From 702512437ab44f938347c1888ffa591395121646 Mon Sep 17 00:00:00 2001
From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com>
Date: Tue, 21 Jul 2026 17:30:09 +0200
Subject: [PATCH] fix(auth): accept 6-10 digit one-time codes on reset page
 (#1102)

The Email OTP Length on this project is 8, but the code input capped at
maxLength 6, silently truncating what the user typed so every verify
failed. gotrue allows 6-10 digits; the input now accepts that range and
the placeholder no longer claims a specific length.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 app/(auth)/reset-password/page.tsx | 8 ++++++--
 messages/en.json                   | 2 +-
 messages/sv.json                   | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/app/(auth)/reset-password/page.tsx b/app/(auth)/reset-password/page.tsx
index d0c531c5..86c555a6 100644
--- a/app/(auth)/reset-password/page.tsx
+++ b/app/(auth)/reset-password/page.tsx
@@ -21,7 +21,11 @@ import { Loader2, KeyRound } from 'lucide-react'
  *   links but do not click buttons, so the one-time token survives
  *   scanning. Never verify in an effect; that re-opens the burn.
  * - 'enter-code': no session, no token_hash. The email also carries a
- *   6-digit code the user can type together with their email address.
+ *   one-time code the user can type together with their email address.
+ *   The code length follows the project's Email OTP Length setting
+ *   (this project uses 8, gotrue allows 6-10), so the input must never
+ *   cap at 6: a maxLength shorter than the real code silently truncates
+ *   what the user types and every verify fails.
  */
 type Mode = 'loading' | 'set-password' | 'confirm-link' | 'enter-code'
 
@@ -242,7 +246,7 @@ function ResetPasswordInner() {
                   onChange={(e) => setCode(e.target.value)}
                   required
                   minLength={6}
-                  maxLength={6}
+                  maxLength={10}
                   disabled={isLoading}
                   className="h-11 tracking-widest"
                 />
diff --git a/messages/en.json b/messages/en.json
index 286e8fbb..3174e634 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -858,7 +858,7 @@
     "code_subtitle": "Enter your email and the one-time code from the email.",
     "email_label": "Email address",
     "code_label": "One-time code",
-    "code_placeholder": "6-digit code",
+    "code_placeholder": "The code from the email",
     "code_button": "Verify code",
     "code_verifying": "Verifying...",
     "code_hint": "The code is in the password reset email. If no email arrived, request a new reset from the login page.",
diff --git a/messages/sv.json b/messages/sv.json
index 6f825274..94fc3465 100644
--- a/messages/sv.json
+++ b/messages/sv.json
@@ -858,7 +858,7 @@
     "code_subtitle": "Ange din e-post och engångskoden från mailet.",
     "email_label": "E-postadress",
     "code_label": "Engångskod",
-    "code_placeholder": "6-siffrig kod",
+    "code_placeholder": "Koden från mailet",
     "code_button": "Verifiera kod",
     "code_verifying": "Verifierar...",
     "code_hint": "Koden finns i mailet om lösenordsåterställning. Hittar du inget mail kan du begära en ny återställning från inloggningssidan.",