Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@
"dependencies": {
"@next/third-parties": "^16.1.6",
"@sentry/nextjs": "^10.38.0",
"@spree/next": "^0.10.4",
"@spree/sdk": "^0.10.0",
"@spree/next": "^0.10.5",
"@spree/sdk": "^0.10.1",
"@stripe/react-stripe-js": "^5.6.0",
"@stripe/stripe-js": "^8.7.0",
"class-variance-authority": "^0.7.1",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,155 @@
"use client";

import { CircleAlert, CircleCheck, Mail } from "lucide-react";
import Link from "next/link";
import { usePathname } from "next/navigation";
import { useState } from "react";
import { Alert, AlertDescription } from "@/components/ui/alert";
import { Button } from "@/components/ui/button";
import {
Card,
CardContent,
CardDescription,
CardFooter,
CardHeader,
CardTitle,
} from "@/components/ui/card";
import { Field, FieldLabel } from "@/components/ui/field";
import { Input } from "@/components/ui/input";
import { requestPasswordReset } from "@/lib/data/customer";
import { extractBasePath } from "@/lib/utils/path";

export default function ForgotPasswordPage() {
const pathname = usePathname();
const basePath = extractBasePath(pathname);

const [email, setEmail] = useState("");
const [submitting, setSubmitting] = useState(false);
const [error, setError] = useState<string | null>(null);
const [submitted, setSubmitted] = useState(false);

const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault();
setError(null);
setSubmitting(true);

try {
const origin = window.location.origin;
const redirectUrl = `${origin}${basePath}/account/reset-password`;
await requestPasswordReset(email, redirectUrl);
setSubmitted(true);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

For @spree/next v0.10.5, what is the exact failure behavior of requestPasswordReset(email, redirectUrl): does it throw, or return an object like { success: false, error }?

💡 Result:

I couldn’t verify the exact v0.10.5 behavior from public docs/source via web search (the Spree docs page for @spree/next doesn’t document requestPasswordReset, and I couldn’t retrieve the v0.10.5 package source itself from an authoritative public location in this environment). (spreecommerce.org)

What I can say confidently is:

  • The older Spree JS SDK (@spree/storefront-api-v2-sdk) explicitly does not throw and instead returns a “result object” you must inspect (isSuccess()/isFail(), fail()), but that statement is about that SDK, not @spree/next. (app.unpkg.com)

So for @spree/next@0.10.5 specifically, you’ll need to confirm by checking the installed package’s typings/implementation locally:

  • node_modules/@spree/next/dist/**/*.d.ts (or equivalent) — see whether requestPasswordReset(...) returns Promise<void> / Promise<...> and whether it documents throwing.
  • node_modules/@spree/next/dist/**/*.js — search for function requestPasswordReset and see if it does if (!res.ok) throw ... vs return { success: false, error }.

If you paste the requestPasswordReset function (or its .d.ts signature) from @spree/next@0.10.5, I can tell you precisely whether it throws or returns a { success: false, error }-style object.

Citations:


🏁 Script executed:

find . -type f -name "page.tsx" | grep "forgot-password" | head -5

Repository: spree/storefront

Length of output: 134


🏁 Script executed:

cat -n src/app/[country]/[locale]/\(storefront\)/account/forgot-password/page.tsx 2>/dev/null || find . -type f -path "*forgot-password/page.tsx" -exec cat -n {} \;

Repository: spree/storefront

Length of output: 5935


🏁 Script executed:

rg "requestPasswordReset" -t ts -t tsx -A 3 -B 3

Repository: spree/storefront

Length of output: 87


🏁 Script executed:

find . -path "*/node_modules/@spree/next*" -name "*.d.ts" -o -path "*/node_modules/@spree/next*" -name "package.json" | head -10

Repository: spree/storefront

Length of output: 42


🏁 Script executed:

find . -path "*/lib/data/customer*" -type f

Repository: spree/storefront

Length of output: 86


🏁 Script executed:

cat -n src/lib/data/customer.ts 2>/dev/null || cat -n src/lib/data/customer.js 2>/dev/null || find . -path "*/lib/data/customer*" -type f -exec cat -n {} \;

Repository: spree/storefront

Length of output: 1767


🏁 Script executed:

find . -type d -name "@spree" | head -5

Repository: spree/storefront

Length of output: 42


🏁 Script executed:

find . -path "*/node_modules/@spree/next*" -type f \( -name "*.d.ts" -o -name "index.js" -o -name "index.ts" \) | head -20

Repository: spree/storefront

Length of output: 42


🏁 Script executed:

grep -r "requestPasswordReset" node_modules/@spree/next --include="*.d.ts" --include="*.ts" --include="*.js" 2>/dev/null | head -20

Repository: spree/storefront

Length of output: 42


🏁 Script executed:

cat package.json | grep -A 2 -B 2 "@spree/next"

Repository: spree/storefront

Length of output: 231


🏁 Script executed:

find . -type f \( -name "package.json" -o -name "package-lock.json" -o -name "pnpm-lock.yaml" \) -exec grep -l "@spree/next" {} \;

Repository: spree/storefront

Length of output: 94


🏁 Script executed:

grep -r "requestPasswordReset" src/ --include="*.ts" --include="*.tsx" -B 5 -A 10

Repository: spree/storefront

Length of output: 5109


🏁 Script executed:

find . -type f -name "*.ts" -o -name "*.tsx" | xargs grep -l "login\|register" | grep -E "(page|component)" | head -5

Repository: spree/storefront

Length of output: 186


🏁 Script executed:

grep -A 10 "handleSubmit\|await _login\|await _register" src/app/**/*.tsx 2>/dev/null | head -40

Repository: spree/storefront

Length of output: 42


🏁 Script executed:

find . -type f -name "*.tsx" -path "*/account/*" -exec grep -l "login\|register" {} \; | head -5

Repository: spree/storefront

Length of output: 247


🏁 Script executed:

cat -n src/app/[country]/[locale]/\(storefront\)/account/page.tsx | head -100

Repository: spree/storefront

Length of output: 3823


🏁 Script executed:

cat -n src/app/[country]/[locale]/\(storefront\)/account/register/page.tsx | head -100

Repository: spree/storefront

Length of output: 3937


🏁 Script executed:

cat -n src/contexts/AuthContext.tsx | head -150

Repository: spree/storefront

Length of output: 4239


🏁 Script executed:

cat -n src/lib/data/customer.ts

Repository: spree/storefront

Length of output: 1767


🏁 Script executed:

grep -r "login as _login" src/ --include="*.ts" --include="*.tsx" -A 5 -B 5 | head -50

Repository: spree/storefront

Length of output: 550


🏁 Script executed:

cat -n src/lib/data/utils.ts 2>/dev/null || find . -path "*/lib/data/utils*" -type f -exec cat -n {} \;

Repository: spree/storefront

Length of output: 1142


🏁 Script executed:

find . -type f \( -name "*.ts" -o -name "*.tsx" \) -exec grep -l "resetPassword\|requestPasswordReset" {} \;

Repository: spree/storefront

Length of output: 235


🏁 Script executed:

cat -n src/app/[country]/[locale]/\(storefront\)/account/reset-password/page.tsx 2>/dev/null | head -100

Repository: spree/storefront

Length of output: 3764


Check the requestPasswordReset result for success before showing confirmation.

At lines 39-40, setSubmitted(true) is called unconditionally after await requestPasswordReset(...). The reset-password page (lines 80-88) treats resetPassword as returning a result object with { success, error } and checks if (result.success). Since requestPasswordReset is wrapped identically to resetPassword in the customer module, it likely returns the same result object. If requestPasswordReset returns { success: false }, the try-catch will not catch it, and users will see a false "Check your email" success message.

Align the error handling with the reset-password page pattern:

const result = await requestPasswordReset(email, redirectUrl);
if (result.success) {
  setSubmitted(true);
} else {
  setError(result.error || "Something went wrong. Please try again.");
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/app/`[country]/[locale]/(storefront)/account/forgot-password/page.tsx
around lines 39 - 40, The call to requestPasswordReset currently sets
setSubmitted(true) unconditionally; instead, capture the returned result (from
requestPasswordReset(email, redirectUrl)), check result.success and only call
setSubmitted(true) on success, otherwise call setError(result.error ||
"Something went wrong. Please try again."); mirror the resetPassword handling so
failures surface to the user rather than showing the success confirmation.

} catch {
setError("Something went wrong. Please try again.");
} finally {
setSubmitting(false);
}
};

if (submitted) {
return (
<div className="max-w-md mx-auto px-4 sm:px-6 lg:px-8 py-16">
<Card>
<CardHeader className="text-center">
<div className="mx-auto w-12 h-12 bg-green-100 rounded-full flex items-center justify-center mb-2">
<CircleCheck className="w-6 h-6 text-green-600" />
</div>
<CardTitle>Check your email</CardTitle>
<CardDescription>
If an account exists for <strong>{email}</strong>, we&apos;ve sent
password reset instructions.
</CardDescription>
</CardHeader>

<CardContent className="space-y-4">
<div className="flex items-start gap-3 text-sm text-gray-600">
<Mail className="w-5 h-5 mt-0.5 flex-shrink-0 text-gray-400" />
<p>
The link in the email will expire in 15 minutes. Check your spam
folder if you don&apos;t see it.
</p>
</div>

<Button
variant="outline"
className="w-full"
onClick={() => {
setSubmitted(false);
setEmail("");
}}
>
Try a different email
</Button>
</CardContent>

<CardFooter className="justify-center">
<Link
href={`${basePath}/account`}
className="text-sm text-primary hover:text-primary/70 font-medium"
>
Back to sign in
</Link>
</CardFooter>
</Card>
</div>
);
}

return (
<div className="max-w-md mx-auto px-4 sm:px-6 lg:px-8 py-16">
<Card>
<CardHeader className="text-center">
<CardTitle>Reset your password</CardTitle>
<CardDescription>
Enter your email and we&apos;ll send you a link to reset your
password.
</CardDescription>
</CardHeader>

<CardContent>
<form onSubmit={handleSubmit} className="space-y-4">
{error && (
<Alert variant="destructive">
<CircleAlert />
<AlertDescription>{error}</AlertDescription>
</Alert>
)}

<Field>
<FieldLabel htmlFor="email">Email</FieldLabel>
<Input
type="email"
id="email"
name="email"
autoComplete="email"
value={email}
onChange={(e) => setEmail(e.target.value)}
required
placeholder="you@example.com"
/>
</Field>

<div className="w-full">
<Button
type="submit"
disabled={submitting}
size="lg"
className="w-full"
>
{submitting ? "Sending..." : "Send reset link"}
</Button>
</div>
</form>
</CardContent>

<CardFooter className="justify-center">
<Link
href={`${basePath}/account`}
className="text-sm text-primary hover:text-primary/70 font-medium"
>
Back to sign in
</Link>
</CardFooter>
</Card>
</div>
);
}
5 changes: 4 additions & 1 deletion src/app/[country]/[locale]/(storefront)/account/layout.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,10 @@ export default function AccountLayout({
const { user, logout, isAuthenticated, loading } = useAuth();

// Pages that don't require authentication
const isAuthPage = pathname.includes("/register");
const isAuthPage =
pathname.includes("/register") ||
pathname.includes("/forgot-password") ||
pathname.includes("/reset-password");
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
const isMainAccountPage = pathname === `${basePath}/account`;

// Redirect to login if not authenticated and trying to access protected sub-pages
Expand Down
Loading
Loading