feat(auth): email verification, Google OAuth, and account settings#4

Merged

BODMAT merged 18 commits into

feat/auth-email-verification-and-account-linking

May 21, 2026

Commits on May 20, 2026

chore(prisma): add AuthIdentity, EmailToken, emailVerified
BODMAT
committed
chore(backend): add nodemailer email service with templates
BODMAT
committed
feat(auth): require email verification for local register/login
BODMAT
committed
fix(auth): close google account-takeover with merge-confirmation flow
BODMAT
committed
feat(auth): set-password, one-time-password and delete-account endpoints
BODMAT
committed
chore(prisma/seed,tests): adapt to AuthIdentity + email verification
BODMAT
committed
fix(prisma): cascade Wallet on user delete
BODMAT
committed
fix(auth): let new register replace an unverified squat on login/email
BODMAT
committed
feat(frontend): verification UX, account settings popup, query toasts
BODMAT
committed
fix(auth-ui): drop DELETE typing confirmation and add header settings avatar
BODMAT
committed
fix(auth): profile photo persistence, google-link flow, and auth UI copy
BODMAT
committed
test(backend): add auth security integration coverage
BODMAT
committed
fix(auth): tighten deletion flow and stabilize security tests
BODMAT
committed
fix(backend): disable real SMTP delivery in test environment
BODMAT
committed