@webtwizz/cloud 0.2.0 → 0.3.0

package/AI_GUIDE.md

@@ -41,6 +41,8 @@ if (error) setMessage(authMessage(error));
 
 For wording that fits the site, pass overrides: `authMessage(error, { USER_ALREADY_EXISTS: 'You already have a booking account.' })`.
 
+When the owner turns on Confirm email, sign-up returns no session and the 6-digit code is emailed automatically. Show a code step: `authClient.emailOtp.verifyEmail({ email, otp })`, then sign them in, with a "Send a new code" button that calls `authClient.emailOtp.sendVerificationOtp({ email, type: 'email-verification' })`. Never send the first code yourself.
+
 5. Protect pages in `src/proxy.ts`, listing only the protected routes in the matcher (a matcher over every path blocks the sign-in page's own scripts):
 
 ```ts

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @webtwizz/cloud
 
+## 0.3.0
+
+### Minor Changes
+
+- f6f3ed3: When Confirm email is on, the sign-up code now goes out through WebTwizz's own emails: the site's sign-in route asks for it right after a sign-up that needs confirming.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/server.js

@@ -1458,9 +1458,20 @@ function forBrowser(response) {
     return new Response(response.body, { status: response.status, statusText: response.statusText, headers: headers2 });
   }
 }
+async function sendSignUpCode(baseUrl, request, response) {
+  const data = await response.clone().json().catch(() => null);
+  const email = data?.user?.email;
+  if (!email || data.user.emailVerified !== false || data.token) return;
+  await fetch(`${baseUrl.replace(/\/+$/, "")}/email-otp/send-verification-otp`, {
+    method: "POST",
+    headers: { "content-type": "application/json", origin: request.headers.get("origin") || new URL(request.url).origin },
+    body: JSON.stringify({ email, type: "email-verification" })
+  }).catch((error) => console.error("[webtwizz-auth] Could not send the sign-up code", error));
+}
 function createAuth(options = {}) {
+  const baseUrl = options.url ?? env("WEBTWIZZ_AUTH_URL");
   const auth = createNeonAuth({
-    baseUrl: options.url ?? env("WEBTWIZZ_AUTH_URL"),
+    baseUrl,
     cookies: {
       secret: options.secret ?? env("WEBTWIZZ_AUTH_SECRET"),
       sessionDataTtl: options.sessionDataTtl
@@ -1471,7 +1482,14 @@ function createAuth(options = {}) {
   auth.handler = () => {
     const methods = handler();
     const wrap = (method) => async (request, context) => forBrowser(await method(forLibrary(request, (original, headers2) => new Request(original, { headers: headers2 })), context));
-    return { GET: wrap(methods.GET), POST: wrap(methods.POST), PUT: wrap(methods.PUT), DELETE: wrap(methods.DELETE), PATCH: wrap(methods.PATCH) };
+    const post = wrap(methods.POST);
+    const signUp = async (request, context) => {
+      const response = await post(request, context);
+      const { path } = await context.params;
+      if (response.ok && path?.join("/") === "sign-up/email") await sendSignUpCode(baseUrl, request, response);
+      return response;
+    };
+    return { GET: wrap(methods.GET), POST: signUp, PUT: wrap(methods.PUT), DELETE: wrap(methods.DELETE), PATCH: wrap(methods.PATCH) };
   };
   auth.middleware = (config) => {
     const run = middleware(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webtwizz/cloud",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Sign-ins, database and file storage for sites built on WebTwizz Cloud",
   "license": "MIT",
   "type": "module",