feat(auth): password reset and email confirmation - #19
Merged
Merged
Conversation
- AuthToken model + migration (hashed, single-use, expiring tokens) and User.emailVerifiedAt; Yandex-created users start verified - Mailer: Resend HTTP API when RESEND_API_KEY/EMAIL_FROM are set, console in development, disabled in production otherwise (GET /auth/features) - POST /auth/forgot-password (no account enumeration), /reset-password (revokes all sessions, verifies email), /verify-email, /resend-verification; sign-up sends a confirmation email - Endpoints routed through api/auth-resource.ts to stay within the Vercel Hobby function limit - Client: forgot/reset/verify pages (tokens in URL hash, StrictMode-safe), forgot link on sign-in, email status and resend on the account page
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Base automatically changed from
feat/error-pages-and-account-linking
to
main
September 29, 2026 19:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #18 (it builds on the account page and auth changes there). Branch auto-delete is now on, so this PR retargets to
mainwhen #18 merges.Summary
Password reset and email confirmation, with email delivery that can be switched on later.
Email delivery (
server/src/lib/mailer.ts)RESEND_API_KEY+EMAIL_FROMset: sends through the Resend HTTP API (no SDK dependency).GET /api/auth/featuresreturns{ email: false }and the UI hides "Forgot password?" and "Send email".Tokens: new
AuthTokentable (migration is additive: one nullable column onUserplus a new table). Only the SHA-256 hash is stored; tokens are single-use and expire (reset 1 h, confirmation 24 h); issuing one invalidates earlier unused tokens of the same type. Links put the token in the URL hash so it never reaches server logs, analytics or Referer headers.Flows
POST /api/auth/forgot-password: same response whether or not the email exists.POST /api/auth/reset-password: sets the password, revokes every session, marks the email verified.POST /api/auth/verify-email;POST /api/auth/resend-verificationfrom the account page. Users created via Yandex start verified.Vercel: the five new endpoints go through one function,
api/auth-resource.ts, plus a rewrite.api/now has 10 of the 12 Hobby functions.Client:
/forgot-password,/reset-password,/verify-emailpages (sharedAuthCard), "Forgot password?" on sign-in, a success notice after a reset, email status and resend on/account. Verification is idempotent per token and the hash is read StrictMode-safely.To enable in production
RESEND_API_KEYandEMAIL_FROM="WidgeCode <noreply@your-domain>"in Vercel.Test plan
format:check,lint,typecheck,test(44 client + 48 server),build,typecheck:api