!fix: password reset flow

[tyler-dane]

!Breaking change: Renames an environment value

Fix password reset email URL and simplify environment configuration

Problem

Password reset emails sent from staging and production contained http://localhost:9080 as the base URL, making the reset link unusable. The variable LOCAL_WEB_URL was hardcoded to localhost:9080 in all env files — including staging and production — because its name implied it was only for local use. The correct domain values existed in STAGING_WEB_URL and PROD_WEB_URL, but those were never wired into the backend schema or the reset link builder.

A secondary issue: the CLI had three separate URL env vars (LOCAL_WEB_URL, STAGING_WEB_URL, PROD_WEB_URL) that were mostly redundant with each other, adding cognitive overhead to env file setup.

Changes

Rename LOCAL_WEB_URL → FRONTEND_URL and fix values per environment

• FRONTEND_URL now holds the public-facing frontend URL for the current deployment — localhost:9080 for local, the real domain for staging/prod
• Wired through the Zod backend schema (env.constants.ts) so ENV.FRONTEND_URL is always the correct domain
• buildResetPasswordLink() now uses this correct value, so reset emails link to the right domain in every environment

Consolidate CLI URL configuration

• Removed STAGING_WEB_URL and PROD_WEB_URL from all env files and CLI_ENV — they duplicated FRONTEND_URL's value
• getCleanupUrl() now simply returns ${FRONTEND_URL}/cleanup — no NODE_ENV branching needed
• getDomainAnswer() extracts the hostname from FRONTEND_URL when it's a real domain; falls back to an interactive prompt (with a tip to set FRONTEND_URL) when it's localhost
• Net result: one URL variable to set, zero redundancy

Password reset UI flow

• Enhanced AuthModal to handle the post-reset sign-up flow and show appropriate status messaging
• Improved URL token handling in useAuthFormHandlers during the reset flow
• Added loader logic in loaders.ts to detect and route reset password sessions

Delete user GCal access check

• deleteCompassDataForMatchingUsers now checks for a Google refresh token before attempting GCal cleanup, avoiding spurious errors for password-only users

Test plan

• Trigger a password reset in staging — confirm the email link points to https://backend.compasscalendar.app/day?auth=reset&token=...
• Complete the reset flow end-to-end: receive email → click link → set new password → sign in
• Run backend tests: pnpm test in packages/backend — Zod schema + supertokens middleware tests
• Run web tests: pnpm test in packages/web — AuthModal tests
• Run CLI locally: confirm delete command cleanup URL resolves correctly

---

Note

Medium Risk
Medium risk because it renames a required backend/CLI env var (LOCAL_WEB_URL→FRONTEND_URL) and refactors SuperTokens override handlers plus web router/auth modal logic, which could break auth flows or deployments if misconfigured.

Overview
Fixes password reset links and simplifies URL env configuration by replacing LOCAL_WEB_URL (and CLI STAGING_WEB_URL/PROD_WEB_URL) with a single FRONTEND_URL used by the backend env schema, SuperTokens reset-email rewriting, and CLI domain/cleanup URL resolution.

Refactors backend SuperTokens overrides into supertokens.middleware.handlers.ts, centralizes “tag new user” email-list behavior in EmailService.tagNewUserIfEnabled, and adjusts tests accordingly (including avoiding a race in SyncDriver.createSync).

Hardens the web password reset UX: loader redirects now preserve ?auth=... query params, reset tokens are managed via URL-safe helpers, the modal adds a loginAfterReset state with a success message, and new tests cover redirects and view switching.

Minor cleanups: remove a noisy console.warn in core event mapping, stabilize RRULE tests, update CLI delete to skip Google watch cleanup when no refresh token exists, and reorganize/add internal docs plus ignore .claude/.

^{Written by Cursor Bugbot for commit 3b8e877. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue. You can view the agent here.}