fix email verification - #24
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR makes verify-email endpoints check runtime authentication state and return conditional messages/redirects (redirect to /admin when the requester is authenticated, otherwise /login). Client pages now refresh user state and invalidate caches after verification/login/register flows. SvelteKit dev defaults change to port 5173. Tests add a "Logged In Verification" scenario. ChangesEmail Verification and State Refresh
Sequence DiagramsequenceDiagram
participant Client
participant Server
participant Auth
Client->>Server: POST /verify-email (token)
par parallel
Server->>Auth: check()
Server->>Auth: verification.consume(token)
end
Auth-->>Server: wasAuthenticated, verification result
alt wasAuthenticated == true
Server-->>Client: { redirectTo: "/admin", message: "Email address verified." }
Client->>Auth: refreshUser()
Auth-->>Client: user refreshed
Client->>Client: invalidateAll() / router.refresh()
Client->>Client: Navigate to /admin
else wasAuthenticated == false
Server-->>Client: { redirectTo: "/login", message: "Email verified — please sign in." }
Client->>Auth: refreshUser()
Auth-->>Client: user refreshed
Client->>Client: invalidateAll() / router.refresh()
Client->>Client: Navigate to /login
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
apps/blog-next/app/verify-email/page.tsx (1)
37-41: 💤 Low value
router.refresh()is likely redundant beforerouter.replace().
router.refresh()re-fetches the RSC payload for the current route (/verify-email). When you then callrouter.replace(redirectTo), the destination route fetches and renders its own RSC payload independently. Since you're navigating away from the current route, refreshing its server data adds an unnecessary round-trip. Consider dropping it:♻️ Suggested simplification
if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') { await auth.refreshUser() - router.refresh() router.replace(submission.data.redirectTo) }Keep
router.refresh()only if there is a code path whereredirectTocould resolve back to the same/verify-emailsegment.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/blog-next/app/verify-email/page.tsx` around lines 37 - 41, The current flow calls router.refresh() immediately before router.replace(submission.data.redirectTo), which is redundant when navigating away; remove the router.refresh() call in the success branch (the block that checks submission?.ok and typeof submission.data?.redirectTo) and only call auth.refreshUser() then router.replace(...). If you need to handle the case where redirectTo might point back to the same /verify-email segment, add a guard comparing the current route to submission.data.redirectTo and only call router.refresh() when they match.apps/blog-sveltekit/src/routes/api/verify-email/+server.ts (1)
16-17: 💤 Low valueParallelize the two awaits for efficiency.
check()andverification.consume()are independent:check()reads session/auth state whileverification.consume()mutates user verification state and token storage without touching the session. This can be safely parallelized:♻️ Suggested refactor
- const wasAuthenticated = await check() - const { error } = await verification.consume(submission.data.token) + const [wasAuthenticated, { error }] = await Promise.all([ + check(), + verification.consume(submission.data.token), + ])🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/blog-sveltekit/src/routes/api/verify-email/`+server.ts around lines 16 - 17, The two awaits are independent and should run in parallel to improve performance: start both operations concurrently by invoking check() and verification.consume(submission.data.token) without awaiting, then await both results (e.g., with Promise.all) and assign the responses to wasAuthenticated and the consume result; update references to const wasAuthenticated and the consume result accordingly so logic that depends on them remains the same.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/blog-sveltekit/src/routes/verify-email/`+page.svelte:
- Around line 22-24: Wrap the call to auth.refreshUser() in a try/catch so a
rejection doesn’t block the subsequent invalidateAll() and goto() calls: call
await auth.refreshUser() inside try, catch and log or surface the error (e.g.,
via console.error or a user-facing notification) but do not rethrow, then always
await invalidateAll() and await goto(submission.data.redirectTo) so the user is
redirected even if refreshUser() fails; update the logic around
auth.refreshUser(), invalidateAll(), goto(), and submission.data.redirectTo
accordingly.
---
Nitpick comments:
In `@apps/blog-next/app/verify-email/page.tsx`:
- Around line 37-41: The current flow calls router.refresh() immediately before
router.replace(submission.data.redirectTo), which is redundant when navigating
away; remove the router.refresh() call in the success branch (the block that
checks submission?.ok and typeof submission.data?.redirectTo) and only call
auth.refreshUser() then router.replace(...). If you need to handle the case
where redirectTo might point back to the same /verify-email segment, add a guard
comparing the current route to submission.data.redirectTo and only call
router.refresh() when they match.
In `@apps/blog-sveltekit/src/routes/api/verify-email/`+server.ts:
- Around line 16-17: The two awaits are independent and should run in parallel
to improve performance: start both operations concurrently by invoking check()
and verification.consume(submission.data.token) without awaiting, then await
both results (e.g., with Promise.all) and assign the responses to
wasAuthenticated and the consume result; update references to const
wasAuthenticated and the consume result accordingly so logic that depends on
them remains the same.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 716fefd4-2c68-47b0-854d-edc5bb64465b
📒 Files selected for processing (11)
apps/blog-next/app/api/verify-email/route.tsapps/blog-next/app/verify-email/page.tsxapps/blog-nuxt/pages/verify-email.vueapps/blog-nuxt/server/api/verify-email.post.tsapps/blog-sveltekit/config/app.tsapps/blog-sveltekit/config/broadcast.tsapps/blog-sveltekit/src/routes/api/verify-email/+server.tsapps/blog-sveltekit/src/routes/login/+page.svelteapps/blog-sveltekit/src/routes/register/+page.svelteapps/blog-sveltekit/src/routes/verify-email/+page.sveltetests/example-app-auth-flow.mjs
Owner
Author
|
@CodeRabbit review |
✅ Actions performedReview triggered.
|
Owner
Author
|
@CodeRabbit review |
✅ Actions performedReview triggered.
|
This was referenced May 7, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Tests
Chores