revisi 18

app/auth.py

@@ -29,19 +29,16 @@ def auth_view():
             unsafe_allow_html=True
         )
 
-        # --- DEBUG & FIX: Auto convert hash (#) to query (?) ---
-        # Try streamlit-url-fragment first
+        # --- Auto convert hash (#) to query (?) using streamlit-url-fragment ---
         fragment_detected = False
         try:
             from streamlit_url_fragment import get_fragment
             fragment = get_fragment()
-            st.write(f"DEBUG: Fragment detected: {fragment}")  # Temporary debug
             
             if fragment and not st.session_state.get("hash_migrated"):
                 # Remove leading # if present and parse fragment parameters
                 clean_fragment = fragment.lstrip('#')
                 params = dict(parse_qsl(clean_fragment))
-                st.write(f"DEBUG: Parsed params: {params}")  # Temporary debug
                 
                 if params.get("type") == "recovery" and params.get("access_token"):
                     # Set query params so existing recovery flow works
@@ -54,8 +51,8 @@ def auth_view():
                     st.session_state["hash_migrated"] = True
                     fragment_detected = True
                     st.rerun()
-        except Exception as e:
-            st.write(f"DEBUG: Fragment library error: {e}")  # Temporary debug
+        except Exception:
+            pass
         
         # Always run JS fallback for reliability
         if not fragment_detected:
@@ -108,11 +105,21 @@ def auth_view():
                     st.error("Token pemulihan tidak ditemukan. Coba klik ulang tautan dari email.")
                 else:
                     try:
+                        # Set session temporarily to update password
                         supabase.auth.set_session(access_token, refresh_token)
                         supabase.auth.update_user({"password": npw})
-                        st.success("Password berhasil diubah. Anda akan diarahkan ke login...")
-                        # bersihkan query params setelah reset
-                        st.experimental_set_query_params()
+                        
+                        # Sign out after password update
+                        supabase.auth.sign_out()
+                        
+                        st.success("Password berhasil diubah. Silakan login dengan password baru.")
+                        
+                        # Clear session and query params
+                        if hasattr(st, "query_params"):
+                            st.query_params.clear()
+                        else:
+                            st.experimental_set_query_params()
+                        
                         st.session_state.clear()
                         st.rerun()
                     except Exception as e: