feat(auth): soft email verification UX across the site

eliott commented

2026-05-20 09:03:16 +02:00

Owner

Mirrors the API's switch to soft email verification. Session now carries
emailVerified (parsed from the new email_verified JWT claim, defaulting to
true so pre-change tokens still validate). A sticky banner on every layout
lets unverified users either resend the link (resendVerificationForMeAction,
no email re-entry) or call refreshSessionAction to mint a fresh JWT after
verifying elsewhere — both trigger router.refresh() so the banner clears
without a logout/login.

Unverified accounts are kept out of write-only flows: /mes-ressources gets
a requireVerifiedSession guard, "Mes ressources" is hidden from the header,
comment forms degrade to a Notice, the resource page skips the user-state
lookup that would 403, and the home CTA stops nudging them toward creation.

verify-email page now embeds ResendVerificationForm on expired/invalid/error
outcomes, and RefreshSessionOnMount fires on success so the user doesn't
have to re-login to lose the banner. Drops unused @tiptap/extension-image.

Mirrors the API's switch to soft email verification. Session now carries emailVerified (parsed from the new email_verified JWT claim, defaulting to true so pre-change tokens still validate). A sticky banner on every layout lets unverified users either resend the link (resendVerificationForMeAction, no email re-entry) or call refreshSessionAction to mint a fresh JWT after verifying elsewhere — both trigger router.refresh() so the banner clears without a logout/login. Unverified accounts are kept out of write-only flows: /mes-ressources gets a requireVerifiedSession guard, "Mes ressources" is hidden from the header, comment forms degrade to a Notice, the resource page skips the user-state lookup that would 403, and the home CTA stops nudging them toward creation. verify-email page now embeds ResendVerificationForm on expired/invalid/error outcomes, and RefreshSessionOnMount fires on success so the user doesn't have to re-login to lose the banner. Drops unused @tiptap/extension-image.

eliott added 1 commit

2026-05-20 09:03:16 +02:00

feat(auth): soft email verification UX across the site ad5b7327ba

Mirrors the API's switch to soft email verification. Session now carries
emailVerified (parsed from the new email_verified JWT claim, defaulting to
true so pre-change tokens still validate). A sticky banner on every layout
lets unverified users either resend the link (resendVerificationForMeAction,
no email re-entry) or call refreshSessionAction to mint a fresh JWT after
verifying elsewhere — both trigger router.refresh() so the banner clears
without a logout/login.

Unverified accounts are kept out of write-only flows: /mes-ressources gets
a requireVerifiedSession guard, "Mes ressources" is hidden from the header,
comment forms degrade to a Notice, the resource page skips the user-state
lookup that would 403, and the home CTA stops nudging them toward creation.

verify-email page now embeds ResendVerificationForm on expired/invalid/error
outcomes, and RefreshSessionOnMount fires on success so the user doesn't
have to re-login to lose the banner. Drops unused @tiptap/extension-image.

eliott added 1 commit

2026-05-20 09:03:21 +02:00

Merge branch 'main' into develop d2cb323cb7

eliott merged commit 5f22289707 into main

2026-05-20 09:03:28 +02:00

eliott referenced this pull request from a commit

2026-05-20 09:03:30 +02:00

Merge pull request 'feat(auth): soft email verification UX across the site' (#10) from develop into main

Rows
Columns

feat(auth): soft email verification UX across the site #10