ffg

frontend/src/pages/ResetPassword.jsx

@@ -86,50 +86,66 @@ const ResetPassword = () => {
   
   const handleSubmit = async (e) => {
     e.preventDefault();
-    
+
     // Basic validation
     if (formData.password !== formData.confirmPassword) {
       alert('Passwords do not match');
       return;
     }
-    
     if (formData.password.length < 8) {
       alert('Password must be at least 8 characters long');
       return;
     }
-    
+
     try {
-      // --- This is the key change ---
-      // Instead of dispatching to your Redux thunk which calls the backend,
-      // call the Supabase client directly.
-      
-      console.log('Resetting password with Supabase client');
-      
+      // --- Check for existing session (recovery session) ---
+      // It's crucial to verify the session was established by the Supabase client
+      // when it processed the URL fragments on app load.
+      const { data: { session }, error: sessionError } = await supabase.auth.getSession();
+      if (sessionError) {
+        console.error('Error getting session:', sessionError);
+        alert('Failed to get session. Please try resetting your password again.');
+        // Optionally, redirect to /forgot-password
+        // navigate('/forgot-password');
+        return;
+      }
+
+      if (!session || !session.user) {
+        // This is the likely cause of AuthSessionMissingError
+        console.warn('No active session found. The URL might not have been processed correctly or the session expired.');
+        alert('Password reset link may be invalid or expired. Please request a new one.');
+        // Optionally, redirect to /forgot-password
+        // navigate('/forgot-password');
+        return;
+      }
+
+      console.log('Resetting password with Supabase client for user:', session.user?.email);
+
       const { data, error } = await supabase.auth.updateUser({
         password: formData.password
       });
-      
+
       if (error) {
-        // Handle specific Supabase errors
         console.error('Supabase password reset error:', error);
         let message = 'Failed to reset password.';
         if (error.message.toLowerCase().includes('password')) {
            message = 'Password does not meet requirements. Please use at least 8 characters.';
-        } else if (error.message.toLowerCase().includes('session')) {
+        } else if (error.message.toLowerCase().includes('session') || error.message.includes("Auth session missing")) {
            message = 'Password reset session expired. Please request a new reset link.';
         } else {
           message = error.message;
         }
-        // Show error to user
-        alert(message); 
+        alert(message);
         return;
       }
-      
-      // If successful
+
       console.log('Password updated successfully:', data);
       alert('Password reset successfully! You can now log in with your new password.');
+      // After successful reset, the session might need to be cleared or re-established.
+      // Consider logging the user out of the recovery session.
+      await supabase.auth.signOut(); 
       navigate('/login');
-      
+
     } catch (err) {
       console.error('Unexpected error during password reset:', err);
       alert('An unexpected error occurred. Please try again.');

frontend/src/services/supabaseClient.js

@@ -38,4 +38,17 @@ export const supabase = createClient(
   }
 );
 
+// --- Add logging to debug session initialization ---
+console.log("Supabase client initialized with URL:", supabaseUrl);
+supabase.auth.getSession()
+  .then(({ data: { session }, error }) => {
+    if (error) {
+      console.error("Error getting initial session:", error);
+    } else {
+      console.log("Initial session from URL (on app load):", session ? "Session exists" : "No session");
+      // Note: The actual session details might be sensitive, so just log existence.
+      // If session is null here when coming from a reset link, it means processing failed.
+    }
+  });
+
 export default supabase;