for me also everything is handled in server actions first.
hmmm and we block users via cookie?
issue is that session created allows users to get authenticated, even if the user does not resets password and reroutes the app.
that's true users can not call admin api.
what about handling it with admin API to update password without creating the session to get authenticated.
<@107176742342402048> I go through the provided sources.
<@&1427691506076225667>
i tried event === 'PASSWORD_RECOVERY' or session.user.aud === 'recovery' but these don't happen.
I am experiencing same unfortunately. anyone with solution to this issue?