sveltekit-auth-example 5.1.2 → 5.5.0

package/CHANGELOG.md

@@ -2,13 +2,41 @@
 
 - Add password complexity checking on /register and /profile pages (only checks for length currently despite what the pages say)
 
+# 5.5.0
+
+- Extract email templates into dedicated files under `src/lib/server/email/` (`password-reset.ts`, `verify-email.ts`)
+- `src/lib/server/email/index.ts` re-exports all templates for clean imports
+
+# 5.1.3
+
+- Session timeout: automatically redirect to /login on session expiry via fetch interceptor (`src/lib/fetch-interceptor.ts`)
+- Add database-level session cleanup on expiry
+- Strengthen Content Security Policy (CSP) in svelte.config.js and vite.config.ts
+- Harden auth endpoints (forgot password, Google OAuth, register, password reset)
+
 # 5.1.2
 
 - Dark mode
+- Rate limiting on auth endpoints
+- Email verification for new registrations
+- Refactor state management: replace `stores.ts` with Svelte 5 `$state`-based `AppState` class (`src/lib/app-state.svelte.ts`)
+- Split single `[slug]` auth handler into dedicated endpoints: login, register, google, logout, reset
+- Add `auth-redirect.ts` helper for consistent post-auth redirects
+- Password complexity enforcement on register and profile pages
+- Add `/api/v1/user` profile update endpoint
+- Service worker improvements
+- Performance improvements in session lookup and DB queries
+- Rename `.env.sample` to `.env.example`
 
 # 5.1.0
 
-- Convert to Tailwind CSS
+- Convert to Tailwind CSS 4
+- Remove Bootstrap dependency
+- Modernize PostgreSQL schema and stored functions
+- Add Playwright end-to-end test configuration
+- Add MCP configuration (`.vscode/mcp.json`) for Svelte MCP server
+- Add `AGENTS.md` coding agent instructions
+- Bump dependencies
 
 # 5.0.4
 

package/README.md

@@ -1,68 +1,61 @@
 # SvelteKit Authentication and Authorization Example
 
-**Updated for Svelte 5 and SvelteKit 2.19**
+[![License](https://img.shields.io/github/license/nstuyvesant/sveltekit-auth-example)](https://github.com/nstuyvesant/sveltekit-auth-example/blob/master/LICENSE)
+[![Node](https://img.shields.io/node/v/sveltekit-auth-example)](https://nodejs.org)
+[![Svelte](https://img.shields.io/badge/Svelte-5-orange)](https://svelte.dev)
 
-This is an example of how to register, authenticate, and update users and limit their access to areas of the website by role (admin, teacher, student). It includes profile management and password resets via SendGrid.
+A complete, production-ready authentication and authorization starter for **Svelte 5** and **SvelteKit 2**. Skip the boilerplate — get secure local accounts, Google OAuth, MFA, email verification, role-based access control, and OWASP-compliant password hashing out of the box.
 
-It's a Single Page App (SPA) built with SvelteKit and a PostgreSQL database back-end. Code is TypeScript and the website is styled using Tailwind CSS. PostgreSQL functions handle password hashing and UUID generation for the session ID. Unlike most authentication examples, this SPA does not use callbacks that redirect back to the site (causing the website to be reloaded with a visual flash).
+## Features
 
-The project includes a Content Security Policy (CSP) in svelte.config.js.
+| | |
+|---|---|
+| ✅ Local accounts (email + password) | ✅ Sign in with Google / Google One Tap |
+| ✅ Multi-factor authentication (MFA) | ✅ Email verification |
+| ✅ Forgot password / email reset (SendGrid) | ✅ User profile management |
+| ✅ Session management + timeout | ✅ Rate limiting |
+| ✅ Role-based access control | ✅ Password complexity enforcement |
+| ✅ Content Security Policy (CSP) | ✅ OWASP-compliant password hashing |
 
-The website supports two types of authentication:
+## Stack
 
-1. **Local accounts** via username (email) and password
-   - The login form (/src/routes/login/+page.svelte) sends the login info as JSON to endpoint /auth/login
-   - The endpoint passes the JSON to PostgreSQL function authenticate(json) which hashes the password and compares it to the stored hashed password in the users table. The function returns JSON containing a session ID (v4 UUID) and user object (sans password).
-   - The endpoint sends this session ID as an httpOnly SameSite cookie and the user object in the body of the response.
-   - The client stores the user object in the loginSession store.
-   - Further requests to the server include the session cookie. The hooks.ts handle() method extracts the session cookie, looks up the user and attaches it to RequestEvent.locals so server-side code can check locals.user.role to see if the request is authorized and return an HTTP 401 status if not.
-2. **Sign in with Google**
-   - **Sign in with Google** is initialized in /src/routes/+layout.svelte.
-   - **Google One Tap** prompt is displayed on the initially loaded page unless [Intelligent Tracking Prevention is enabled in the browser](https://developers.google.com/identity/gsi/web/guides/features#upgraded_ux_on_itp_browsers).
-   - **Sign in with Google** button is on the login page (/src/routes/login/+page.svelte) and register page (/src/routes/register/+page.svelte).
-   - Clicking either button opens a new window asking the user to authorize this website. If the user OKs it, a JSON Web Token (JWT) is sent to a callback function.
-   - The callback function (in /src/lib/auth.ts) sends the JWT to an endpoint on this server /auth/google.
-   - The endpoint decodes and validates the user information then calls the PostgreSQL function start_gmail_user_session to upsert the user to the database returing a session id in an httpOnly SameSite cookie and user in the body of the response.
-   - The client stores the user object in the loginSession store.
-   - Further requests to the server work identically to local accounts above.
-
-> There is some overhead to checking the user session in a database each time versus using a JWT; however, validating each request avoids problems discussed in [this article](https://redis.com/blog/json-web-tokens-jwt-are-dangerous-for-user-sessions/) and [this one](https://scotch.io/bar-talk/why-jwts-suck-as-session-tokens). For a high-volume website, I would use Redis or the equivalent.
+- **[SvelteKit](https://kit.svelte.dev)** — Single Page Application
+- **[PostgreSQL 16+](https://www.postgresql.org)** — database with server-side hashing
+- **[Tailwind CSS 4](https://tailwindcss.com)** — styling
+- **TypeScript** — end-to-end type safety
 
-The forgot password / password reset functionality uses a JWT and [**SendGrid**](https://www.sendgrid.com) to send the email. You would need to have a **SendGrid** account and set two environmental variables. Email sending is in /src/routes/auth/forgot.ts. This code could easily be replaced by nodemailer or something similar. Note: I have no affliation with **SendGrid** (used their API in another project).
+## Requirements
 
-## Prerequisites
-
-- PostgreSQL 14.10 or higher
-- Node.js 18.19.1 or higher
-- Google API client
-- Twilio SendGrid account (only used for emailing password reset link - the sample can run without it but forgot password will not work)
+- Node.js 24.14.0 or later
+- PostgreSQL 16 or later
+- A [SendGrid](https://sendgrid.com) account (for password reset emails)
+- A [Google API client ID](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid) (for Sign in with Google)
 
 ## Setting up the project
 
-Here are the steps:
-
-1. Get the project and setup the database
+1. Get the project and set up the database
 
 ```bash
 # Clone the repo to your current directory
 git clone https://github.com/nstuyvesant/sveltekit-auth-example.git
 
 # Install the dependencies
-cd /sveltekit-auth-example
+cd sveltekit-auth-example
 yarn install
 
-# Create PostgreSQL database (only works if you installed PostgreSQL)
+# Create PostgreSQL database (only works if you have PostgreSQL installed)
 psql -d postgres -f db_create.sql
 ```
 
-2. Create a **Google API client ID** per [these instructions](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid). Make sure you include `http://localhost:3000`, `http://localhost` in the Authorized JavaScript origins and `http://localhost:3000/auth/google/callback` in the Authorized redirect URIs for your Client ID for Web application. ** Do not access the site using http://127.0.0.1:3000 ** - use `http://localhost:3000` or it will not work.
+2. Create a **Google API client ID** per [these instructions](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid). Make sure you include `http://localhost:3000` and `http://localhost` in the Authorized JavaScript origins, and `http://localhost:3000/auth/google/callback` in the Authorized redirect URIs for your Client ID for Web application. **Do not access the site using http://127.0.0.1:3000** — use `http://localhost:3000` or it will not work.
 
 3. [Create a free Twilio SendGrid account](https://signup.sendgrid.com) and generate an API Key following [this documentation](https://docs.sendgrid.com/ui/account-and-settings/api-keys) and add a sender as documented [here](https://docs.sendgrid.com/ui/sending-email/senders).
 
-4. Create an **.env** file at the top level of the project with the following values (substituting your own id and PostgreSQL username and password):
+4. Create a **.env** file at the top level of the project with the following values (substituting your own id and PostgreSQL username and password):
 
 ```bash
 DATABASE_URL=postgres://user:password@localhost:5432/auth
+DATABASE_SSL=false
 DOMAIN=http://localhost:3000
 JWT_SECRET=replace_with_your_own
 SENDGRID_KEY=replace_with_your_own
@@ -73,14 +66,50 @@ PUBLIC_GOOGLE_CLIENT_ID=replace_with_your_own
 ## Run locally
 
 ```bash
-# Start the server and open the app in a new browser tab
+# Start the dev server and open the app in a new browser tab
 yarn dev -- --open
 ```
 
+## Build and preview
+
+```bash
+# Build for production
+yarn build
+
+# Preview the production build
+yarn preview
+```
+
 ## Valid logins
 
 The db_create.sql script adds three users to the database with obvious roles:
 
-- admin@example.com password admin123
-- teacher@example.com password teacher123
-- student@example.com password student123
+| Email | Password | Role |
+|---|---|---|
+| admin@example.com | admin123 | admin |
+| teacher@example.com | teacher123 | teacher |
+| student@example.com | student123 | student |
+
+## How it works
+
+The website supports two types of authentication:
+
+1. **Local accounts** via username (email) and password
+   - The login form (/src/routes/login/+page.svelte) sends the login info as JSON to endpoint /auth/login
+   - The endpoint passes the JSON to PostgreSQL function authenticate(json) which hashes the password and compares it to the stored hashed password in the users table. The function returns JSON containing a session ID (v4 UUID) and user object (sans password).
+   - The endpoint sends this session ID as an httpOnly SameSite cookie and the user object in the body of the response.
+   - The client stores the user object in `appState` (see /src/lib/app-state.svelte.ts).
+   - Further requests to the server include the session cookie. The hooks.ts handle() method extracts the session cookie, looks up the user and attaches it to RequestEvent.locals so server-side code can check locals.user.role to see if the request is authorized and return an HTTP 401 status if not.
+2. **Sign in with Google**
+   - **Sign in with Google** is initialized in /src/routes/+layout.svelte.
+   - **Google One Tap** prompt is displayed on the initially loaded page unless [Intelligent Tracking Prevention is enabled in the browser](https://developers.google.com/identity/gsi/web/guides/features#upgraded_ux_on_itp_browsers).
+   - **Sign in with Google** button is on the login page (/src/routes/login/+page.svelte) and register page (/src/routes/register/+page.svelte).
+   - Clicking either button opens a new window asking the user to authorize this website. If the user OKs it, a JSON Web Token (JWT) is sent to a callback function.
+   - The callback function (in /src/lib/google.ts) sends the JWT to an endpoint on this server /auth/google.
+   - The endpoint decodes and validates the user information then calls the PostgreSQL function start_gmail_user_session to upsert the user to the database returning a session id in an httpOnly SameSite cookie and user in the body of the response.
+   - The client stores the user object in `appState` (see /src/lib/app-state.svelte.ts).
+   - Further requests to the server work identically to local accounts above.
+
+> There is some overhead to checking the user session in a database each time versus using a JWT; however, validating each request avoids problems discussed in [this article](https://redis.com/blog/json-web-tokens-jwt-are-dangerous-for-user-sessions/). For a high-volume website, I would use Redis or the equivalent.
+
+The forgot password / password reset functionality uses a JWT and [**SendGrid**](https://www.sendgrid.com) to send the email. You would need to have a **SendGrid** account and set two environmental variables. Email sending is in /src/routes/auth/forgot/+server.ts. This code could easily be replaced by nodemailer or something similar. Note: I have no affiliation with **SendGrid** (used their API in another project).

package/db_create.sql

@@ -189,6 +189,43 @@ $BODY$;
 
 ALTER FUNCTION public.get_session(uuid) OWNER TO auth;
 
+-- Like get_session but also bumps the expiry (sliding sessions).
+-- Returns NULL if the session is expired or does not exist.
+CREATE OR REPLACE FUNCTION public.get_and_update_session(input_session_id uuid)
+  RETURNS json
+  LANGUAGE 'plpgsql'
+AS $BODY$
+DECLARE
+  result json;
+BEGIN
+  UPDATE sessions
+    SET expires = CURRENT_TIMESTAMP + INTERVAL '2 hours'
+  WHERE id = input_session_id AND expires > CURRENT_TIMESTAMP;
+
+  IF NOT FOUND THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT json_build_object(
+    'id', sessions.user_id,
+    'role', users.role,
+    'email', users.email,
+    'firstName', users.first_name,
+    'lastName', users.last_name,
+    'phone', users.phone,
+    'optOut', users.opt_out,
+    'expires', sessions.expires
+  ) INTO result
+  FROM sessions
+    INNER JOIN users ON sessions.user_id = users.id
+  WHERE sessions.id = input_session_id;
+
+  RETURN result;
+END;
+$BODY$;
+
+ALTER FUNCTION public.get_and_update_session(uuid) OWNER TO auth;
+
 CREATE OR REPLACE FUNCTION public.verify_email_and_create_session(input_id integer)
     RETURNS uuid
     LANGUAGE 'plpgsql'
@@ -224,7 +261,7 @@ BEGIN
   PERFORM id FROM users WHERE email = input_email;
   IF NOT FOUND THEN
     INSERT INTO users(role, password, email, first_name, last_name, phone)
-      VALUES('student', crypt(input_password, gen_salt('bf', 8)), input_email, input_first_name, input_last_name, input_phone)
+      VALUES('student', crypt(input_password, gen_salt('bf', 12)), input_email, input_first_name, input_last_name, input_phone)
       RETURNING
         json_build_object(
           'sessionId', create_session(users.id),
@@ -286,7 +323,7 @@ CREATE OR REPLACE PROCEDURE public.reset_password(IN input_id integer, IN input_
   LANGUAGE plpgsql
 AS $procedure$
 BEGIN
-  UPDATE users SET password = crypt(input_password, gen_salt('bf', 8)) WHERE id = input_id;
+  UPDATE users SET password = crypt(input_password, gen_salt('bf', 12)) WHERE id = input_id;
 END;
 $procedure$
 ;
@@ -308,7 +345,7 @@ BEGIN
   IF input_id = 0 THEN
     INSERT INTO users (role, email, password, first_name, last_name, phone, email_verified)
     VALUES (
-	  input_role, input_email, crypt(input_password, gen_salt('bf', 8)),
+	  input_role, input_email, crypt(input_password, gen_salt('bf', 12)),
 	  input_first_name, input_last_name, input_phone, true);
   ELSE
     UPDATE users SET
@@ -317,7 +354,7 @@ BEGIN
 	  email_verified = true,
 	  password = CASE WHEN input_password = ''
 		  THEN password -- leave as is (we are updating fields other than the password)
-		  ELSE crypt(input_password, gen_salt('bf', 8))
+		  ELSE crypt(input_password, gen_salt('bf', 12))
 	  END,
 	  first_name = input_first_name,
 	  last_name = input_last_name,
@@ -343,7 +380,7 @@ BEGIN
     email = input_email,
 	password = CASE WHEN input_password = ''
       THEN password -- leave as is (we are updating fields other than the password)
-	  ELSE crypt(input_password, gen_salt('bf', 8))
+	  ELSE crypt(input_password, gen_salt('bf', 12))
 	END,
 	first_name = input_first_name,
 	last_name = input_last_name,

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "sveltekit-auth-example",
 	"description": "SvelteKit Authentication Example",
-	"version": "5.1.2",
+	"version": "5.5.0",
 	"author": "Nate Stuyvesant",
 	"license": "https://github.com/nstuyvesant/sveltekit-auth-example/blob/master/LICENSE",
 	"repository": {
@@ -37,6 +37,7 @@
 	"dependencies": {
 		"@sendgrid/mail": "^8.1.6",
 		"google-auth-library": "^10.6.1",
+		"jsonwebtoken": "^9.0.3",
 		"pg": "^8.20.0"
 	},
 	"devDependencies": {
@@ -55,7 +56,6 @@
 		"eslint-config-prettier": "^10.1.8",
 		"eslint-plugin-svelte": "^3.15.2",
 		"globals": "^17.4.0",
-		"jsonwebtoken": "^9.0.3",
 		"playwright": "^1.58.2",
 		"prettier": "^3.8.1",
 		"prettier-plugin-sql": "^0.19.2",

package/src/hooks.server.ts

@@ -31,8 +31,12 @@ setInterval(() => {
 
 // Attach authorization to each server request (role may have changed)
 async function attachUserToRequestEvent(sessionId: string, event: RequestEvent) {
-	const result = await query('SELECT * FROM get_session($1::uuid)', [sessionId], 'get-session')
-	event.locals.user = result.rows[0]?.get_session // undefined if not found
+	const result = await query(
+		'SELECT get_and_update_session($1::uuid)',
+		[sessionId],
+		'get-and-update-session'
+	)
+	event.locals.user = result.rows[0]?.get_and_update_session // undefined if not found
 }
 
 // Invoked for each endpoint called and initially for SSR router

package/src/lib/auth-redirect.ts

@@ -8,7 +8,7 @@ import { page } from '$app/state'
 export function redirectAfterLogin(user: User): void {
 	if (!user) return
 	const referrer = page.url.searchParams.get('referrer')
-	if (referrer) {
+	if (referrer && referrer.startsWith('/') && !referrer.startsWith('//')) {
 		goto(referrer)
 		return
 	}

package/src/lib/fetch-interceptor.ts

@@ -0,0 +1,23 @@
+import { goto } from '$app/navigation'
+import { page } from '$app/state'
+import { appState } from '$lib/app-state.svelte'
+
+/**
+ * Monkey-patches window.fetch to intercept 401 responses.
+ * When a 401 is received while a user is logged in, the session has expired:
+ * clear app state and redirect to /login with the current path as the referrer.
+ *
+ * Call once from +layout.svelte's onMount.
+ */
+export function setupFetchInterceptor() {
+	const originalFetch = window.fetch
+	window.fetch = async (...args) => {
+		const response = await originalFetch(...args)
+		if (response.status === 401 && appState.user) {
+			appState.user = undefined
+			const referrer = encodeURIComponent(page.url.pathname + page.url.search)
+			goto(`/login?referrer=${referrer}`)
+		}
+		return response
+	}
+}

package/src/lib/server/email/index.ts

@@ -0,0 +1,2 @@
+export { sendPasswordResetEmail } from './password-reset'
+export { sendVerificationEmail } from './verify-email'

package/src/lib/server/email/password-reset.ts

@@ -0,0 +1,15 @@
+import { DOMAIN, SENDGRID_SENDER } from '$env/static/private'
+import { sendMessage } from '$lib/server/sendgrid'
+
+export const sendPasswordResetEmail = async (toEmail: string, token: string) => {
+	await sendMessage({
+		to: { email: toEmail },
+		from: SENDGRID_SENDER,
+		subject: 'Password reset',
+		categories: ['account'],
+		html: `
+      <p><a href="${DOMAIN}/auth/reset/${token}">Reset my password</a>. Your browser will open and ask you to
+      provide a new password with a confirmation then redirect you to your login page.</p>
+    `
+	})
+}

package/src/lib/server/email/verify-email.ts

@@ -0,0 +1,16 @@
+import { DOMAIN, SENDGRID_SENDER } from '$env/static/private'
+import { sendMessage } from '$lib/server/sendgrid'
+
+export const sendVerificationEmail = async (toEmail: string, token: string) => {
+	await sendMessage({
+		to: { email: toEmail },
+		from: SENDGRID_SENDER,
+		subject: 'Verify your email address',
+		categories: ['account'],
+		html: `
+      <p>Thanks for registering! Please verify your email address by clicking the link below:</p>
+      <p><a href="${DOMAIN}/auth/verify/${token}">Verify my email address</a></p>
+      <p>This link expires in 24 hours. If you did not register, you can safely ignore this email.</p>
+    `
+	})
+}

package/src/routes/+layout.svelte

@@ -4,6 +4,7 @@
 	import { goto, beforeNavigate } from '$app/navigation'
 	import { appState } from '$lib/app-state.svelte'
 	import { initializeGoogleAccounts } from '$lib/google'
+	import { setupFetchInterceptor } from '$lib/fetch-interceptor'
 
 	import './layout.css'
 
@@ -39,6 +40,7 @@
 	})
 
 	onMount(() => {
+		setupFetchInterceptor()
 		initializeGoogleAccounts()
 		if (!appState.user) google.accounts.id.prompt()
 	})

package/src/routes/auth/forgot/+server.ts

@@ -1,10 +1,9 @@
 import type { Secret } from 'jsonwebtoken'
-import type { MailDataRequired } from '@sendgrid/mail'
 import type { RequestHandler } from './$types'
 import jwt from 'jsonwebtoken'
-import { JWT_SECRET, DOMAIN, SENDGRID_SENDER } from '$env/static/private'
+import { JWT_SECRET } from '$env/static/private'
 import { query } from '$lib/server/db'
-import { sendMessage } from '$lib/server/sendgrid'
+import { sendPasswordResetEmail } from '$lib/server/email'
 
 export const POST: RequestHandler = async event => {
 	const body = await event.request.json()
@@ -12,26 +11,13 @@ export const POST: RequestHandler = async event => {
 	const { rows } = await query(sql, [body.email])
 
 	if (rows.length > 0) {
-		const { userId } = rows[0]
-		// Create JWT with userId expiring in 30 mins
-		const secret = JWT_SECRET
-		const token = jwt.sign({ subject: userId }, <Secret>secret, {
-			expiresIn: '30m'
-		})
-
-		// Email URL with token to user
-		const message: MailDataRequired = {
-			to: { email: body.email },
-			from: SENDGRID_SENDER,
-			subject: 'Password reset',
-			categories: ['account'],
-			html: `
-        <a href="${DOMAIN}/auth/reset/${token}">Reset my password</a>. Your browser will open and ask you to provide a
-        new password with a confirmation then redirect you to your login page.
-      `
-		}
+		const token = jwt.sign(
+			{ subject: rows[0].userId, purpose: 'reset-password' },
+			JWT_SECRET as Secret,
+			{ expiresIn: '30m' }
+		)
 		try {
-			await sendMessage(message)
+			await sendPasswordResetEmail(body.email, token)
 		} catch (err) {
 			console.error('Failed to send password reset email:', err)
 			// Still return 204 to avoid leaking whether the email exists in our system

package/src/routes/auth/google/+server.ts

@@ -54,9 +54,7 @@ export const POST: RequestHandler = async event => {
 
 		cookies.set('session', userSession.id, { httpOnly: true, sameSite: 'lax', secure: true, path: '/' })
 		return json({ message: 'Successful Google Sign-In.', user: userSession.user })
-	} catch (err) {
-		let message = ''
-		if (err instanceof Error) message = err.message
-		error(401, message)
+	} catch {
+		error(401, 'Google authentication failed.')
 	}
 }

package/src/routes/auth/register/+server.ts

@@ -1,10 +1,9 @@
 import { error, json } from '@sveltejs/kit'
 import type { RequestHandler } from './$types'
-import type { MailDataRequired } from '@sendgrid/mail'
 import jwt from 'jsonwebtoken'
-import { JWT_SECRET, DOMAIN, SENDGRID_SENDER } from '$env/static/private'
+import { JWT_SECRET } from '$env/static/private'
 import { query } from '$lib/server/db'
-import { sendMessage } from '$lib/server/sendgrid'
+import { sendVerificationEmail } from '$lib/server/email'
 
 export const POST: RequestHandler = async event => {
 	let body: { email?: string; password?: string; firstName?: string; lastName?: string }
@@ -17,6 +16,10 @@ export const POST: RequestHandler = async event => {
 	if (!body.email || !body.password || !body.firstName || !body.lastName)
 		error(400, 'Please supply all required fields: email, password, first and last name.')
 
+	const passwordPattern = /(?=.*[A-Z])(?=.*[0-9])(?=.*[^A-Za-z0-9]).{8,}/
+	if (!passwordPattern.test(body.password))
+		error(400, 'Password must be at least 8 characters and include an uppercase letter, a number, and a special character.')
+
 	let result
 	try {
 		const sql = `SELECT register($1) AS "authenticationResult";`
@@ -43,19 +46,7 @@ export const POST: RequestHandler = async event => {
 		{ expiresIn: '24h' }
 	)
 
-	const message: MailDataRequired = {
-		to: { email: body.email },
-		from: SENDGRID_SENDER,
-		subject: 'Verify your email address',
-		categories: ['account'],
-		html: `
-      <p>Thanks for registering! Please verify your email address by clicking the link below:</p>
-      <p><a href="${DOMAIN}/auth/verify/${token}">Verify my email address</a></p>
-      <p>This link expires in 24 hours. If you did not register, you can safely ignore this email.</p>
-    `
-	}
-
-	await sendMessage(message)
+	await sendVerificationEmail(body.email, token)
 
 	return json({
 		message: 'Registration successful. Please check your email to verify your account.',

package/src/routes/auth/reset/+server.ts

@@ -12,6 +12,7 @@ export const PUT: RequestHandler = async event => {
 	// Check the validity of the token and extract userId
 	try {
 		const decoded = <JwtPayload>jwt.verify(token, <jwt.Secret>JWT_SECRET)
+		if (decoded.purpose !== 'reset-password') throw new Error('Invalid token purpose.')
 		const userId = decoded.subject
 
 		// Update the database with the new password

package/svelte.config.js

@@ -37,7 +37,7 @@ const config = {
 			mode: 'auto',
 			directives: {
 				'default-src': [...baseCsp],
-				'script-src': ['unsafe-inline', ...baseCsp],
+				'script-src': [...baseCsp],
 				'img-src': ['data:', 'blob:', ...baseCsp],
 				'style-src': ['unsafe-inline', ...baseCsp],
 				'object-src': ['none'],

package/vite.config.ts

@@ -4,7 +4,7 @@ import tailwindcss from '@tailwindcss/vite'
 
 export default defineConfig({
 	build: {
-		sourcemap: true
+		sourcemap: process.env.NODE_ENV !== 'production'
 	},
 	plugins: [sveltekit(), tailwindcss()],
 	test: {