sfbrigade / sf-lifeline

GNU Affero General Public License v3.0

7 stars 4 forks source link

[Closes #96] User can verify their account using email token #100

Closed javtran closed 3 months ago

javtran commented 3 months ago

96

New API route for verifying with emailVerificationToken
Test added for new route
Added new client page to handle email verification. Notifies whether token is invalid or account is successfully verified

javtran commented 3 months ago

This looks good! A few things that I think we should change looking a bit closer...

Since we're verifying through a link, let's make the verification token a full UUID string so that it's harder to spoof.

After a successful verification and setting the emailVerifiedAt, let's also clear the token from the User's record.

I think we're missing a UNIQUE constraint on the emailVerificationToken column in the schema...

I addressed the changes!