ATM-183 remove PKCE flow from Supabase auth client

[b-at-neu]

Summary

• Removes flowType: 'pkce' from the Supabase browser client config
• Switches to implicit flow, which returns tokens in the URL hash and is picked up by detectSessionInUrl: true
• Fixes "auth session missing" error after clicking a password reset link — PKCE requires a server-side /auth/callback code exchange that was never implemented

Test plan

• Request a password reset email
• Click the link in the email → lands on /login/confirm
• Click "Reset Password" → redirected to the reset form
• Enter a new password → succeeds without "auth session missing" error
• Sign up as a new user → confirmation email link still works

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
attendance-manager	Ready	Preview, Comment	Apr 13, 2026 1:37am