feat(auth): add configurable email verification enforcement

Auth:RequireEmailVerification (default off) gates whether local register requires confirming email before login. OAuth new-user paths are untouched -- Google/Microsoft already assert a verified email. Adds verify-email and resend-verification-email endpoints, mirroring the existing reset-password enumeration-avoidance and rate-limiting patterns, plus a login-embedded resend affordance and a verify-email landing page on the frontend. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-13 01:22:26 +02:00
parent 0ca2f2b261
commit 904f3a8ec8
9 changed files with 528 additions and 3 deletions
@@ -1,6 +1,6 @@
 import React, { useEffect, useState } from "react";

-import { Box, Button, Checkbox, FormControlLabel, Paper, Tab, Tabs, TextField, Typography } from "@mui/material";
+import { Alert, Box, Button, Checkbox, FormControlLabel, Paper, Tab, Tabs, TextField, Typography } from "@mui/material";

 import { useLocation, useNavigate } from "react-router-dom";

@@ -18,6 +18,7 @@ type AuthConfig = {
  microsoftEnabled: boolean;
  localEnabled: boolean;
  allowRegistration: boolean;
+  requireEmailVerification: boolean;
 };

 export default function LoginPage() {
@@ -34,6 +35,9 @@ export default function LoginPage() {
  const [rememberMe, setRememberMe] = useState(() => getRememberMePref());
  const [loading, setLoading] = useState(false);
  const [pendingToken, setPendingToken] = useState<string | null>(null);
+  const [emailNotVerified, setEmailNotVerified] = useState(false);
+  const [resendingVerification, setResendingVerification] = useState(false);
+  const [verificationResent, setVerificationResent] = useState(false);

  const nextPath = (location?.state?.from as string | undefined) ?? "/dashboard";

@@ -53,6 +57,8 @@ export default function LoginPage() {

  async function submit(mode: "login" | "register") {
    setLoading(true);
+    setEmailNotVerified(false);
+    setVerificationResent(false);
    try {
      const url = mode === "register" ? "/auth/register" : "/auth/login";
      const res = await api.post<{ requiresTwoFactor?: boolean; pendingToken?: string }>(url, { email, password, rememberMe });
@@ -61,13 +67,33 @@ export default function LoginPage() {
        return;
      }
      await completeLogin();
+      if (mode === "register" && cfg?.requireEmailVerification) {
+        toast(t("registerCheckEmailForVerification"), "info");
+      }
    } catch (e: any) {
-      toast(getApiErrorMessage(e, t("loginFailed")), "error");
+      if (mode === "login" && e?.response?.data?.error === "email_not_verified") {
+        setEmailNotVerified(true);
+      } else {
+        toast(getApiErrorMessage(e, t("loginFailed")), "error");
+      }
    } finally {
      setLoading(false);
    }
  }

+  async function resendVerification() {
+    setResendingVerification(true);
+    try {
+      await api.post("/auth/resend-verification-email", { email });
+      setVerificationResent(true);
+      toast(t("verificationEmailResent"), "success");
+    } catch (e: any) {
+      toast(getApiErrorMessage(e, t("verifyEmailFailed")), "error");
+    } finally {
+      setResendingVerification(false);
+    }
+  }
+
  const allowReg = cfg?.allowRegistration ?? false;

  return (
@@ -106,6 +132,18 @@ export default function LoginPage() {

            {tab === 0 && (
              <Box component="form" onSubmit={(e) => { e.preventDefault(); void submit("login"); }} sx={{ display: "flex", flexDirection: "column", gap: 1.5 }}>
+                {cfg?.requireEmailVerification && emailNotVerified && (
+                  <Alert
+                    severity="warning"
+                    action={
+                      <Button color="inherit" size="small" disabled={resendingVerification || verificationResent} onClick={() => void resendVerification()}>
+                        {verificationResent ? t("verificationEmailResent") : t("resendVerificationEmail")}
+                      </Button>
+                    }
+                  >
+                    {t("emailNotVerified")}
+                  </Alert>
+                )}
                <TextField label={t("profileEmail")} value={email} onChange={(e) => setEmail(e.target.value)} autoComplete="email" fullWidth />
                <TextField label={t("profileCurrentPassword")} value={password} onChange={(e) => setPassword(e.target.value)} autoComplete={allowReg ? "new-password" : "current-password"} type="password" fullWidth />

@@ -0,0 +1,75 @@
+import React, { useEffect, useState } from "react";
+
+import { Alert, Box, Button, CircularProgress, Paper, Typography } from "@mui/material";
+
+import { useNavigate } from "react-router-dom";
+
+import { api, getApiErrorMessage } from "../api";
+import { useI18n } from "../i18n/I18nProvider";
+
+type Status = "verifying" | "success" | "error";
+
+export default function VerifyEmailPage() {
+  const { t } = useI18n();
+  const navigate = useNavigate();
+
+  const [status, setStatus] = useState<Status>("verifying");
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  useEffect(() => {
+    const params = new URLSearchParams(window.location.search);
+    const userId = params.get("userId") || "";
+    const token = params.get("token") || "";
+
+    if (!userId || !token) {
+      setStatus("error");
+      setErrorMessage(t("missingVerifyLinkInfo"));
+      return;
+    }
+
+    api
+      .post("/auth/verify-email", { userId, token })
+      .then(() => setStatus("success"))
+      .catch((e: any) => {
+        setStatus("error");
+        setErrorMessage(getApiErrorMessage(e, t("verifyEmailFailed")));
+      });
+  }, [t]);
+
+  return (
+    <Box
+      sx={{
+        minHeight: "100vh",
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        p: 2,
+        background:
+          "radial-gradient(1200px 700px at 20% 0%, rgba(79,140,255,0.14), transparent 55%), radial-gradient(900px 600px at 80% 20%, rgba(245,158,11,0.10), transparent 55%)",
+      }}
+    >
+      <Paper sx={{ width: "min(520px, 100%)", p: 3 }}>
+        <Typography variant="h5" sx={{ fontWeight: 900, mb: 0.5 }}>
+          {t("verifyEmailTitle")}
+        </Typography>
+
+        <Box sx={{ display: "flex", flexDirection: "column", gap: 1.5, mt: 2 }}>
+          {status === "verifying" && (
+            <Box sx={{ display: "flex", alignItems: "center", gap: 1.5 }}>
+              <CircularProgress size={20} />
+              <Typography sx={{ color: "text.secondary" }}>{t("verifyEmailVerifying")}</Typography>
+            </Box>
+          )}
+          {status === "success" && <Alert severity="success">{t("verifyEmailSuccess")}</Alert>}
+          {status === "error" && <Alert severity="error">{errorMessage}</Alert>}
+
+          <Box sx={{ display: "flex", justifyContent: "flex-end", mt: 1 }}>
+            <Button variant="contained" onClick={() => navigate("/login")}>
+              {t("backToLogin")}
+            </Button>
+          </Box>
+        </Box>
+      </Paper>
+    </Box>
+  );
+}