SvelteKit Supabase auth example doesn't support password reset or user invite

[paulcalcraft]

Bug report

• [ x ] I confirm this is a bug with Supabase, not with my own application.
• [ x ] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Password reset and user invite processes for supabase email auth on SvelteKit send information in the URL fragment. This is apparently necessary for OAuth flows, but there is nothing in the SvelteKit supabase auth tutorial that handles this, so all password resets/user invites just silently fail.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Follow the auth tutorial
2. Invite a user or do reset password via Supabase web on the auth section in the project.
3. See the link has a fragment with #access_token= etc.
4. Click it, it's not handled by anything set up in the tutorial. Silently fails with the access_token still sitting in the URL fragment

Edit:
Note that if password reset is initiated by the SvelteKit app, it does work. It's only when sent via the supabase web auth interface in the database project that it fails. When executed via the app, it sends an email with a different kind of token to supabase auth, which correctly redirects to the endpoint with the code in a query string, which is what the tutorial is set up for. The email generated via the app contains a reset password link with a token link like this: https://MY_PROJECT.supabase.co/auth/v1/verify?token=pkce_89c69eb90517fd34XXXXXXXXXXXXXXXX&type=recovery&redirect_to=https://MY_DOMAIN/

The token begins with "pkce_", and that seems to be the difference between supabase auth redirecting via ?code=XXX (which works) instead of #access_token=XXX.

Is there any way to get the supabase web interface to send a reset email with a pkce token?
(end of edit)

Expected behavior

The tutorial should set up handling for the fragment to support password reset and user invite functionality.

Edit:
And/or you should be able to send a reset password/invite user request via the supabase web's project auth view that sends the right type of token (pkce).

Additional context

There are a number of people struggling with this in various discussions for both SvelteKit and Next.js, e.g.

• https://github.com/orgs/supabase/discussions/3360
• https://github.com/orgs/supabase/discussions/2842

This github example might be the full working code needed. If so, it should be linked from the Supabase SvelteKite docs.

The top of the auth helper docs (top google hit for sveltekit supabase auth) suggests migrating to SSR. If the auth helpers approach can't support invite and password reset, maybe the suggestion should be more severe and be a deprecation?

Even if this is just a case of outdated docs, hopefully this post is useful for others searching/struggling to figure out full SvelteKit Supabase auth.

[burggraf]

This is great input, @paulcalcraft, but this is more of an enhancement request than a bug, so I'm moving it over to the Github Discussions section where it will get some more traction. Please pick it up from there. Thanks for this!