Suite 39 — password-reset flow + fix BetterAuthAccount uuid drift

[aryavenkatesan]

Suite 39 — password-reset flow wiring + auth model drift

Follow-up to Suite 38. Backend 115 tests OK, makemigrations --check clean; frontend pnpm build + pnpm test 33/33 + lint green.

39.1 — Wire Better Auth password-reset (unblocks the 38.A4 rollover)

• theCommonsWeb/src/lib/auth.ts — add emailAndPassword.sendResetPassword, sending the reset email directly via the Brevo REST API from the Next server (the frontend had no email helper). Wrapped in try/catch — logs and returns on failure, never throws (matches Better Auth anti-enumeration).
• ForgotPasswordForm.tsx — replace the stub with a real authClient.requestPasswordReset({ email, redirectTo: '/reset-password' }).
• New public theCommonsWeb/src/app/reset-password/page.tsx + form — consumes ?token=, sets a new password via authClient.resetPassword, redirects to sign-in.
• better-auth@1.6.11 method names verified: requestPasswordReset / resetPassword.

39.2 — Fix BetterAuthAccount uuid drift

• BetterAuthAccount.user_id TextField → UUIDField (db_column="userId") to match the live neon_auth.account column. managed=False mirror ⇒ no migration generated. Added a fast field-type assertion test. Rollover command keeps its raw SQL (neon_auth mirrors aren't in the test DB); docstring updated.

⚠️ Do NOT merge until these are done

1. Prod env prerequisite: add BREVO_API_KEY (and optionally DIGEST_FROM_EMAIL) to theCommonsWeb's prod server env. Without it, /forgot-password returns success but no reset email is sent (logged, not thrown). The backend already has this key; the frontend did not.
2. E2E email receipt is unverified — the wiring matches the backend's Brevo pattern but no live send was triggered. Verify end-to-end (request reset → receive email → set password → sign in) after the env var is set, ideally against a staging/prod passwordless test account.

Once merged + env set, the 38.A4 rollover (rollover_passwordless_accounts --send) is unblocked.

Note

BetterAuthSession.user_id is still TextField — 39.2 left it (not confirmed drifted, out of scope). Minor potential follow-up if session ORM joins ever need it.

🤖 Generated with Claude Code