Password reset link: Invalid user error

[svenissimo]

When going through the password-reset flow for email/password breaks when entering new password

Error
Invalid user
The user associated with this session is invalid.

Configuration

• turso db.
• mailhog.

Steps

• create an account using email and password
• verify account
• log out
• login screen -> reset password
• enter email
• click reset link and enter new password.
• Error shown.

Appears that locals does not have valid user.

		try {
			const { token } = params;
			const userId = await validatePasswordResetToken(token);
			const { user } = locals;

			console.log('XXX', { user, userId });
			if (!user || user.id !== userId) {
				const feedbacks = getFeedbackObjects([
					{
						type: 'error',
						title: 'Invalid user',
						message: 'The user associated with this session is invalid.'
					}
				]);

[ihsanmohamad]

I did something like this for my project.
where I add my own getUserById in my users.ts inside postgres drizzle.

try {
			const { token } = event.params;
			const userId = await validatePasswordResetToken(token);
			const user = await getUserById(userId);

			if (!user || user.id !== userId) {
				setFlash({ type: 'error', title: 'Invalid user', description: 'The user associated with this session is invalid.' }, event);
				return fail(400, {
					form
				});
			}
			// Invalidate all sessions and update the password
			await lucia.invalidateUserSessions(userId);
			await resetPassword(userId, await new Argon2id().hash(password));

			// If the user has not verified their email, verify it now
			if (!user.emailVerified) {
				await updateUserData(userId, { emailVerified: true });
			}

			const session = await lucia.createSession(user.id, {
				createdAt: new Date(),
				updatedAt: new Date()
			});

			const sessionCookie = lucia.createSessionCookie(session.id);
			event.cookies.set(sessionCookie.name, sessionCookie.value, {
				path: '.',
				...sessionCookie.attributes
			});
		} catch (e) {
			setFlash({ type: 'error', title: 'Invalid reset link', description: 'Your password reset link is invalid or has expired. Please try again..' }, event);
			return fail(400, {
				form
			});
		}

[svenissimo]

@ihsanmohamad thanks I already resolved doing almost the exact approach :)

I had contemplated raising a PR but I feel like the repo is not actively maintained.