582 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
supabase/agent-skills#581 ·
All issues in supabase/agent-skills
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100