Files
project-manager/web/src/views/ProfileView.vue
T
aneurinandClaude Sonnet 5 f9b65cc4a7 Add stage 7: email verification magic links and a profile page
Backend
- New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail()
  (the default fallback), and log-to-file transports, selected by
  MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token
  and sends the link (APP_URL/verify-email?token=...).
- Migration 005: email_verifications table + users.verification_email_sent_at.
- Registration now emails a verification link (best effort — a send failure
  doesn't fail registration).
- POST /api/auth/verify-email consumes a token and returns a session, so
  opening the link verifies the address (or applies a pending email change)
  and logs the user in. Single-use; distinct 400s for invalid/used/expired.
- POST /api/email/verification resends; POST /api/email/change requests a
  deferred change (current password required; link goes to the new address;
  users.email only updates when that link is opened). Both throttled to once
  per 60s, returning 429 + retry_after.
- GET /api/me and every session payload now include pending_email. Shared
  SessionPayload builds the user/session JSON for all entry points.

Frontend
- /verify-email view: posts the token, adopts the returned session, redirects.
- /profile view: shows address + status, a resend button with a live cooldown
  (driven by retry_after / 429), and a change-email form (new address +
  current password) that surfaces the pending change.
- Header shows a "verify email" badge linking to the profile.

Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle,
and deferred change; AuthTest folded into ApiTestCase, which now routes mail
to a per-test log. Suite: 32 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-03 20:04:49 +01:00

140 lines
4.5 KiB
Vue

<script setup lang="ts">
import { computed, onBeforeUnmount, ref } from 'vue'
import { ApiError } from '../lib/api'
import { useAuthStore } from '../stores/auth'
const auth = useAuthStore()
const cooldown = ref(0)
let timer: ReturnType<typeof setInterval> | undefined
function startCooldown(seconds: number) {
cooldown.value = Math.max(0, Math.ceil(seconds))
clearInterval(timer)
timer = setInterval(() => {
cooldown.value -= 1
if (cooldown.value <= 0) clearInterval(timer)
}, 1000)
}
onBeforeUnmount(() => clearInterval(timer))
// --- resend verification -------------------------------------------------
const resending = ref(false)
const resendMessage = ref('')
const resendError = ref('')
async function onResend() {
resending.value = true
resendMessage.value = ''
resendError.value = ''
try {
const retryAfter = await auth.resendVerification()
resendMessage.value = `Sent. Check ${auth.user?.email}.`
startCooldown(retryAfter)
} catch (e) {
if (e instanceof ApiError) {
resendError.value = e.message
if (e.status === 429) startCooldown(e.retryAfter ?? 60)
} else {
resendError.value = 'Could not send the email.'
}
} finally {
resending.value = false
}
}
// --- change email ------------------------------------------------------
const newEmail = ref('')
const password = ref('')
const changing = ref(false)
const changeMessage = ref('')
const changeError = ref<ApiError | null>(null)
async function onChangeEmail() {
changing.value = true
changeMessage.value = ''
changeError.value = null
try {
const { pending_email, retry_after } = await auth.requestEmailChange(newEmail.value, password.value)
changeMessage.value = `Confirmation link sent to ${pending_email}. Your address changes once you open it.`
newEmail.value = ''
password.value = ''
startCooldown(retry_after)
} catch (e) {
changeError.value = e instanceof ApiError ? e : new ApiError('Could not request the change.', 0)
if (e instanceof ApiError && e.status === 429) startCooldown(e.retryAfter ?? 60)
} finally {
changing.value = false
}
}
const resendLabel = computed(() => {
if (resending.value) return 'Sending…'
if (cooldown.value > 0) return `Resend in ${cooldown.value}s`
return 'Resend verification email'
})
</script>
<template>
<section class="card">
<p><RouterLink to="/">&larr; Back to lists</RouterLink></p>
<h1>Your profile</h1>
<p><strong>Email:</strong> {{ auth.user?.email }}</p>
<p>
<strong>Status:</strong>
<span v-if="auth.emailVerified">verified</span>
<span v-else class="badge badge--warn">not verified</span>
</p>
<div v-if="auth.user?.pending_email" class="notice">
A change to <strong>{{ auth.user.pending_email }}</strong> is pending. Open the
link we sent to that address to complete it. The link expires 15 minutes
after it was sent.
</div>
<section v-if="!auth.emailVerified">
<h2>Verify your email</h2>
<p class="muted">
We sent a link to {{ auth.user?.email }}. It expires 15 minutes after
it's sent. You can resend it once a minute.
</p>
<button type="button" :disabled="resending || cooldown > 0" @click="onResend">
{{ resendLabel }}
</button>
<p v-if="resendMessage" class="muted">{{ resendMessage }}</p>
<p v-if="resendError" class="form-error">{{ resendError }}</p>
</section>
<section>
<h2>Change email address</h2>
<form class="form" @submit.prevent="onChangeEmail">
<label>
<span>New email</span>
<input v-model="newEmail" type="email" maxlength="255" required />
<small v-if="changeError?.fieldError('email')" class="field-error">
{{ changeError.fieldError('email') }}
</small>
</label>
<label>
<span>Current password</span>
<input v-model="password" type="password" autocomplete="current-password" required />
<small v-if="changeError?.fieldError('password')" class="field-error">
{{ changeError.fieldError('password') }}
</small>
</label>
<p v-if="changeError && Object.keys(changeError.details).length === 0" class="form-error">
{{ changeError.message }}
</p>
<p v-if="changeMessage" class="muted">{{ changeMessage }}</p>
<button type="submit" :disabled="changing || cooldown > 0">
{{ changing ? 'Sending' : cooldown > 0 ? `Wait ${cooldown}s` : 'Send confirmation link' }}
</button>
</form>
</section>
</section>
</template>