Task/email verification

[mateuszpolis]

Email Verification System Implementation

Overview

This PR implements a secure email verification system for user registration, enhancing account security and preventing unauthorized access. The implementation follows security best practices and includes comprehensive test coverage.

Key Features

• 🔐 Secure email verification flow with JWT tokens
• 🛡️ Prevention of email enumeration attacks
• 📧 Common email template system for consistent styling
• 🔄 Resend verification functionality
• ✅ Comprehensive test coverage

Changes

Database

• Added email verification fields to users table:
  • emailVerified (boolean)
  • email_verification_token (text)
  • email_verification_expires (timestamp)

Authentication Flow

• Modified registration process to require email verification
• Updated sign-in to block unverified users
• Added email verification status checks
• Implemented secure token-based verification

API Endpoints

• /api/auth/register: Updated to create unverified accounts
• /api/auth/verify-email: New endpoint for email verification
• /api/auth/resend-verification: New endpoint for requesting new verification emails

Frontend

• New verification email page with success/error states
• Resend verification form with security-focused UX
• Updated sign-up form to handle verification flow
• Enhanced sign-in form with verification status feedback

Security Improvements

• JWT-based verification tokens with 24-hour expiration
• Prevention of email enumeration attacks
• Secure token validation and storage
• Rate limiting on verification attempts

Testing

• Added comprehensive test suites for:
  • API endpoints
  • UI components
  • Security scenarios
  • Error handling
• Updated existing tests to match new verification flow

Testing Instructions

1. Register a new account
2. Check email for verification link
3. Verify email through the link
4. Test resend verification functionality
5. Verify sign-in works after verification

Security Considerations

• All verification tokens expire after 24 hours
• Email enumeration attacks are prevented
• JWT tokens are signed with server secret
• Verification status is properly checked during authentication

[Copilot]

Pull Request Overview

This PR implements a secure email verification system for user registration by introducing new API endpoints, updating authentication flows, enhancing DB schema/migrations, and adding comprehensive test coverage. Key changes include:

• Secure token-based email verification integrated into registration and sign-in flows.
• New UI components and endpoints for email verification and resend functions.
• Expanded tests ensuring correct behavior in various scenarios.

Reviewed Changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/components/auth/sign-up-form.test.tsx	Updated tests to validate success messaging and redirection after registration.
tests/app/auth/verify-email/[token]/page.test.tsx	Added tests ensuring proper handling of the email verification page.
tests/app/auth/resend-verification/page.test.tsx	Included tests for the resend verification email page and its various states.
tests/api/auth/verify-email.test.ts	Introduced API tests covering various error and success scenarios for email verification.
tests/api/auth/resend-verification.test.ts	Added tests to simulate resend verification email behavior and security responses.
tests/api/auth/register.test.ts	Updated registration tests to account for email verification token generation and messaging.
lib/users/actions.ts	Added functions to update, validate, and verify user email tokens.
lib/db/schema/users.ts	Extended schema to include email verification fields with default values.
lib/db/migrations/*	New migration files to add email verification related fields to the users table.
lib/auth.ts	Updated login flow to block access for unverified or inactive accounts.
lib/actions.ts	Added a common email template and email verification sending function.
components/auth/sign-up-form.tsx	Modified sign-up form to display a success message and clear inputs before redirecting.
components/auth/sign-in-form.tsx	Enhanced sign-in form to show additional guidance when email verification is pending.
app/auth/verify-email/[token]/page.tsx	Created a new verification page component for handling and displaying verification statuses.
app/auth/resend-verification/page.tsx	Built a new page for resending verification emails with appropriate UI states.
app/api/auth/verify-email/route.ts	Developed an API route to process email verification requests securely.
app/api/auth/resend-verification/route.ts	Developed an API route to process resend verification requests with security in mind.
app/api/auth/register/route.ts	Updated registration API to generate and email verification tokens upon new account creation.

Comments suppressed due to low confidence (3)

components/auth/sign-up-form.tsx:74

• [nitpick] Consider replacing the fixed timeout redirection with a more deterministic approach (e.g., using router.replace after ensuring the success message has been read) for improved user experience.

setTimeout(() => { router.push("/auth/sign-in") }, 2000)

components/auth/sign-in-form.tsx:59

• Ensure that the toast library supports rendering React components when passing JSX directly in error messages to avoid unexpected rendering issues.

if (result.error.includes('verify your email')) {

lib/db/migrations/0012_email_verification_token.sql:1

• Remove or reposition inline comment markers (e.g., '--> statement-breakpoint') to prevent potential SQL parsing issues.

ALTER TABLE "users" ADD COLUMN "email_verified" boolean DEFAULT false NOT NULL;--> statement-breakpoint

[github-actions]

Coverage report

The coverage rate went from 88.0% to 88.15% ⬆️

The branch rate is 73.2%

91% of new lines are covered.

Diff Coverage details (click to unfold)

app/auth/verify-email/[token]/page.tsx

90.0% of new lines are covered

app/api/auth/resend-verification/route.ts

100.0% of new lines are covered

app/auth/resend-verification/page.tsx

92.5925925925926% of new lines are covered

lib/auth.ts

0.0% of new lines are covered

app/api/auth/verify-email/route.ts

91.66666666666667% of new lines are covered

lib/db/schema/users.ts

100.0% of new lines are covered

components/auth/sign-up-form.tsx

100.0% of new lines are covered

app/api/auth/register/route.ts

100.0% of new lines are covered

components/auth/sign-in-form.tsx

100.0% of new lines are covered

[TheRealSeber]

cinema