feat(auth): introduce email verification policy configuration - #3393
feat(auth): introduce email verification policy configuration#3393manucorporat wants to merge 1 commit into
Conversation
- Added `AUTH_REQUIRE_EMAIL_VERIFICATION` environment variable to declare email verification policy for password signups across all environments, including production. - Updated documentation to reflect the new email verification policy and its implications for signup processes. - Enhanced the auth configuration to support the new policy, allowing for more granular control over email verification requirements. - Implemented tests to ensure the correct behavior of the email verification policy in various environments.
|
Here's a visual recap of what changed: Open the full interactive recap |
![builder-io-integration[bot]](https://avatars.githubusercontent.com/in/353721?s=60&v=4){kind=small}
There was a problem hiding this comment.
Builder reviewed your changes and found 1 potential issue 🟡
Review Details
Code Review Summary
PR #3393 adds an optional auth.requireEmailVerification setting and AUTH_REQUIRE_EMAIL_VERIFICATION alias, with explicit precedence over environment-derived defaults and the QA-only skip flag. The auth implementation keeps the unset case distinct, correctly prevents unverifiable password signups when verification is required but no email provider is configured, and the added tests cover the important precedence and provider combinations. The Vite alias cleanup is also well-targeted for Vite 8, and the documentation/changesets are comprehensive.
Risk assessment: High, because this changes authentication policy and can affect account creation and login security.
Key Findings
- 🟡 MEDIUM — The Vite compatibility cleanup unconditionally removes
rollupOptions, which is still the supported configuration key for Vite 7 consumers. This can silently discard user build and dependency-prebundling options.
The authentication-policy review found no additional confirmed security or behavior defects. The PR-specific auth and Vite tests reported by reviewers passed.
🧪 Browser testing: All 16 planned auth flows were attempted but could not be verified because Chrome DevTools was unavailable and the sandbox's database write path returned unrelated Neon/WebSocket errors.
| // property, so returning our own `rolldownOptions` alongside it makes the two | ||
| // diverge and Vite warns that this plugin set both — then ignores the | ||
| // `rollupOptions` half regardless. Drop the alias from what we spread back. | ||
| const { rollupOptions: _buildRollupOptionsAlias, ...userBuild } = |
There was a problem hiding this comment.
🟡 Preserve rollupOptions for Vite 7 consumers
The new destructuring unconditionally removes userConfig.build.rollupOptions (and the analogous optimizeDeps.rollupOptions) before returning the plugin config. Because @agent-native/core supports vite >=7, Vite 7 consumers can lose configured Rollup inputs, outputs, plugins, or externals; preserve genuine Vite 7 rollupOptions values while removing only the Vite 8 alias.
Additional Info
Confirmed by 2 of 3 parallel code-review agents; the third found no additional issues.
1 participant
AUTH_REQUIRE_EMAIL_VERIFICATIONenvironment variable to declare email verification policy for password signups across all environments, including production.