fix: prevent sign-out crash and surface real email-send failures #58

2026-07-14T12:14:23-05:00

ilia commented

2026-07-14 12:14:23 -05:00

Fixes #57 and #56.

#57 - Sign-out crash

NextAuth session/jwt callbacks no longer return null (NextAuth v5 client useSession() throws on a null session; this fired during sign-out for deactivated/refreshed sessions).
UserMenu/Header sign-out now closes the Manage Users overlay + popover before calling signOut(), and catches sign-out errors instead of leaving an unhandled rejection.
Added app/error.tsx as a defensive error boundary.

#56 - Forgot password / login emails

Registration and forgot-password flows now tell the user honestly when the confirmation/reset email failed to send, instead of always claiming success.
lib/email.ts throws a clear, actionable error when neither SMTP nor Resend is configured, instead of a cryptic SDK error.
Documented the required SMTP/Resend env vars in DEPLOYMENT_CHECKLIST.md (they were missing entirely, which is the main reason no confirmation/reset emails were ever sent in deployed environments).

Companion ansible-side change (separate repo) wires up DATABASE_URL_AUTH, NEXTAUTH_SECRET/URL, and SMTP_*/RESEND_* env vars for the punimTag dev/qa/prod deploy targets, which were previously unset entirely.

Fixes #57 and #56. ## #57 - Sign-out crash - NextAuth `session`/`jwt` callbacks no longer return `null` (NextAuth v5 client `useSession()` throws on a `null` session; this fired during sign-out for deactivated/refreshed sessions). - `UserMenu`/`Header` sign-out now closes the Manage Users overlay + popover before calling `signOut()`, and catches sign-out errors instead of leaving an unhandled rejection. - Added `app/error.tsx` as a defensive error boundary. ## #56 - Forgot password / login emails - Registration and forgot-password flows now tell the user honestly when the confirmation/reset email failed to send, instead of always claiming success. - `lib/email.ts` throws a clear, actionable error when neither SMTP nor Resend is configured, instead of a cryptic SDK error. - Documented the required SMTP/Resend env vars in `DEPLOYMENT_CHECKLIST.md` (they were missing entirely, which is the main reason no confirmation/reset emails were ever sent in deployed environments). Companion ansible-side change (separate repo) wires up `DATABASE_URL_AUTH`, `NEXTAUTH_SECRET`/`URL`, and `SMTP_*`/`RESEND_*` env vars for the punimTag dev/qa/prod deploy targets, which were previously unset entirely.

ilia added 1 commit 2026-07-14 12:14:23 -05:00

fix: prevent sign-out crash and surface real email-send failures

CI / skip-ci-check (pull_request) Successful in 4s

Details

CI / docker-ci (pull_request) Successful in 6s

Details

CI / secret-scan (pull_request) Successful in 9s

Details

bb09159133

- NextAuth session/jwt callbacks no longer return null (the client
  useSession() hook chokes on a null session, crashing the app on
  sign-out for deactivated/refreshed sessions) — fixes #57
- UserMenu/Header sign-out handlers close the Manage Users overlay and
  popover before calling signOut(), and no longer let a rejected
  signOut() promise go unhandled
- Added an app-level error boundary as a safety net for any remaining
  client render errors
- Registration and forgot-password flows now tell the user honestly
  when the confirmation/reset email failed to send instead of always
  claiming success — related to #56
- lib/email.ts throws a clear, actionable error when neither
  SMTP nor Resend is configured, instead of a cryptic SDK error
- Documented required SMTP/Resend env vars in DEPLOYMENT_CHECKLIST.md
  (were missing entirely, which is why no confirmation/reset emails
  were ever sent in deployed environments) — fixes #56

ilia merged commit e54c60912c into dev

2026-07-14 12:14:53 -05:00

ilia deleted branch fix/logout-crash-and-email-delivery

2026-07-14 12:14:53 -05:00

ilia referenced this issue from a commit

2026-07-14 12:14:54 -05:00

Merge pull request 'fix: prevent sign-out crash and surface real email-send failures' (#58) from fix/logout-crash-and-email-delivery into dev

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ilia/punimtag#58