fix(auth): email-change recovery re-send and confirmation feedback (#2034)

* fix(auth): email-change recovery re-send and confirmation feedback

A half-completed secure email change was a dead end: the pending-address
short-circuit in /api/account/email swallowed every retry without
re-sending mails, so once the confirmation links expired the user could
never recover, and confirmation clicks landed on the dashboard with no
feedback at all.

- /api/account/email: only short-circuit a repeat request while the
  pending mails are fresh (30 min); a stale pending change falls through
  to GoTrue, which restarts the change and re-sends both mails
- /auth/callback: type=email_change now redirects to a status page
  (/auth/email-change) that says whether one click remains, the change
  is complete, or the link was dead, instead of landing silently
- auth mail templates: both email-change mails explain that two mails
  are sent and both links must be clicked
- settings: the save button re-enables for the pending address as
  Skicka igen, so users can trigger the re-send themselves

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(auth): exempt email-change confirmations from the authenticated /auth bounce (skeptic findings)

- middleware: let /auth/email-change and /auth/callback?type=email_change
  through for authenticated users; the bounce to / swallowed confirmation
  clicks before verifyOtp ran (pre-existing since #2017)
- email-change done page resolves the WL-14 landing destination for the CTA
- /api/account/email returns resent flag; settings toast says mails were
  already sent instead of claiming a fresh send

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/account/email/__tests__/route.test.ts

@@ -104,12 +104,13 @@ describe('POST /api/account/email', () => {
     expect(String(options.emailRedirectTo)).toMatch(/\/auth\/callback$/)
   })
 
-  it('short-circuits a repeat request for the already-pending address', async () => {
+  it('short-circuits a repeat request while the pending mails are fresh', async () => {
     const { updateUser } = mockUserClient({
       user: {
         id: 'user-1',
         email: 'old@testbrand.example',
         new_email: 'pending@testbrand.example',
+        email_change_sent_at: new Date(Date.now() - 60_000).toISOString(),
       } as { id: string; email?: string },
     })
 
@@ -126,6 +127,47 @@ describe('POST /api/account/email', () => {
     expect(updateUser).not.toHaveBeenCalled()
   })
 
+  it('re-sends when the pending change is stale (expired-link recovery)', async () => {
+    const { updateUser } = mockUserClient({
+      user: {
+        id: 'user-1',
+        email: 'old@testbrand.example',
+        new_email: 'pending@testbrand.example',
+        email_change_sent_at: new Date(
+          Date.now() - 2 * 60 * 60 * 1000,
+        ).toISOString(),
+      } as { id: string; email?: string },
+    })
+
+    const req = createMockRequest('/api/account/email', {
+      method: 'POST',
+      body: { email: 'pending@testbrand.example' },
+    })
+    const { status } = await parseJsonResponse(await POST(req))
+
+    expect(status).toBe(200)
+    expect(updateUser).toHaveBeenCalledTimes(1)
+  })
+
+  it('re-sends when the pending change has no sent timestamp', async () => {
+    const { updateUser } = mockUserClient({
+      user: {
+        id: 'user-1',
+        email: 'old@testbrand.example',
+        new_email: 'pending@testbrand.example',
+      } as { id: string; email?: string },
+    })
+
+    const req = createMockRequest('/api/account/email', {
+      method: 'POST',
+      body: { email: 'pending@testbrand.example' },
+    })
+    const { status } = await parseJsonResponse(await POST(req))
+
+    expect(status).toBe(200)
+    expect(updateUser).toHaveBeenCalledTimes(1)
+  })
+
   it('returns 409 when the address already belongs to another account', async () => {
     mockUserClient({
       user: { id: 'user-1', email: 'old@testbrand.example' },

app/api/account/email/route.ts

@@ -12,6 +12,11 @@ const ChangeEmailSchema = z.object({
   email: z.string().trim().toLowerCase().max(320).pipe(z.string().email()),
 })
 
+// How long a pending change is considered fresh enough that re-submitting the
+// same address is a no-op instead of a re-send. Kept well under the token
+// expiry so a user with a dead link can always get new mails.
+const FRESH_PENDING_MS = 30 * 60 * 1000
+
 /**
  * POST /api/account/email
  *
@@ -50,12 +55,24 @@ export async function POST(request: Request) {
   }
 
   // Re-requesting the address that is already awaiting confirmation is a
-  // no-op success rather than another GoTrue round trip (which would re-send
-  // both confirmation mails and eat into the send rate limit). new_email is
-  // absent on the claims-mapped fast path; then GoTrue's own rate limit is
-  // the backstop.
+  // no-op success ONLY while the pending mails are fresh (protects the send
+  // rate limit against double-clicks). Once they are older than that, the
+  // confirmation links may have expired and the user's only recovery path is
+  // re-running the change, so fall through to GoTrue, which restarts the
+  // change and re-sends both mails. new_email/email_change_sent_at are absent
+  // on the claims-mapped fast path; then GoTrue's own rate limit is the
+  // backstop.
   if (user.new_email && email === user.new_email.toLowerCase()) {
-    return NextResponse.json({ data: { ok: true, pending_email: email } })
+    const sentAt = user.email_change_sent_at
+      ? Date.parse(user.email_change_sent_at)
+      : Number.NaN
+    const fresh =
+      Number.isFinite(sentAt) && Date.now() - sentAt < FRESH_PENDING_MS
+    if (fresh) {
+      return NextResponse.json({
+        data: { ok: true, pending_email: email, resent: false },
+      })
+    }
   }
 
   // Trusted-origin resolution, not request.url: behind a proxy request.url
@@ -98,5 +115,7 @@ export async function POST(request: Request) {
 
   log.info('email change requested', { userId: user.id })
 
-  return NextResponse.json({ data: { ok: true, pending_email: email } })
+  return NextResponse.json({
+    data: { ok: true, pending_email: email, resent: true },
+  })
 }