From 3ef215b729719c01dec5e3303ab80b9c98426eca Mon Sep 17 00:00:00 2001
From: Adil2009700 <adilhassan2009@gmail.com>
Date: Sun, 5 Jul 2026 23:24:32 +0530
Subject: [PATCH 1/5] feat: Student rework view - show exactly what failed
 during QA review (#410) - Add questSubmissions include to getAssignments API
 to fetch latest submission data - Create ReworkFeedbackPanel component to
 display criteria results, quality score, and reviewer notes - Show feedback
 panel when assignment status is 'needs_rework' - Handle graceful fallback
 when no feedback data is available

---
 app/dashboard/quests/[id]/page.tsx | 90 ++++++++++++++++++++++++++++++
 lib/services/assignment-service.ts | 18 ++++++
 2 files changed, 108 insertions(+)

diff --git a/app/dashboard/quests/[id]/page.tsx b/app/dashboard/quests/[id]/page.tsx
index e420329..6c13efc 100644
--- a/app/dashboard/quests/[id]/page.tsx
+++ b/app/dashboard/quests/[id]/page.tsx
@@ -25,6 +25,80 @@ import remarkGfm from 'remark-gfm';
 import rehypeHighlight from 'rehype-highlight';
 import 'highlight.js/styles/github.css';
 
+interface Submission {
+  id: string;
+  status: string;
+  submissionContent: string;
+  submissionNotes: string;
+  reviewNotes: unknown;
+  criteriaResults: unknown;
+  qualityScore: number | null;
+  reviewedAt: string | null;
+  reviewerId: string | null;
+}
+
+// Rework feedback panel component
+function ReworkFeedbackPanel({ submission }: { submission: Submission }) {
+  const criteriaResults = submission.criteriaResults as Array<{ criterion: string; met: boolean; note?: string }> | null;
+  const reviewNotes = submission.reviewNotes as string[] | null;
+  const qualityScore = submission.qualityScore;
+
+  // If no feedback data, show fallback message
+  if (!criteriaResults && !reviewNotes && !qualityScore) {
+    return (
+      <div className="rounded-xl border border-orange-200 bg-orange-50 p-4 text-xs text-orange-800">
+        <p className="font-medium">Rework Required</p>
+        <p className="mt-1">Your submission needs revision. Please review the reviewer notes and resubmit.</p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="rounded-xl border border-orange-200 bg-orange-50/80 p-4 space-y-3">
+      <div className="flex items-center gap-2 text-orange-800">
+        <AlertCircle className="h-4 w-4" />
+        <h3 className="font-semibold text-sm">Rework Required</h3>
+      </div>
+
+      {/* Criteria Results */}
+      {criteriaResults && criteriaResults.length > 0 && (
+        <div className="space-y-2">
+          <p className="text-xs font-medium text-orange-800">Criteria that need fixing:</p>
+          <ul className="space-y-1.5">
+            {criteriaResults.map((item, index) => (
+              <li key={index} className={`text-xs ${item.met ? 'text-emerald-700' : 'text-orange-800'}`}>
+                <span className="font-medium">{item.met ? '✓' : '✗'}</span> {item.criterion}
+                {item.note && (
+                  <p className="ml-4 mt-0.5 text-orange-700/80 italic">{item.note}</p>
+                )}
+              </li>
+            ))}
+          </ul>
+        </div>
+      )}
+
+      {/* Quality Score */}
+      {qualityScore !== null && (
+        <div className="text-xs text-orange-800">
+          <span className="font-medium">Quality Score:</span> {qualityScore}/10
+        </div>
+      )}
+
+      {/* General Review Notes */}
+      {reviewNotes && reviewNotes.length > 0 && (
+        <div className="text-xs text-orange-800">
+          <p className="font-medium">Reviewer Note:</p>
+          <p className="mt-1 italic">{Array.isArray(reviewNotes) ? reviewNotes.join(' ') : reviewNotes}</p>
+        </div>
+      )}
+
+      <p className="text-xs text-orange-700/70 pt-1">
+        Resubmit when you&apos;ve addressed the feedback above.
+      </p>
+    </div>
+  );
+}
+
 interface Quest {
   id: string;
   title: string;
@@ -62,6 +136,18 @@ interface Assignment {
   progress?: number;
   completedTasks?: string[];
   lastUpdateAt?: string;
+  // Added for rework feedback display
+  questSubmissions?: Array<{
+    id: string;
+    status: string;
+    submissionContent: string;
+    submissionNotes: string;
+    reviewNotes: unknown;
+    criteriaResults: unknown;
+    qualityScore: number | null;
+    reviewedAt: string | null;
+    reviewerId: string | null;
+  }>;
 }
 
 function assignmentStatusClass(status: string) {
@@ -505,6 +591,10 @@ export default function QuestDetailPage() {
                           ? 'Quest claimed! Start working to unlock the submission form.'
                           : 'Quest in progress. Submit your work using the form below.'}
                 </div>
+                {/* Rework Feedback Panel */}
+                {assignment.status === 'needs_rework' && assignment.questSubmissions && assignment.questSubmissions.length > 0 && (
+                  <ReworkFeedbackPanel submission={assignment.questSubmissions[0]} />
+                )}
                 {canStart && (
                   <Button
                     className="w-full bg-emerald-600 hover:bg-emerald-700 text-white text-xs"
diff --git a/lib/services/assignment-service.ts b/lib/services/assignment-service.ts
index fb9c48f..3c95c94 100644
--- a/lib/services/assignment-service.ts
+++ b/lib/services/assignment-service.ts
@@ -262,6 +262,7 @@ export async function getAssignments(searchParams: URLSearchParams, user: Sessio
       include: {
         quest: {
           select: {
+            id: true,
             title: true,
             description: true,
             questType: true,
@@ -275,6 +276,23 @@ export async function getAssignments(searchParams: URLSearchParams, user: Sessio
             deadline: true,
           },
         },
+        // Include latest submission for rework feedback display
+        questSubmissions: {
+          where: { status: { not: 'superseded' } },
+          orderBy: { submittedAt: 'desc' },
+          take: 1,
+          select: {
+            id: true,
+            status: true,
+            submissionContent: true,
+            submissionNotes: true,
+            reviewNotes: true,
+            criteriaResults: true,
+            qualityScore: true,
+            reviewedAt: true,
+            reviewerId: true,
+          },
+        },
       },
       skip: offset,
       take: limit,

From 4f115bd915d50837d4c4a385ce316fa312d34cb9 Mon Sep 17 00:00:00 2001
From: Adil2009700 <adilhassan2009@gmail.com>
Date: Tue, 7 Jul 2026 13:51:46 +0530
Subject: [PATCH 2/5] fix: Add error handling to QA queue approve/reject
 functions (#416) - Wrap handleApprove and handleReject in try/catch blocks -
 Check HTTP response status and JSON success flag - Display error toast on
 failure, success toast on success - Use finally block to ensure loading state
 is reset

---
 app/admin/qa-queue/page.tsx | 63 +++++++++++++++++++++++++++----------
 1 file changed, 47 insertions(+), 16 deletions(-)

diff --git a/app/admin/qa-queue/page.tsx b/app/admin/qa-queue/page.tsx
index ead465e..cd5615a 100644
--- a/app/admin/qa-queue/page.tsx
+++ b/app/admin/qa-queue/page.tsx
@@ -19,6 +19,7 @@ import {
 import { Shield, Clock, CheckCircle, XCircle, Loader2, ArrowLeft, ExternalLink, DollarSign, Ban } from 'lucide-react';
 import { formatDistanceToNow } from 'date-fns';
 import { fetchWithAuth } from '@/lib/fetch-with-auth';
+import { toast } from 'sonner';
 
 interface QueueItem {
   id: string;
@@ -101,27 +102,57 @@ export default function QAQueuePage() {
 
   const handleApprove = async (assignmentId: string) => {
     setSubmitting(true);
-    await fetchWithAuth(`/api/admin/qa-queue/${assignmentId}`, {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ action: 'approve' }),
-    });
-    await fetchQueue();
-    setSubmitting(false);
+    try {
+      const res = await fetchWithAuth(`/api/admin/qa-queue/${assignmentId}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ action: 'approve' }),
+      });
+      const data = await res.json();
+      
+      if (!res.ok || !data.success) {
+        toast.error(data.error || 'Failed to approve submission');
+        setSubmitting(false);
+        return;
+      }
+      
+      toast.success('Submission approved successfully');
+      await fetchQueue();
+    } catch (error) {
+      console.error('Approve error:', error);
+      toast.error('Failed to approve submission - network error');
+    } finally {
+      setSubmitting(false);
+    }
   };
 
   const handleReject = async () => {
     if (!rejectTarget || !rejectNotes.trim()) return;
     setSubmitting(true);
-    await fetchWithAuth(`/api/admin/qa-queue/${rejectTarget.id}`, {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ action: 'reject', notes: rejectNotes.trim() }),
-    });
-    await fetchQueue();
-    setSubmitting(false);
-    setRejectTarget(null);
-    setRejectNotes('');
+    try {
+      const res = await fetchWithAuth(`/api/admin/qa-queue/${rejectTarget.id}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ action: 'reject', notes: rejectNotes.trim() }),
+      });
+      const data = await res.json();
+      
+      if (!res.ok || !data.success) {
+        toast.error(data.error || 'Failed to reject submission');
+        setSubmitting(false);
+        return;
+      }
+      
+      toast.success('Submission rejected - returned to student for revision');
+      await fetchQueue();
+    } catch (error) {
+      console.error('Reject error:', error);
+      toast.error('Failed to reject submission - network error');
+    } finally {
+      setSubmitting(false);
+      setRejectTarget(null);
+      setRejectNotes('');
+    }
   };
 
   const openPaymentModal = (item: QueueItem) => {

From f9730f25e9ec53ab68b3a1d9cf0c18466a4b44ce Mon Sep 17 00:00:00 2001
From: Adil2009700 <adilhassan2009@gmail.com>
Date: Thu, 23 Jul 2026 15:40:29 +0530
Subject: [PATCH 3/5] fix: Move XP reward inside transaction to prevent
 permanent XP loss (#324)

---
 lib/xp-utils.ts | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/lib/xp-utils.ts b/lib/xp-utils.ts
index 4c08c29..543e554 100644
--- a/lib/xp-utils.ts
+++ b/lib/xp-utils.ts
@@ -2,7 +2,7 @@
 // Replaces Supabase RPC: update_user_xp_and_skills
 import { prisma } from './db';
 import { getRankForXp } from './ranks';
-import { UserRank } from '@prisma/client';
+import { UserRank, Prisma } from '@prisma/client';
 import { logActivity } from './activity-logger';
 import { updateStreak } from './streak-utils';
 import { checkAchievements } from './achievement-checker';
@@ -19,14 +19,42 @@ export function calculateLevelFromXP(xp: number): number {
 /**
  * Update user XP, level, rank, and skill points in a single transaction.
  * Also updates adventurer_profiles stats (questsCompleted, completionRate).
+ * 
+ * @param userId The user ID to update
+ * @param xpGained XP amount to add
+ * @param skillPointsGained Skill points to add
+ * @param questId Optional quest ID for activity logging
+ * @param tx Optional Prisma transaction client - if provided, uses existing transaction
  */
 export async function updateUserXpAndSkills(
   userId: string,
   xpGained: number,
   skillPointsGained: number,
-  questId?: string
+  questId?: string,
+  tx?: Prisma.TransactionClient
+): Promise<{ newXp: number; newLevel: number; newRank: string; rankChanged: boolean }> {
+  // If transaction client is provided, use it directly
+  if (tx) {
+    return updateUserXpAndSkillsTransaction(userId, xpGained, skillPointsGained, questId, tx);
+  }
+  
+  // Otherwise create a new transaction
+  return prisma.$transaction(async (transaction) => {
+    return updateUserXpAndSkillsTransaction(userId, xpGained, skillPointsGained, questId, transaction);
+  });
+}
+
+/**
+ * Internal helper function that performs the actual update logic.
+ * This can be called from within an existing transaction.
+ */
+async function updateUserXpAndSkillsTransaction(
+  userId: string,
+  xpGained: number,
+  skillPointsGained: number,
+  questId: string | undefined,
+  tx: Prisma.TransactionClient
 ): Promise<{ newXp: number; newLevel: number; newRank: string; rankChanged: boolean }> {
-  return prisma.$transaction(async (tx) => {
     // Get current user stats
     const user = await tx.user.findUnique({
       where: { id: userId },

From badef283debdd08a27a0ceffff58794f73dc99b1 Mon Sep 17 00:00:00 2001
From: Adil2009700 <adilhassan2009@gmail.com>
Date: Thu, 23 Jul 2026 15:42:08 +0530
Subject: [PATCH 4/5] fix: Move XP reward processing inside transaction to
 prevent permanent XP loss (#324)

---
 app/api/quests/submissions/route.ts | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/app/api/quests/submissions/route.ts b/app/api/quests/submissions/route.ts
index 26f82b4..429a6a3 100644
--- a/app/api/quests/submissions/route.ts
+++ b/app/api/quests/submissions/route.ts
@@ -336,21 +336,25 @@ export async function PUT(request: NextRequest) {
           }
         }
 
+        // Process XP and skills INSIDE the transaction to prevent permanent XP loss
+        if (rewardsPayload) {
+          const { updateUserXpAndSkills } = await import('@/lib/xp-utils');
+          await updateUserXpAndSkills(
+            rewardsPayload.userId,
+            rewardsPayload.xpReward,
+            rewardsPayload.skillPointsReward,
+            assignmentData.questId,
+            tx // Pass transaction client to ensure atomic operation
+          );
+        }
+
         return { submission: updatedSubmission, rewardsPayload, paymentInfo };
       },
       { maxWait: 10_000, timeout: 20_000 }
     );
 
-    // Process XP and skills (outside transaction)
+    // Process referral milestone and bootcamp tracking AFTER transaction completes
     if (reviewResult.rewardsPayload) {
-      const { updateUserXpAndSkills } = await import('@/lib/xp-utils');
-      await updateUserXpAndSkills(
-        reviewResult.rewardsPayload.userId,
-        reviewResult.rewardsPayload.xpReward,
-        reviewResult.rewardsPayload.skillPointsReward,
-        assignmentData.questId
-      );
-
       // Referral milestone check — award XP to the referrer if applicable
       const completionCount = await prisma.questCompletion.count({
         where: { userId: reviewResult.rewardsPayload.userId },

From 3d1dbe2a180bbad462910c4ffc72acfe232e8482 Mon Sep 17 00:00:00 2001
From: Adil2009700 <adilhassan2009@gmail.com>
Date: Thu, 23 Jul 2026 21:33:43 +0530
Subject: [PATCH 5/5] feat: Add secure email change flow with verification to
 OLD email (#407)

---
 app/api/user/confirm-email-change/route.ts | 231 +++++++++++++++++++++
 app/api/user/request-email-change/route.ts | 131 ++++++++++++
 app/api/user/update-email/route.ts         |  16 +-
 prisma/schema.prisma                       |  17 ++
 4 files changed, 388 insertions(+), 7 deletions(-)
 create mode 100644 app/api/user/confirm-email-change/route.ts
 create mode 100644 app/api/user/request-email-change/route.ts

diff --git a/app/api/user/confirm-email-change/route.ts b/app/api/user/confirm-email-change/route.ts
new file mode 100644
index 0000000..ab77912
--- /dev/null
+++ b/app/api/user/confirm-email-change/route.ts
@@ -0,0 +1,231 @@
+import { NextResponse } from 'next/server';
+import { prisma } from '@/lib/db';
+import crypto from 'crypto';
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url);
+    const token = url.searchParams.get('token');
+
+    if (!token) {
+      return NextResponse.json({ error: 'Token is required' }, { status: 400 });
+    }
+
+    // Find the email change request
+    const emailChangeRequest = await prisma.emailChangeRequest.findUnique({
+      where: { token },
+      include: { user: true },
+    });
+
+    if (!emailChangeRequest) {
+      return NextResponse.json({ error: 'Invalid or expired token' }, { status: 404 });
+    }
+
+    // Check if token is already used
+    if (emailChangeRequest.status === 'confirmed') {
+      return NextResponse.json({ error: 'This token has already been used' }, { status: 400 });
+    }
+
+    // Check if token is expired
+    if (emailChangeRequest.expiresAt < new Date()) {
+      // Update status to expired
+      await prisma.emailChangeRequest.update({
+        where: { id: emailChangeRequest.id },
+        data: { status: 'expired' },
+      });
+      return NextResponse.json({ error: 'Token has expired' }, { status: 400 });
+    }
+
+    // Check if new email is still available (another user might have registered with it)
+    const existingUser = await prisma.user.findUnique({
+      where: { email: emailChangeRequest.newEmail },
+    });
+
+    if (existingUser && existingUser.id !== emailChangeRequest.userId) {
+      return NextResponse.json(
+        { error: 'This email is now in use by another account. Please request a new email change.' },
+        { status: 400 }
+      );
+    }
+
+    // Use transaction to ensure atomic update
+    await prisma.$transaction(async (tx) => {
+      // Update user's email
+      await tx.user.update({
+        where: { id: emailChangeRequest.userId },
+        data: { 
+          email: emailChangeRequest.newEmail,
+          // Force session invalidation by updating updatedAt timestamp
+          updatedAt: new Date(),
+        },
+      });
+
+      // Mark email change request as confirmed
+      await tx.emailChangeRequest.update({
+        where: { id: emailChangeRequest.id },
+        data: { status: 'confirmed' },
+      });
+
+      // Invalidate any other pending email change requests for this user
+      await tx.emailChangeRequest.updateMany({
+        where: {
+          userId: emailChangeRequest.userId,
+          id: { not: emailChangeRequest.id },
+          status: 'pending',
+        },
+        data: { status: 'expired' },
+      });
+    });
+
+    // Return success page or redirect to login
+    const html = `
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <title>Email Changed Successfully</title>
+        <style>
+          body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            min-height: 100vh;
+            margin: 0;
+            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+          }
+          .container {
+            background: white;
+            padding: 2rem;
+            border-radius: 12px;
+            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+            text-align: center;
+            max-width: 400px;
+          }
+          .success-icon {
+            font-size: 48px;
+            color: #10b981;
+            margin-bottom: 1rem;
+          }
+          h1 {
+            color: #1f2937;
+            margin-bottom: 1rem;
+          }
+          p {
+            color: #6b7280;
+            margin-bottom: 2rem;
+            line-height: 1.5;
+          }
+          .login-button {
+            background: #667eea;
+            color: white;
+            border: none;
+            padding: 12px 24px;
+            border-radius: 6px;
+            font-size: 16px;
+            cursor: pointer;
+            text-decoration: none;
+            display: inline-block;
+          }
+          .login-button:hover {
+            background: #5a67d8;
+          }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <div class="success-icon">✓</div>
+          <h1>Email Changed Successfully!</h1>
+          <p>Your email has been updated to <strong>${emailChangeRequest.newEmail}</strong>.</p>
+          <p>For security reasons, you have been logged out. Please log in again with your new email address.</p>
+          <a href="/login" class="login-button">Go to Login</a>
+        </div>
+      </body>
+      </html>
+    `;
+
+    return new NextResponse(html, {
+      status: 200,
+      headers: {
+        'Content-Type': 'text/html',
+      },
+    });
+
+  } catch (error) {
+    console.error('Failed to confirm email change:', error);
+    
+    const html = `
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <title>Error Confirming Email Change</title>
+        <style>
+          body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            min-height: 100vh;
+            margin: 0;
+            background: linear-gradient(135deg, #f56565 0%, #ed8936 100%);
+          }
+          .container {
+            background: white;
+            padding: 2rem;
+            border-radius: 12px;
+            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+            text-align: center;
+            max-width: 400px;
+          }
+          .error-icon {
+            font-size: 48px;
+            color: #f56565;
+            margin-bottom: 1rem;
+          }
+          h1 {
+            color: #1f2937;
+            margin-bottom: 1rem;
+          }
+          p {
+            color: #6b7280;
+            margin-bottom: 2rem;
+            line-height: 1.5;
+          }
+          .home-button {
+            background: #f56565;
+            color: white;
+            border: none;
+            padding: 12px 24px;
+            border-radius: 6px;
+            font-size: 16px;
+            cursor: pointer;
+            text-decoration: none;
+            display: inline-block;
+          }
+          .home-button:hover {
+            background: #e53e3e;
+          }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <div class="error-icon">✗</div>
+          <h1>Error Confirming Email Change</h1>
+          <p>There was an error processing your email change request. Please try requesting a new email change.</p>
+          <a href="/dashboard/settings" class="home-button">Go to Settings</a>
+        </div>
+      </body>
+      </html>
+    `;
+
+    return new NextResponse(html, {
+      status: 500,
+      headers: {
+        'Content-Type': 'text/html',
+      },
+    });
+  }
+}
\ No newline at end of file
diff --git a/app/api/user/request-email-change/route.ts b/app/api/user/request-email-change/route.ts
new file mode 100644
index 0000000..6df6d2f
--- /dev/null
+++ b/app/api/user/request-email-change/route.ts
@@ -0,0 +1,131 @@
+import { NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { prisma } from '@/lib/db';
+import { z } from 'zod';
+import bcrypt from 'bcryptjs';
+import crypto from 'crypto';
+
+// Rate limiting store (in-memory for simplicity, could use Redis in production)
+const rateLimitStore = new Map<string, { count: number; resetTime: number }>();
+
+const requestEmailChangeSchema = z.object({
+  newEmail: z.string().email('Please provide a valid email address'),
+  currentPassword: z.string().min(1, 'Current password is required'),
+});
+
+export async function POST(req: Request) {
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const userId = session.user.id;
+
+    // Rate limiting: max 3 requests per hour per user
+    const now = Date.now();
+    const userRateLimit = rateLimitStore.get(userId);
+    
+    if (userRateLimit && userRateLimit.resetTime > now) {
+      if (userRateLimit.count >= 3) {
+        return NextResponse.json(
+          { error: 'Too many requests. Please try again later.' },
+          { status: 429 }
+        );
+      }
+      rateLimitStore.set(userId, { ...userRateLimit, count: userRateLimit.count + 1 });
+    } else {
+      // Reset or create rate limit (1 hour)
+      rateLimitStore.set(userId, { count: 1, resetTime: now + 60 * 60 * 1000 });
+    }
+
+    const json = await req.json();
+    const { newEmail, currentPassword } = requestEmailChangeSchema.parse(json);
+    const normalizedNewEmail = newEmail.trim().toLowerCase();
+
+    // Fetch user to verify password and get current email
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { passwordHash: true, email: true },
+    });
+
+    if (!user) {
+      return NextResponse.json({ error: 'User not found' }, { status: 404 });
+    }
+
+    // OAuth users have no password — email change via this endpoint is not supported for them
+    if (!user.passwordHash) {
+      return NextResponse.json(
+        { error: 'Email change is not available for social login accounts. Please contact support.' },
+        { status: 400 }
+      );
+    }
+
+    // Require current password re-verification (security fix for account takeover)
+    const isValid = await bcrypt.compare(currentPassword, user.passwordHash);
+    if (!isValid) {
+      return NextResponse.json({ error: 'Incorrect password' }, { status: 403 });
+    }
+
+    // Prevent changing to the same email
+    if (user.email.toLowerCase() === normalizedNewEmail) {
+      return NextResponse.json({ error: 'New email must be different from current email' }, { status: 400 });
+    }
+
+    // Check if new email is already in use
+    const existingUser = await prisma.user.findUnique({
+      where: { email: normalizedNewEmail },
+    });
+
+    if (existingUser) {
+      return NextResponse.json(
+        { error: 'This email is already in use by another account' },
+        { status: 400 }
+      );
+    }
+
+    // Generate secure token
+    const token = crypto.randomBytes(32).toString('hex');
+    
+    // Set expiration to 24 hours from now
+    const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000);
+
+    // Create email change request
+    const emailChangeRequest = await prisma.emailChangeRequest.create({
+      data: {
+        userId,
+        newEmail: normalizedNewEmail,
+        token,
+        expiresAt,
+        status: 'pending',
+      },
+    });
+
+    // TODO: Send verification email to OLD email address
+    // In production, this would integrate with an email service like SendGrid, Resend, etc.
+    const verificationLink = `${process.env.NEXTAUTH_URL}/api/user/confirm-email-change?token=${token}`;
+    
+    console.log(`Email change verification link for user ${userId}: ${verificationLink}`);
+    console.log(`Email should be sent to OLD email: ${user.email}`);
+    console.log(`New email requested: ${normalizedNewEmail}`);
+
+    // For development/testing purposes, return the verification link
+    // In production, remove this and only return success message
+    return NextResponse.json({ 
+      success: true, 
+      message: 'Verification email sent to your current email address.',
+      verificationLink: process.env.NODE_ENV === 'development' ? verificationLink : undefined
+    });
+
+  } catch (error) {
+    console.error('Failed to request email change:', error);
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: error.errors[0].message }, { status: 400 });
+    }
+    return NextResponse.json(
+      { error: 'Something went wrong while processing your request' },
+      { status: 500 }
+    );
+  }
+}
\ No newline at end of file
diff --git a/app/api/user/update-email/route.ts b/app/api/user/update-email/route.ts
index 820e261..7f97467 100644
--- a/app/api/user/update-email/route.ts
+++ b/app/api/user/update-email/route.ts
@@ -62,13 +62,15 @@ export async function POST(req: Request) {
       );
     }
 
-    // Update user's email
-    await prisma.user.update({
-      where: { id: session.user.id },
-      data: { email: normalizedEmail },
-    });
+    // Redirect to new secure email change flow
+    return NextResponse.json({ 
+      success: false, 
+      message: 'Please use the new secure email change flow. Redirecting...',
+      redirectTo: '/api/user/request-email-change',
+      // For backward compatibility, we could automatically forward the request
+      // but for now, we'll just inform the client to use the new endpoint
+    }, { status: 400 });
 
-    return NextResponse.json({ success: true, email: normalizedEmail });
   } catch (error) {
     console.error('Failed to update email:', error);
     if (error instanceof z.ZodError) {
@@ -79,4 +81,4 @@ export async function POST(req: Request) {
       { status: 500 }
     );
   }
-}
+}
\ No newline at end of file
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 318e036..8176a5a 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -664,6 +664,23 @@ model ErrorLog {
   @@map("error_logs")
 }
 
+model EmailChangeRequest {
+  id        String   @id @default(uuid()) @db.Uuid
+  userId    String   @map("user_id") @db.Uuid
+  newEmail  String   @map("new_email")
+  token     String   @unique
+  status    String   @default("pending") // pending | confirmed | expired
+  expiresAt DateTime @map("expires_at") @db.Timestamptz
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([token])
+  @@index([status])
+  @@index([expiresAt])
+  @@map("email_change_requests")
+}
+
 model Party {
   id        String     @id @default(uuid()) @db.Uuid
   questId   String     @unique @map("quest_id") @db.Uuid