* fix(auth): email-change recovery re-send and confirmation feedback
A half-completed secure email change was a dead end: the pending-address
short-circuit in /api/account/email swallowed every retry without
re-sending mails, so once the confirmation links expired the user could
never recover, and confirmation clicks landed on the dashboard with no
feedback at all.
- /api/account/email: only short-circuit a repeat request while the
pending mails are fresh (30 min); a stale pending change falls through
to GoTrue, which restarts the change and re-sends both mails
- /auth/callback: type=email_change now redirects to a status page
(/auth/email-change) that says whether one click remains, the change
is complete, or the link was dead, instead of landing silently
- auth mail templates: both email-change mails explain that two mails
are sent and both links must be clicked
- settings: the save button re-enables for the pending address as
Skicka igen, so users can trigger the re-send themselves
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p
* fix(auth): exempt email-change confirmations from the authenticated /auth bounce (skeptic findings)
- middleware: let /auth/email-change and /auth/callback?type=email_change
through for authenticated users; the bounce to / swallowed confirmation
clicks before verifyOtp ran (pre-existing since #2017)
- email-change done page resolves the WL-14 landing destination for the CTA
- /api/account/email returns resent flag; settings toast says mails were
already sent instead of claiming a fresh send
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(account): self-service login email change with double confirmation
New POST /api/account/email requests the change via the user session so
Supabase's AAL2 guard applies, and the account settings page gets an email
row with pending-confirmation state. Confirmation mails (both addresses)
and the /auth/callback email_change verification already existed; this
wires the missing initiation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p
* feat(account): map email_exists to a 409 with Swedish copy
Changing to an address that already has an account is refused by GoTrue
(addresses are unique per auth user); surface that as a clear conflict
instead of the generic fallback.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p
* fix(account): trusted redirect origin + profiles.email sync trigger (skeptic findings)
- emailRedirectTo now derives from resolveRequestAppOrigin(): request.url
can be an internal origin behind a proxy (dead confirmation links on
self-hosted) and auth links must not follow attacker-chosen hosts;
registered white-label hosts keep their brand.
- New migration 20260828191950: sync_profile_email trigger mirrors
auth.users.email changes into profiles.email (member lists, notification
recipients, AGI/KU contact, invite dedup all read profiles.email), plus a
backfill for already-diverged rows. pg-real test included.
- Save button disabled while the same address awaits confirmation (no
rate-limit re-fires); GoTrue's 'error sending email change email' now maps
to the Swedish SMTP guidance.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p
* fix(account): idempotent repeat request for the pending address
CodeRabbit follow-up: a second POST for the address already awaiting
confirmation now returns the pending state without another GoTrue round
trip (no duplicate confirmation mails, no rate-limit burn). Claims-mapped
sessions lack new_email; GoTrue's send rate limit remains the backstop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson