bug: forgot password page is inaccessible

[sibsfinx]

On the /auth/sign-in page, "Forgot password" link is always hidden — even when the login/password aren't correct. When visiting /auth/forgot-password user gets redirected to /auth/sign-in?redirectTo=%2Fauth%2Fforgot-password, which is the same login screen.

Reproduced on the versions 1.2.59 and 1.2.32
https://github.com/user-attachments/assets/6ac610b2-109a-43a5-85ee-117cb8b4bec8

Here's a recording of my fixed version
https://github.com/user-attachments/assets/57b99809-6e65-48af-aabe-b3e466de4d82

I somehow fixed it (here sibsfinx#1), not opening a PR yet in this repo — it needs some cleanup and includes a transactional email (Brevo for proof of concept) which is a broader scope and should be discussed first.

An alternative option can be a cli password recovery, but that's slightly worse in terms of UX

---

[Kaushikgtm]

Thanks for the detailed report and the fork fix @sibsfinx I dug into the code and it looks like what reads as one bug is actually three separate causes stacked together. Sharing the breakdown in case it helps whoever picks this up:

1. The page is unreachable because the route isn't treated as an auth page

In with-auth-check.tsx, pathCorrespondsToAnAuthPage() only matches sign-in, sign-up, sso, and sign-out:

const pathCorrespondsToAnAuthPage = (pathname) => {
return (
pathname?.startsWith("/auth/sign-in") ||
pathname?.startsWith("/auth/sign-up") ||
pathname?.startsWith("/auth/sso") ||
pathname?.startsWith("/auth/sign-out")
// forgot-password / reset-password are missing
);
};
So when a logged-out user opens /auth/forgot-password, isAuthPage is false, the !isAuthPage && !isLoggedIn branch fires, and they get bounced to /auth/sign-in?redirectTo=%2Fauth%2Fforgot-password — exactly the redirect in the recording.

2. The "Forgot password" link is explicitly hidden

In auth-view-with-error-handling.tsx the link is hidden via classNames={{ form: { forgotPasswordLink: "hidden" } }}, and the custom SignInView form that renders by default doesn't include a forgot-password link at all. So even with #1 fixed, there's no entry point in the UI.

3. No sendResetPassword is configured on the backend

In better-auth.ts the config is just:

emailAndPassword: {
enabled: true,
},
Better Auth needs a sendResetPassword callback to actually deliver the reset link. Without it, even a reachable form can't send anything — which is the transactional-email/broader-scope piece you flagged.

[sibsfinx]

1. It's handled in https://github.com/sibsfinx/archestra/pull/1/changes#diff-f6e03c14a089d16701e49f4e40fa95e005df64d85dfe137abe11d6612b871070R232.

2. Pls see the video of the fix attached https://github.com/user-attachments/assets/57b99809-6e65-48af-aabe-b3e466de4d82

3. That's implemented https://github.com/sibsfinx/archestra/pull/1/changes#diff-550f4906c1a396585052681fb2b3cefc242749338e694bf3ad73d056f163695eR252

Attaching a screenshot from the email service, can provide logs

@Kaushikgtm Did you check the recordings and the pr in my fork yourself, or is it an LLM–generated reply? I think all three points are covered