* fix(auth): land stock email-change links on the status page and stop retries voiding pending mails
A secure email change needs one click in each mailbox. Stock GoTrue links
verify on the GoTrue host and return to /auth/callback through redirect_to
with ?message= (first click), ?error= (dead link) or ?code= (completing
click); none carries a token_hash, so the callback bounced every one of
them to /login with no message. Users read that as a failure and pressed
"Byt" again, and because the claims fast path carries no new_email, the
route re-issued both tokens on every press and voided the links they were
about to click.
- /api/account/email stamps flow=email_change on emailRedirectTo and reads
pending state from GoTrue when the session claims lack it, so a repeat
request inside the 30-minute window is a no-op instead of a re-send.
- /auth/callback routes flow=email_change redirects to
/auth/email-change?status=partial|done|failed; hook-style token_hash
links keep using the existing verifyOtp branch.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LMFybWJqw8vScQiEDwKXGi
* fix(auth): let signed-in stock email-change redirects through the proxy and treat a minted code as done
Skeptic findings on e5639fb43:
- The proxy bounced authenticated /auth/callback requests to / unless they
carried type=email_change. Stock GoTrue links return with only the
flow=email_change marker, so the new status branch was unreachable from
the signed-in browser the change usually starts in. Exempt the marker too.
- A completing click opened in a browser without the PKCE verifier (phone
mail app) failed the code exchange and, with no session to inspect, was
reported as a failed change although GoTrue had already flipped the
address. A code is only minted after that verify, so report done.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LMFybWJqw8vScQiEDwKXGi
* fix(auth): gate email-change requests with an atomic per-user claim
CodeRabbit on PR #2199: the pending-state read from GoTrue is not atomic,
so two concurrent POST /api/account/email calls (two tabs, a retried
fetch) could both see nothing pending and both re-issue the confirmation
tokens, voiding each other's mails.
Migration 20260903083000 adds email_change_requests (one row per auth
user, RLS with no policies) and two SECURITY DEFINER RPCs:
claim_email_change_request(p_email, p_window_seconds) is a single
INSERT ... ON CONFLICT DO UPDATE whose row lock serialises concurrent
claimers, so exactly one caller per address per window wins; a different
address always wins; release_email_change_request drops the claim when
GoTrue refuses the change so the user can retry.
The route claims right before updateUser, answers resent:false when the
claim is held, releases on GoTrue failure, and falls through to GoTrue if
the RPC itself errors. pg-real test covers sequential, windowed,
concurrent, per-user, release and RLS behaviour. Applied to staging with
the same version.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LMFybWJqw8vScQiEDwKXGi
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
