..

app/auth.py

@@ -32,208 +32,327 @@ def auth_view():
             unsafe_allow_html=True
         )
 
-        # --- Password recovery handler (Supabase redirect) ---
-        # 1) Move hash params to query params on first load, then reload once
-        # Try in main document first (no iframe), so it can read the top-level hash reliably
+        # --- Hash to Query Parameter Migration ---
+        # Use more compatible approach for Streamlit
         st.markdown(
             """
             <script>
-            (function () {
-              try {
-                var hash = window.location.hash;
-                if (hash && hash.length > 1 && !sessionStorage.getItem('hash_migrated')) {
-                  var hashParams = new URLSearchParams(hash.substring(1));
-                  var queryParams = new URLSearchParams(window.location.search);
-                  var hasParams = false;
-                  hashParams.forEach(function (value, key) {
-                    queryParams.set(key, value);
-                    hasParams = true;
-                  });
-                  if (hasParams) {
-                    sessionStorage.setItem('hash_migrated', 'true');
-                    var newUrl = window.location.origin + window.location.pathname + '?' + queryParams.toString();
-                    window.location.replace(newUrl);
-                  }
-                }
-              } catch (e) {
-                console && console.warn && console.warn('main-doc hash->query failed', e);
-              }
-            })();
+            // Streamlit-compatible hash migration
+            if (typeof window !== 'undefined') {
+                (function() {
+                    try {
+                        var hash = window.location.hash;
+                        var hasParams = hash && hash.length > 1;
+                        var migrated = sessionStorage ? sessionStorage.getItem('hash_migrated') : null;
+                        
+                        if (hasParams && !migrated) {
+                            // Simple string parsing to avoid URL constructor issues
+                            var hashContent = hash.substring(1);
+                            var pairs = hashContent.split('&');
+                            var queryParams = new URLSearchParams(window.location.search);
+                            var hasAuthParams = false;
+                            
+                            for (var i = 0; i < pairs.length; i++) {
+                                var pair = pairs[i].split('=');
+                                if (pair.length === 2) {
+                                    var key = decodeURIComponent(pair[0]);
+                                    var value = decodeURIComponent(pair[1]);
+                                    
+                                    // Check for Supabase auth parameters
+                                    if (key === 'access_token' || key === 'type' || key === 'refresh_token') {
+                                        hasAuthParams = true;
+                                    }
+                                    
+                                    queryParams.set(key, value);
+                                }
+                            }
+                            
+                            if (hasAuthParams) {
+                                if (sessionStorage) {
+                                    sessionStorage.setItem('hash_migrated', 'true');
+                                }
+                                
+                                var newUrl = window.location.origin + window.location.pathname;
+                                if (queryParams.toString()) {
+                                    newUrl += '?' + queryParams.toString();
+                                }
+                                
+                                window.location.replace(newUrl);
+                            }
+                        }
+                    } catch (e) {
+                        console && console.log && console.log('Hash migration error:', e);
+                    }
+                })();
+            }
             </script>
             """,
-            unsafe_allow_html=True,
+            unsafe_allow_html=True
         )
-        components.html(
-            """
-            <script>
-            (function () {
-              try {
-                // In iframe context, read and write via parent to ensure access to top-level URL
-                var w = window.parent || window;
-                var hash = w.location.hash;
-                // Only act if hash contains params and we haven't migrated
-                if (hash && hash.length > 1 && !w.sessionStorage.getItem('hash_migrated')) {
-                  var hashParams = new URLSearchParams(hash.substring(1));
-                  var queryParams = new URLSearchParams(w.location.search);
-
-                  var hasParams = false;
-                  hashParams.forEach(function (value, key) {
-                    queryParams.set(key, value);
-                    hasParams = true;
-                  });
 
-                  if (hasParams) {
-                    // Mark as migrated to avoid loops
-                    w.sessionStorage.setItem('hash_migrated', 'true');
-                    // Build absolute URL (preserve origin + path), clear hash, and REPLACE (no extra reloads)
-                    var newUrl = w.location.origin + w.location.pathname + '?' + queryParams.toString();
-                    w.location.replace(newUrl);
-                    // Fallback after a short delay in case replace is ignored
-                    setTimeout(function(){
-                      if (w.location.hash) {
-                        w.location.href = newUrl;
-                      }
-                    }, 250);
-                  }
-                }
-              } catch (e) {
-                console.error('iframe hash->query migration failed', e);
-              }
-            })();
-            </script>
-            """,
-            height=1,
-        )
+        # Clear migration flag after successful page load with query params
+        try:
+            qp = st.query_params if hasattr(st, 'query_params') else st.experimental_get_query_params()
+            get_q = lambda k: qp.get(k, None) if hasattr(st, 'query_params') else (qp.get(k, [None])[0] if isinstance(qp.get(k, None), list) else qp.get(k, None))
+            
+            # If we have recovery parameters, clear the migration flag
+            if get_q("type") == "recovery":
+                st.markdown(
+                    """
+                    <script>
+                    if (typeof sessionStorage !== 'undefined') {
+                        sessionStorage.removeItem('hash_migrated');
+                    }
+                    </script>
+                    """,
+                    unsafe_allow_html=True
+                )
+        except Exception as e:
+            pass  # Silently handle errors in production
 
-        # 2) Read query params for recovery flow
+        # Read query params for recovery flow
         try:
-            qp = st.query_params  # Streamlit >= 1.30
-            get_q = lambda k: qp.get(k, None)
+            qp = st.query_params if hasattr(st, 'query_params') else st.experimental_get_query_params()
+            get_q = lambda k: qp.get(k, None) if hasattr(st, 'query_params') else (qp.get(k, [None])[0] if isinstance(qp.get(k, None), list) else qp.get(k, None))
         except Exception:
-            qp = st.experimental_get_query_params()
-            get_q = lambda k: (qp.get(k, [None])[0] if isinstance(qp.get(k, None), list) else qp.get(k, None))
+            # Fallback for older Streamlit versions
+            import urllib.parse as urlparse
+            qp = {}
+            get_q = lambda k: None
 
         q_type = get_q("type")
+        access_token = get_q("access_token")
+        refresh_token = get_q("refresh_token")
+        
+        # Debug info (remove in production)
+        if os.getenv("DEBUG_MODE") == "true" and st.checkbox("Show debug info"):
+            st.write("Query params:", dict(qp) if hasattr(qp, 'items') else qp)
+            st.write("Type:", q_type)
+            st.write("Has access token:", bool(access_token))
+            st.write("Has refresh token:", bool(refresh_token))
+
         if q_type == "recovery":
-            st.info("Reset password: silakan masukkan password baru Anda.")
-            access_token = get_q("access_token")
-            refresh_token = get_q("refresh_token")
-            with st.form("reset_password_form"):
-                npw = st.text_input("Password Baru", type="password")
-                npw2 = st.text_input("Konfirmasi Password Baru", type="password")
-                submit_reset = st.form_submit_button("Set Password Baru")
+            st.success("🔑 Halaman Reset Password")
+            st.info("Silakan masukkan password baru Anda di bawah ini.")
+            
+            with st.form("reset_password_form", clear_on_submit=False):
+                st.markdown("### Set Password Baru")
+                new_password = st.text_input("Password Baru", type="password", help="Minimal 6 karakter")
+                confirm_password = st.text_input("Konfirmasi Password Baru", type="password")
+                submit_reset = st.form_submit_button(" Update Password", use_container_width=True)
+                
             if submit_reset:
-                if not npw or len(npw) < 6:
-                    st.error("Password minimal 6 karakter.")
-                elif npw != npw2:
-                    st.error("Konfirmasi password tidak sama.")
+                if not new_password:
+                    st.error(" Password tidak boleh kosong.")
+                elif len(new_password) < 6:
+                    st.error(" Password minimal 6 karakter.")
+                elif new_password != confirm_password:
+                    st.error(" Konfirmasi password tidak sama.")
                 elif not access_token or not refresh_token:
-                    st.error("Token pemulihan tidak ditemukan. Coba klik ulang tautan dari email.")
+                    st.error(" Token pemulihan tidak valid. Silakan klik ulang tautan dari email.")
+                    st.info("💡 Tip: Pastikan Anda mengklik tautan langsung dari email tanpa menyalin-paste.")
                 else:
                     try:
-                        # Set current session using tokens from redirect
-                        supabase.auth.set_session(access_token, refresh_token)
-                        # Update user password
-                        supabase.auth.update_user({"password": npw})
-                        st.success("Password berhasil diubah. Silakan login kembali.")
-                        # Optional: clear recovery query params
-                        try:
-                            # Best-effort to clear params
-                            st.markdown(
-                                """
-                                <script>
-                                (function(){
-                                  const qp = new URLSearchParams(window.location.search);
-                                  ["type","access_token","refresh_token","expires_in","expires_at","token_type"].forEach(k=>qp.delete(k));
-                                  const newUrl = window.location.pathname + (qp.toString()?('?'+qp.toString()):'');
-                                  window.history.replaceState(null, '', newUrl);
-                                })();
-                                </script>
-                                """,
-                                unsafe_allow_html=True,
-                            )
-                        except Exception:
-                            pass
+                        with st.spinner("Mengupdate password..."):
+                            # Set session dengan token dari URL
+                            supabase.auth.set_session(access_token, refresh_token)
+                            
+                            # Update password
+                            result = supabase.auth.update_user({"password": new_password})
+                            
+                            if result:
+                                st.success(" Password berhasil diubah!")
+                                st.info("🔄 Silakan login dengan password baru Anda.")
+                                
+                                # Clear query parameters setelah sukses
+                                st.markdown(
+                                    """
+                                    <script>
+                                    if (typeof window !== 'undefined') {
+                                        setTimeout(function() {
+                                            try {
+                                                var params = ['type', 'access_token', 'refresh_token', 'expires_in', 'expires_at', 'token_type'];
+                                                var search = new URLSearchParams(window.location.search);
+                                                var changed = false;
+                                                
+                                                for (var i = 0; i < params.length; i++) {
+                                                    if (search.has(params[i])) {
+                                                        search.delete(params[i]);
+                                                        changed = true;
+                                                    }
+                                                }
+                                                
+                                                if (changed) {
+                                                    var newUrl = window.location.pathname;
+                                                    if (search.toString()) {
+                                                        newUrl += '?' + search.toString();
+                                                    }
+                                                    window.history.replaceState({}, document.title, newUrl);
+                                                }
+                                                
+                                                if (typeof sessionStorage !== 'undefined') {
+                                                    sessionStorage.removeItem('hash_migrated');
+                                                }
+                                                
+                                                // Optional: reload page to show login form
+                                                setTimeout(function() { window.location.reload(); }, 2000);
+                                            } catch (e) {
+                                                console && console.log && console.log('Cleanup error:', e);
+                                                window.location.reload();
+                                            }
+                                        }, 1000);
+                                    }
+                                    </script>
+                                    """,
+                                    unsafe_allow_html=True
+                                )
+                            else:
+                                st.error(" Gagal mengubah password. Silakan coba lagi.")
+                                
                     except Exception as e:
-                        st.error(f"Gagal mengubah password: {e}")
-            # When in recovery mode, do not render login/register tabs
-            return
+                        st.error(f" Error: {str(e)}")
+                        st.info("💡 Jika masalah berlanjut, minta tautan reset password baru.")
+            
+            # Tampilkan tombol untuk kembali ke login
+            if st.button("← Kembali ke Login", use_container_width=True):
+                # Clear query params and reload
+                st.markdown(
+                    """
+                    <script>
+                    if (typeof window !== 'undefined') {
+                        try {
+                            var params = ['type', 'access_token', 'refresh_token', 'expires_in', 'expires_at', 'token_type'];
+                            var search = new URLSearchParams(window.location.search);
+                            
+                            for (var i = 0; i < params.length; i++) {
+                                search.delete(params[i]);
+                            }
+                            
+                            var newUrl = window.location.pathname;
+                            if (search.toString()) {
+                                newUrl += '?' + search.toString();
+                            }
+                            
+                            window.history.replaceState({}, document.title, newUrl);
+                            
+                            if (typeof sessionStorage !== 'undefined') {
+                                sessionStorage.removeItem('hash_migrated');
+                            }
+                            
+                            window.location.reload();
+                        } catch (e) {
+                            window.location.href = window.location.pathname;
+                        }
+                    }
+                    </script>
+                    """,
+                    unsafe_allow_html=True
+                )
+            
+            return  # Exit early, don't show other tabs
 
-        # Auth tabs inside wrapper
-        tab_login, tab_register, tab_forgot = st.tabs(["Login", "Register", "Forgot Password"])
+        # Auth tabs inside wrapper (only show when not in recovery mode)
+        tab_login, tab_register, tab_forgot = st.tabs([" Login", "📝 Register", "🔑 Forgot Password"])
 
         with tab_login:
+            st.markdown("### Masuk ke Akun Anda")
             with st.form("login_form"):
-                email = st.text_input("Email")
-                password = st.text_input("Password", type="password")
-                submitted = st.form_submit_button("Login")
+                email = st.text_input(" Email", placeholder="contoh@email.com")
+                password = st.text_input(" Password", type="password")
+                submitted = st.form_submit_button(" Login", use_container_width=True)
+                
             if submitted:
+                if not email or not password:
+                    st.error(" Email dan password harus diisi.")
+                    return
+                    
                 # Demo password fallback
                 shared_pw = os.getenv("APP_DEMO_PASSWORD")
                 if shared_pw and password == shared_pw:
                     st.session_state["user"] = {"id": "demo-user", "email": email or "demo@example.com"}
-                    st.success("Login demo berhasil")
+                    st.success(" Login demo berhasil")
                     st.rerun()
+                    return
+                
                 try:
-                    auth_res = supabase.auth.sign_in_with_password({
-                        "email": email,
-                        "password": password,
-                    })
-                    user = getattr(auth_res, "user", None)
-                    if user:
-                        st.session_state["user"] = {"id": user.id, "email": getattr(user, "email", email)}
-                        session_obj = getattr(auth_res, "session", None)
-                        if session_obj:
-                            st.session_state["sb_session"] = {
-                                "access_token": getattr(session_obj, "access_token", None),
-                                "refresh_token": getattr(session_obj, "refresh_token", None),
-                            }
-                        st.success("Login berhasil")
-                        st.rerun()
-                    else:
-                        st.error("Email atau password salah.")
+                    with st.spinner("Logging in..."):
+                        auth_res = supabase.auth.sign_in_with_password({
+                            "email": email,
+                            "password": password,
+                        })
+                        user = getattr(auth_res, "user", None)
+                        if user:
+                            st.session_state["user"] = {"id": user.id, "email": getattr(user, "email", email)}
+                            session_obj = getattr(auth_res, "session", None)
+                            if session_obj:
+                                st.session_state["sb_session"] = {
+                                    "access_token": getattr(session_obj, "access_token", None),
+                                    "refresh_token": getattr(session_obj, "refresh_token", None),
+                                }
+                            st.success(" Login berhasil!")
+                            st.rerun()
+                        else:
+                            st.error(" Email atau password salah.")
                 except Exception as e:
-                    st.error(f"Gagal login: {e}")
+                    st.error(f" Gagal login: {str(e)}")
 
         with tab_register:
-            st.caption("Buat akun baru. Anda akan menerima email konfirmasi.")
+            st.markdown("### Buat Akun Baru")
+            st.caption(" Anda akan menerima email konfirmasi setelah registrasi.")
             with st.form("register_form"):
-                r_email = st.text_input("Email", key="reg_email")
-                r_password = st.text_input("Password", type="password", key="reg_password")
-                r_password2 = st.text_input("Konfirmasi Password", type="password", key="reg_password2")
-                submitted_r = st.form_submit_button("Register")
+                r_email = st.text_input(" Email", key="reg_email", placeholder="contoh@email.com")
+                r_password = st.text_input(" Password", type="password", key="reg_password", help="Minimal 6 karakter")
+                r_password2 = st.text_input(" Konfirmasi Password", type="password", key="reg_password2")
+                submitted_r = st.form_submit_button("📝 Daftar", use_container_width=True)
+                
             if submitted_r:
-                if r_password != r_password2:
-                    st.error("Password tidak sama.")
+                if not r_email or not r_password:
+                    st.error(" Email dan password harus diisi.")
+                elif len(r_password) < 6:
+                    st.error(" Password minimal 6 karakter.")
+                elif r_password != r_password2:
+                    st.error(" Konfirmasi password tidak sama.")
                 else:
                     try:
-                        # Prefer explicit env, then generic site URL, then localhost for dev
-                        redirect_url = os.getenv(
-                            "SUPABASE_EMAIL_REDIRECT",
-                            os.getenv("NEXT_PUBLIC_SITE_URL", "https://yozora721-pnp-chatbot-v1.hf.space/"),
-                        )
-                        supabase.auth.sign_up({
-                            "email": r_email,
-                            "password": r_password,
-                            "options": {"email_redirect_to": redirect_url}
-                        })
-                        st.success("Registrasi berhasil. Silakan cek email untuk konfirmasi.")
+                        with st.spinner("Mendaftarkan akun..."):
+                            # Set redirect URL dengan prioritas yang lebih clear
+                            redirect_url = os.getenv("SUPABASE_EMAIL_REDIRECT")
+                            if not redirect_url:
+                                redirect_url = os.getenv("NEXT_PUBLIC_SITE_URL", "https://yozora721-pnp-chatbot-v1.hf.space/")
+                            
+                            supabase.auth.sign_up({
+                                "email": r_email,
+                                "password": r_password,
+                                "options": {"email_redirect_to": redirect_url}
+                            })
+                            st.success(" Registrasi berhasil!")
+                            st.info(" Silakan cek email untuk konfirmasi akun.")
                     except Exception as e:
-                        st.error(f"Gagal registrasi: {e}")
+                        st.error(f" Gagal registrasi: {str(e)}")
 
         with tab_forgot:
-            st.caption("Kirim tautan reset password ke email Anda.")
+            st.markdown("### Reset Password")
+            st.caption(" Kami akan mengirim tautan reset password ke email Anda.")
             with st.form("forgot_form"):
-                f_email = st.text_input("Email", key="forgot_email")
-                submitted_f = st.form_submit_button("Kirim Link Reset")
+                f_email = st.text_input(" Email", key="forgot_email", placeholder="contoh@email.com")
+                submitted_f = st.form_submit_button(" Kirim Link Reset", use_container_width=True)
+                
             if submitted_f:
-                try:
-                    # Prefer explicit env, then generic site URL, then localhost for dev
-                    redirect_url = os.getenv(
-                        "SUPABASE_EMAIL_REDIRECT",
-                        os.getenv("NEXT_PUBLIC_SITE_URL", "https://yozora721-pnp-chatbot-v1.hf.space/"),
-                    )
-                    supabase.auth.reset_password_for_email(f_email, {"redirect_to": redirect_url})
-                    st.success("Email reset password telah dikirim. Periksa kotak masuk Anda.")
-                except Exception as e:
-                    st.error(f"Gagal mengirim email reset password: {e}")
+                if not f_email:
+                    st.error(" Email harus diisi.")
+                else:
+                    try:
+                        with st.spinner("Mengirim email reset..."):
+                            # Set redirect URL dengan prioritas yang lebih clear
+                            redirect_url = os.getenv("SUPABASE_EMAIL_REDIRECT")
+                            if not redirect_url:
+                                redirect_url = os.getenv("NEXT_PUBLIC_SITE_URL", "https://yozora721-pnp-chatbot-v1.hf.space/")
+                                
+                            supabase.auth.reset_password_for_email(
+                                f_email, 
+                                {"redirect_to": redirect_url}
+                            )
+                            st.success(" Email reset password telah dikirim!")
+                            st.info(" Periksa kotak masuk (dan folder spam) untuk tautan reset password.")
+                    except Exception as e:
+                        st.error(f" Gagal mengirim email: {str(e)}")