3 Commits

Author	SHA1	Message	Date
admins	2790a7d24b	Wire up email verification flow for new signups ... requireEmailVerification was enabled but no sendVerificationEmail was configured — new users saw "check your email", never received anything, and couldn't log in (403 shown as "wrong email or password"). - email.ts: add verification email template; welcome email no longer claims the account is "confirmed" - auth.ts: configure emailVerification (send on signup, resend on unverified login attempt, auto sign-in after verification, 24h TTL) - register route: callbackURL=/dashboard so the verify link lands in the cabinet - login form: distinguish 403 (unverified — tell user a fresh link was sent) and 429 (rate limit) from wrong credentials Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-12 14:01:46 +05:00
admins	8240db5d22	Make registration errors informative ... - Backend: explicitly return 409 EMAIL_TAKEN when the email already exists, instead of Better Auth's silent 200 (common after migration). - Frontend: split error handling — network failure, non-JSON body (502/proxy), and meaningful server errors get distinct messages; the "email already registered" case shows login / reset-password links instead of a generic "connection error". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-12 13:20:56 +05:00
admins	231ed083be	Add anti-bot registration protection ... - Custom /api/register route: honeypot, disposable email blocking, Cloudflare Turnstile verification - Register form: honeypot hidden field, Turnstile widget (loads when NEXT_PUBLIC_TURNSTILE_SITE_KEY set) - Install disposable-email-domains package - Add NEXT_PUBLIC_TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY env vars to .env.example Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-26 12:35:06 +05:00