fix: firebase user email actions changed

[Alessandro100]

Summary:

When a user requested a reset password action, the link coming from the reset password email was not correct
ex: https://mobilitydatabase.org/email-verification?mode=resetPassword&oobCode=y&apiKey=x

This happened because when we changed the action link in the firebase console for the email verification, it auto applied it to all the actions email-verification password-reset

The solution was to include a generic action link /auth/action that will redirect the user to the correct page depending on the mode firebase provides

Expected behavior:

When a user needs to verify their email address or reset their password, the link given to them in the email should succeed

Testing tips:

Important

For the firebase dev environment we use https://mobilitydatabase.org/auth/action because there is no stable dev environment, all you need to do is replace https://mobilitydatabase.org/ with the preview url and it will work. This is the link you will find in the email

1. Create a new account and verify your email using the link in the email
2. Once this account is created, log out and do a reset password. Use the link in the email
3. Login with the new password

To Note
There are 2 more unaccounted firebase actions that we do not have pages for because we do not support them

• email address change
• multi factor enrollment

Once this gets merged to production I will change the action urls in firebase console prod

Please make sure these boxes are checked before submitting your pull request - thanks!

• Run the unit tests with yarn test to make sure you didn't break anything
• Add or update any needed documentation to the repo
• Format the title like "feat: [new feature short description]". Title must follow the Conventional Commit Specification(https://www.conventionalcommits.org/en/v1.0.0/).
• Linked all relevant issues
• Include screenshot(s) showing how this pull request works and fixes the issue(s)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mobilitydatabase-web	Ready	Preview	Sep 28, 2026 5:01pm UTC

[Copilot]

Copilot review overview

🟡 Changes recommended

Transient verification failures become terminal, repeated query parameters can cause a 500 response, and the core reset workflow lacks coverage.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Handle array-valued query parameters before trimming reset values · New
• Add retry handling for transient password reset verification failures · New
• Add state machine tests for Firebase password reset flows · New

What changed in this PR

Adds a generic Firebase auth-action route that dispatches email verification and password-reset links to localized handlers.

Changes:

• Adds Firebase action routing with locale resolution and backward compatibility.
• Implements the password-reset form and error handling.
• Adds translations and unit tests for routing/error helpers.
• Applied Vercel React best practices during review.

File	Description
ResetPassword.tsx	Implements the password-reset workflow.
reset-password/​page.tsx	Exposes the reset-password route.
reset-password-errors.ts	Maps Firebase reset errors.
reset-password-errors.spec.ts	Tests error mapping.
email-verification/​page.tsx	Redirects legacy action links.
auth/​action/​page.tsx	Adds the generic Firebase action entry point.
auth-actions.ts	Resolves action targets and locales.
auth-actions.spec.ts	Tests action resolution.
AuthActionError.tsx	Displays unsupported-action errors.
messages/​fr.json	Adds French translations.
messages/​en.json	Adds English translations.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

*Lighthouse ran on https://mobilitydatabase-ehwi6nk5b-mobility-data.vercel.app/ * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance	Accessibility	Best Practices	SEO
🟢 98	🟢 94	🟢 96	🟢 100

*Lighthouse ran on https://mobilitydatabase-ehwi6nk5b-mobility-data.vercel.app/feeds * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance	Accessibility	Best Practices	SEO
🟢 91	🟠 87	🟢 96	🟢 100

*Lighthouse ran on https://mobilitydatabase-ehwi6nk5b-mobility-data.vercel.app/feeds/gtfs/mdb-2126 * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance	Accessibility	Best Practices	SEO
🔴 43	🟢 94	🟢 96	🟢 100

*Lighthouse ran on https://mobilitydatabase-ehwi6nk5b-mobility-data.vercel.app/feeds/gtfs_rt/mdb-2585 * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance	Accessibility	Best Practices	SEO
🟠 85	🟠 84	🟢 96	🟢 100

*Lighthouse ran on https://mobilitydatabase-ehwi6nk5b-mobility-data.vercel.app/feeds/gbfs/gbfs-flamingo_porirua * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance	Accessibility	Best Practices	SEO
🟢 91	🟢 94	🟢 96	🟢 100

[davidgamez]

LGTM