- Add `purpose` column (default: 'login') to distinguish login tokens from email-change tokens - verifyMagicToken only matches purpose='login' - verifyEmailChange only matches purpose='email-change' - Re-check email availability at verification time, not just initiation — prevents race where someone registers with the new email between request and verification Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| drizzle.config.ts | ||
| package.json | ||
| tsconfig.json | ||