From 6dd396150aff14aad4b3f26a0a9224d78ec5dce7 Mon Sep 17 00:00:00 2001
From: Mohamed Melouk <42706279+cobraprojects@users.noreply.github.com>
Date: Wed, 6 May 2026 16:50:25 +0300
Subject: [PATCH 1/2] fix email verification

---
 apps/blog-next/app/api/verify-email/route.ts  |  9 +++--
 apps/blog-next/app/verify-email/page.tsx      |  5 ++-
 apps/blog-nuxt/pages/verify-email.vue         | 10 ++++-
 .../blog-nuxt/server/api/verify-email.post.ts |  9 +++--
 apps/blog-sveltekit/config/app.ts             |  2 +-
 apps/blog-sveltekit/config/broadcast.ts       |  2 +-
 .../src/routes/api/verify-email/+server.ts    |  9 +++--
 .../src/routes/login/+page.svelte             |  7 +++-
 .../src/routes/register/+page.svelte          |  7 +++-
 .../src/routes/verify-email/+page.svelte      | 12 +++++-
 tests/example-app-auth-flow.mjs               | 38 +++++++++++++++++++
 11 files changed, 90 insertions(+), 20 deletions(-)

diff --git a/apps/blog-next/app/api/verify-email/route.ts b/apps/blog-next/app/api/verify-email/route.ts
index ab7cf904..341a6041 100644
--- a/apps/blog-next/app/api/verify-email/route.ts
+++ b/apps/blog-next/app/api/verify-email/route.ts
@@ -1,4 +1,4 @@
-import { verification } from '@holo-js/auth'
+import { check, verification } from '@holo-js/auth'
 import { sanitizeFlashedInput, validate } from '@holo-js/forms'
 
 import { verifyEmailForm } from '@/lib/schemas/auth'
@@ -12,6 +12,7 @@ export async function POST(request: Request) {
     })
   }
 
+  const wasAuthenticated = await check()
   const { error } = await verification.consume(submission.data.token)
   if (error) {
     return Response.json({
@@ -26,7 +27,9 @@ export async function POST(request: Request) {
   }
 
   return Response.json(submission.success({
-    message: 'Email address verified. You can sign in now.',
-    redirectTo: '/login',
+    message: wasAuthenticated
+      ? 'Email address verified.'
+      : 'Email address verified. You can sign in now.',
+    redirectTo: wasAuthenticated ? '/admin' : '/login',
   }))
 }
diff --git a/apps/blog-next/app/verify-email/page.tsx b/apps/blog-next/app/verify-email/page.tsx
index 0299e3a1..18e1b744 100644
--- a/apps/blog-next/app/verify-email/page.tsx
+++ b/apps/blog-next/app/verify-email/page.tsx
@@ -5,7 +5,7 @@ import { useState } from 'react'
 import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
 
-import { useForm } from '@holo-js/adapter-next/client'
+import { useAuth, useForm } from '@holo-js/adapter-next/client'
 
 import { verifyEmailForm } from '@/lib/schemas/auth'
 
@@ -21,6 +21,7 @@ const panelStyle = {
 
 function VerifyEmailPageContent() {
   const router = useRouter()
+  const auth = useAuth()
   const searchParams = useSearchParams()
   const token = searchParams.get('token') ?? ''
   const email = searchParams.get('email') ?? ''
@@ -34,6 +35,8 @@ function VerifyEmailPageContent() {
       const response = await fetch('/api/verify-email', { method: 'POST', body: formData })
       const submission = await response.json()
       if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
+        await auth.refreshUser()
+        router.refresh()
         router.replace(submission.data.redirectTo)
       }
       return submission
diff --git a/apps/blog-nuxt/pages/verify-email.vue b/apps/blog-nuxt/pages/verify-email.vue
index e132e1c4..62d8d580 100644
--- a/apps/blog-nuxt/pages/verify-email.vue
+++ b/apps/blog-nuxt/pages/verify-email.vue
@@ -1,9 +1,10 @@
 <script setup lang="ts">
-import { useRoute } from '#imports'
+import { navigateTo, useRoute } from '#imports'
 import { useForm } from '@holo-js/adapter-nuxt/client'
 import { ref } from 'vue'
 import { verifyEmailForm } from '~/lib/schemas/auth'
 
+const { refreshUser } = await useAuth()
 const route = useRoute()
 const token = typeof route.query.token === 'string' ? route.query.token : ''
 const email = typeof route.query.email === 'string' ? route.query.email : ''
@@ -14,7 +15,12 @@ const resending = ref(false)
 const form = useForm(verifyEmailForm, {
   initialValues: { token },
   async submitter({ formData }) {
-    return await $fetch('/api/verify-email', { method: 'POST', body: formData })
+    const submission = await $fetch('/api/verify-email', { method: 'POST', body: formData })
+    if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
+      await refreshUser()
+      await navigateTo(submission.data.redirectTo)
+    }
+    return submission
   },
 })
 
diff --git a/apps/blog-nuxt/server/api/verify-email.post.ts b/apps/blog-nuxt/server/api/verify-email.post.ts
index b1f6ba6f..ca8830c1 100644
--- a/apps/blog-nuxt/server/api/verify-email.post.ts
+++ b/apps/blog-nuxt/server/api/verify-email.post.ts
@@ -1,4 +1,4 @@
-import { verification } from '@holo-js/auth'
+import { check, verification } from '@holo-js/auth'
 import { sanitizeFlashedInput, validate } from '@holo-js/forms'
 
 import { verifyEmailForm } from '../../lib/schemas/auth'
@@ -12,6 +12,7 @@ export default defineEventHandler(async (event) => {
     return failure
   }
 
+  const wasAuthenticated = await check()
   const { error } = await verification.consume(submission.data.token)
   if (error) {
     setResponseStatus(event, error.status)
@@ -25,7 +26,9 @@ export default defineEventHandler(async (event) => {
   }
 
   return submission.success({
-    message: 'Email address verified. You can sign in now.',
-    redirectTo: '/login',
+    message: wasAuthenticated
+      ? 'Email address verified.'
+      : 'Email address verified. You can sign in now.',
+    redirectTo: wasAuthenticated ? '/admin' : '/login',
   })
 })
diff --git a/apps/blog-sveltekit/config/app.ts b/apps/blog-sveltekit/config/app.ts
index 3d75b4bc..7d97936f 100644
--- a/apps/blog-sveltekit/config/app.ts
+++ b/apps/blog-sveltekit/config/app.ts
@@ -9,7 +9,7 @@ const appEnv = env('APP_ENV') === 'production'
 export default defineAppConfig({
   name: env('APP_NAME', 'blog-sveltekit'),
   key: env('APP_KEY'),
-  url: env('APP_URL', 'http://localhost:3000'),
+  url: env('APP_URL', 'http://localhost:5173'),
   env: appEnv,
   debug: env('APP_DEBUG', true),
   paths: {
diff --git a/apps/blog-sveltekit/config/broadcast.ts b/apps/blog-sveltekit/config/broadcast.ts
index 6cbd8be1..b37f6978 100644
--- a/apps/blog-sveltekit/config/broadcast.ts
+++ b/apps/blog-sveltekit/config/broadcast.ts
@@ -17,7 +17,7 @@ export default defineBroadcastConfig({
         useTLS: broadcastScheme === 'https',
       },
       clientOptions: {
-        authEndpoint: `${env('APP_URL', 'http://localhost:3000')}/broadcasting/auth`,
+        authEndpoint: `${env('APP_URL', 'http://localhost:5173')}/broadcasting/auth`,
       },
     },
     log: {
diff --git a/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts b/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts
index 989d633d..548288c2 100644
--- a/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts
+++ b/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts
@@ -1,5 +1,5 @@
 import { json } from '@sveltejs/kit'
-import { verification } from '@holo-js/auth'
+import { check, verification } from '@holo-js/auth'
 import { sanitizeFlashedInput, validate } from '@holo-js/forms'
 
 import { verifyEmailForm } from '$lib/schemas/auth'
@@ -13,6 +13,7 @@ export async function POST({ request }: { request: Request }) {
     })
   }
 
+  const wasAuthenticated = await check()
   const { error } = await verification.consume(submission.data.token)
   if (error) {
     return json({
@@ -27,7 +28,9 @@ export async function POST({ request }: { request: Request }) {
   }
 
   return json(submission.success({
-    message: 'Email address verified. You can sign in now.',
-    redirectTo: '/login',
+    message: wasAuthenticated
+      ? 'Email address verified.'
+      : 'Email address verified. You can sign in now.',
+    redirectTo: wasAuthenticated ? '/admin' : '/login',
   }))
 }
diff --git a/apps/blog-sveltekit/src/routes/login/+page.svelte b/apps/blog-sveltekit/src/routes/login/+page.svelte
index 4c9790e0..73543145 100644
--- a/apps/blog-sveltekit/src/routes/login/+page.svelte
+++ b/apps/blog-sveltekit/src/routes/login/+page.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
-  import { goto } from '$app/navigation'
-  import { useForm } from '@holo-js/adapter-sveltekit/client'
+  import { goto, invalidateAll } from '$app/navigation'
+  import { useAuth, useForm } from '@holo-js/adapter-sveltekit/client'
   import { loginForm } from '$lib/schemas/auth'
 
+  const auth = useAuth()
   const form = useForm(loginForm, {
     validateOn: 'blur',
     initialValues: { email: '', password: '', remember: false },
@@ -10,6 +11,8 @@
       const response = await fetch('/api/login', { method: 'POST', body: formData })
       const submission = await response.json()
       if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
+        await auth.refreshUser()
+        await invalidateAll()
         await goto(submission.data.redirectTo)
       }
       return submission
diff --git a/apps/blog-sveltekit/src/routes/register/+page.svelte b/apps/blog-sveltekit/src/routes/register/+page.svelte
index 757a9716..4ea7955e 100644
--- a/apps/blog-sveltekit/src/routes/register/+page.svelte
+++ b/apps/blog-sveltekit/src/routes/register/+page.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
-  import { goto } from '$app/navigation'
-  import { useForm } from '@holo-js/adapter-sveltekit/client'
+  import { goto, invalidateAll } from '$app/navigation'
+  import { useAuth, useForm } from '@holo-js/adapter-sveltekit/client'
   import { registerForm } from '$lib/schemas/auth'
 
+  const auth = useAuth()
   const form = useForm(registerForm, {
     validateOn: 'blur',
     initialValues: { name: '', email: '', password: '', passwordConfirmation: '' },
@@ -10,6 +11,8 @@
       const response = await fetch('/api/register', { method: 'POST', body: formData })
       const submission = await response.json()
       if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
+        await auth.refreshUser()
+        await invalidateAll()
         await goto(submission.data.redirectTo)
       }
       return submission
diff --git a/apps/blog-sveltekit/src/routes/verify-email/+page.svelte b/apps/blog-sveltekit/src/routes/verify-email/+page.svelte
index 8219dc09..6d0203f4 100644
--- a/apps/blog-sveltekit/src/routes/verify-email/+page.svelte
+++ b/apps/blog-sveltekit/src/routes/verify-email/+page.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
-  import { useForm } from '@holo-js/adapter-sveltekit/client'
+  import { goto, invalidateAll } from '$app/navigation'
+  import { useAuth, useForm } from '@holo-js/adapter-sveltekit/client'
   import { verifyEmailForm } from '$lib/schemas/auth'
 
   export let data: {
@@ -11,11 +12,18 @@
   let resendError = ''
   let resending = false
 
+  const auth = useAuth()
   const form = useForm(verifyEmailForm, {
     initialValues: { token: data.token },
     async submitter({ formData }) {
       const response = await fetch('/api/verify-email', { method: 'POST', body: formData })
-      return await response.json()
+      const submission = await response.json()
+      if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
+        await auth.refreshUser()
+        await invalidateAll()
+        await goto(submission.data.redirectTo)
+      }
+      return submission
     },
   })
 
diff --git a/tests/example-app-auth-flow.mjs b/tests/example-app-auth-flow.mjs
index 3c832007..bee96bcf 100644
--- a/tests/example-app-auth-flow.mjs
+++ b/tests/example-app-auth-flow.mjs
@@ -202,6 +202,44 @@ export async function assertExampleAppAuthFlow({
   assert.equal(initialUser.json.authenticated, false)
   assert.equal(initialUser.json.user, null)
 
+  const loggedInVerificationEmail = `${appName}-logged-in-verification-${Date.now()}@app.test`
+  const loggedInVerificationOutputStart = getOutput().length
+  const loggedInVerificationJar = createCookieJar()
+  const loggedInVerification = await fetchAuthJson('/api/register', {
+    fields: {
+      name: 'Logged In Verification User',
+      email: loggedInVerificationEmail,
+      password,
+      passwordConfirmation: password,
+    },
+    headers: {
+      'x-forwarded-for': '127.0.0.221',
+      'x-real-ip': '127.0.0.221',
+    },
+    jar: loggedInVerificationJar,
+  })
+  assert.equal(loggedInVerification.response.status, 201)
+  assert.equal(loggedInVerification.json.ok, true)
+
+  const loggedInVerificationToken = (
+    await waitForOutputMatch(
+      getOutput,
+      authTokenPattern,
+      loggedInVerificationOutputStart,
+    )
+  )[1]
+  assert.ok(loggedInVerificationToken)
+
+  const loggedInVerified = await fetchAuthJson('/api/verify-email', {
+    method: 'POST',
+    fields: {
+      token: loggedInVerificationToken,
+    },
+    jar: loggedInVerificationJar,
+  })
+  assert.equal(loggedInVerified.json.ok, true)
+  assert.equal(loggedInVerified.json.data?.redirectTo, '/admin')
+
   const registerOutputStart = getOutput().length
   const registeredJar = createCookieJar()
   const registered = await fetchAuthJson('/api/register', {

From a5f870bac531e98092bcede36d7b59d4ce918cb0 Mon Sep 17 00:00:00 2001
From: Mohamed Melouk <42706279+cobraprojects@users.noreply.github.com>
Date: Wed, 6 May 2026 17:51:27 +0300
Subject: [PATCH 2/2] fix

---
 apps/blog-next/app/verify-email/page.tsx                   | 1 -
 apps/blog-sveltekit/src/routes/api/verify-email/+server.ts | 5 +++--
 apps/blog-sveltekit/src/routes/verify-email/+page.svelte   | 6 +++++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/apps/blog-next/app/verify-email/page.tsx b/apps/blog-next/app/verify-email/page.tsx
index 18e1b744..9b44079c 100644
--- a/apps/blog-next/app/verify-email/page.tsx
+++ b/apps/blog-next/app/verify-email/page.tsx
@@ -36,7 +36,6 @@ function VerifyEmailPageContent() {
       const submission = await response.json()
       if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
         await auth.refreshUser()
-        router.refresh()
         router.replace(submission.data.redirectTo)
       }
       return submission
diff --git a/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts b/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts
index 548288c2..26ac9fcf 100644
--- a/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts
+++ b/apps/blog-sveltekit/src/routes/api/verify-email/+server.ts
@@ -13,8 +13,9 @@ export async function POST({ request }: { request: Request }) {
     })
   }
 
-  const wasAuthenticated = await check()
-  const { error } = await verification.consume(submission.data.token)
+  const authenticationCheck = check()
+  const verificationResult = verification.consume(submission.data.token)
+  const [wasAuthenticated, { error }] = await Promise.all([authenticationCheck, verificationResult])
   if (error) {
     return json({
       ok: false as const,
diff --git a/apps/blog-sveltekit/src/routes/verify-email/+page.svelte b/apps/blog-sveltekit/src/routes/verify-email/+page.svelte
index 6d0203f4..26f67ea3 100644
--- a/apps/blog-sveltekit/src/routes/verify-email/+page.svelte
+++ b/apps/blog-sveltekit/src/routes/verify-email/+page.svelte
@@ -19,7 +19,11 @@
       const response = await fetch('/api/verify-email', { method: 'POST', body: formData })
       const submission = await response.json()
       if (submission?.ok === true && typeof submission.data?.redirectTo === 'string') {
-        await auth.refreshUser()
+        try {
+          await auth.refreshUser()
+        } catch (error) {
+          console.error('Failed to refresh the current user after email verification.', error)
+        }
         await invalidateAll()
         await goto(submission.data.redirectTo)
       }