Payload Reset Password Function Not Working (Beta 11)

[hatchli]

The resetPassword function seems to be broken this beta
This previously worked just fine in Beta 2:

But now throws the following error:

[JessChowdhury]

Hi @hatchli, what steps did you take to get this error? I have tested with the /forgot-password endpoint and have been unable to replicate.

[PatrikKozak]

Hey @hatchli - as @JessChowdhury mentioned, we rolled out some fixes for the forgot-password view yesterday.

Can you pull in the latest beta version in your repo and see if you're still getting the error above? If so, can you please provide a reproducible repo?

[hatchli]

@PatrikKozak @JessChowdhury

I've updated to the latest beta (18) and the same issue persists. I have no problem utilizing the admin panel's forgot password functionality - the issue is with the local api. I've learned that this also affects my email verification for creating a new user - same error. The thing these both share are utilizing the auth param of the Users collection and the corresponding generateEmailHTML.

 auth: {
    forgotPassword: {
      generateEmailHTML: ({ token }) => {
        console.log('token', token)
        return `<a href='${process.env.NEXT_PUBLIC_SERVER_URL}/reset-password?token=${token}'>Click here to reset your password</a>`
      },
    },
    verify: {
      generateEmailHTML: ({ token }) => {
        return `<a href='${process.env.NEXT_PUBLIC_SERVER_URL}/verify-email?token=${token}'>Click here to Verify Your Email</a>`
      },
    },
    tokenExpiration: 86400,
    cookies: {
      sameSite: 'Strict',
    },
  },

Notably, I'm able to send emails programatically via payload's req for other tasks (like Newsletter signup), so it doesn't seem to be an issue with the email setup.

hooks: {
    afterChange: [
      ({ operation, req, doc }) => {
        const { id, email, verified, token } = doc
        if (!verified && !doc?.user && operation === 'create') {
          req.payload.sendEmail({
            from: 'FromEmail <info@hatchli.com>',
            to: [email],
            subject: 'Please Confirm Your Email for Newsletters',
            html: NewsletterEmailHtml({
              token: req.payload.encrypt(token),
              email: email,
            }),
          })
        }
        return doc
      },
    ],
  },

I have no idea what's changed, so I will attempt to build a reproduction via create-payload-app@beta
I'd prefer if possible to simply share my repo (along with .env) privately - is that possible? EDIT: got a minimal(ish) repo working, going to share shortly, so unnecessary
Thanks for any help you can provide

[hatchli]

@PatrikKozak @JessChowdhury

Here's the (as minimal I could make it without nuking my db) reproduction: https://github.com/hatchli/reproduce-forgot

I have dm'd the .env on discord

Reproduction steps:

pnpm install
pnpm dev
navigate to http://localhost:3000/forgot-password
enter any email and you'll see the error referenced above (ERR_INVALID_URL) on the server

Thanks!

[jmikrut]

Hey @hatchli —

We just fixed something that may be related:
#6086

This will go out in a beta shortly - so give it a shot once it's live!

But in the meantime I noticed that you have a typo in your serverURL:

In addition, you are creating email HTML that sends to a ${process.env.NEXT_PUBLIC_SERVER_URL}/reset-password?token=${token} - but we don't have the page that corresponds with this route in your reproduction for us to be able to test with.

Do you have a valid NEXT_PUBLIC_SERVER_URL defined? If it's not fixed in the above commit, it might be a problem with your implementation I'm afraid. But we're happy to continue to help. I will convert this to a discussion so we can keep talking there.

[hatchli]

🤦‍♂️
@jmikrut Thanks for spotting that James

Unfortunately fixing that typo and ensuring that there is a corresponding file in the env doesn't appear to fix it. I confirmed that the NEXT_PUBLIC_SERVER_URL is defined in the env as well - in fact, both are simply http://localhost:3000 (and the actual product url in production with vercel). This all worked fine in a 2.0 custom-server implementation.

I'll have to wait for that fix to be pushed - I will absolutely be updating to the next beta and will report back. If it still fails, I'll update the reproduction repo with the corresponding reset-password page so you can test properly - for some reason I thought that wasn't necessary to include, as it just runs a simple token validation, but I will absolutely include it.

Thanks for continuing to help - this is a roadblock for me, as the verify email isn't being sent for signup either (with the same issue).

[jmikrut]

Hey @hatchli — my bad. I actually did just find the REAL fix for this. It was related to local API usage of resetPassword and / or forgotPassword.

#6126

This will be merged once tests pass, and then will be included within the next release! Sorry for converting this to a discussion prematurely - this was indeed a legit issue!