Redirect confirmed email users to sign in

README.md

@@ -74,7 +74,7 @@ Brevo is configured as Supabase Auth's SMTP provider; the Express API does not s
    <p><a href="https://sporalizer.pages.dev/api/auth/confirm?token_hash={{ .TokenHash }}">Confirm email</a></p>
    ```
 
-   Set **Site URL** to the frontend origin. Allow the frontend callback URLs listed above. The Pages proxy forwards confirmation to the backend, which verifies the one-time token and sets secure, host-only HttpOnly cookies on the frontend domain. Existing email links using the Space origin should be replaced by newly issued emails.
+   Set **Site URL** to the frontend origin. Allow the frontend callback URLs listed above. The Pages proxy forwards confirmation to the backend, which verifies the one-time token and redirects to `/login?verified=1`; the user then signs in with their email and password. Existing email links using the Space origin should be replaced by newly issued emails.
 
 Brevo credentials stay in Supabase SMTP settings and are not added to the browser or committed to `.env`.
 
@@ -84,7 +84,7 @@ Brevo credentials stay in Supabase SMTP settings and are not added to the browse
 - `POST /api/auth/login` — `{ email, password }`.
 - `GET /api/auth/google?redirect=/labs` — starts Google OAuth.
 - `GET /api/auth/callback` — exchanges the Supabase code and sets HttpOnly cookies.
-- `GET /api/auth/confirm?token_hash=...` — verifies the signup email and sets HttpOnly cookies.
+- `GET /api/auth/confirm?token_hash=...` — verifies the signup email and redirects to the login page with a confirmation message.
 - `GET /api/auth/me` — verifies the session and refreshes it when necessary.
 - `POST /api/auth/logout` — clears the session cookies.
 - `GET /api/auth/profile` and `PATCH /api/auth/profile` — read and update the signed-in user's profile.

src/server.ts

@@ -444,8 +444,7 @@ app.get("/api/auth/callback", async (req, res, next) => {
 });
 
 // Supabase confirmation emails can use {{ .TokenHash }} to deliver the one-time
-// token directly to this server. This lets us establish the same HttpOnly
-// cookie session used by password and Google sign-in.
+// token directly to this server. Verify the email, then ask the user to sign in.
 app.get("/api/auth/confirm", async (req, res, next) => {
   try {
     const tokenHash = typeof req.query.token_hash === "string" ? req.query.token_hash : "";
@@ -455,8 +454,7 @@ app.get("/api/auth/confirm", async (req, res, next) => {
     if (error || !data.user || !data.session) return res.redirect(`${env.FRONTEND_URL}/login?error=email_confirmation_failed`);
 
     await syncProfile(data.user);
-    setSessionCookies(res, data.session);
-    return res.redirect(`${env.FRONTEND_URL}/labs`);
+    return res.redirect(`${env.FRONTEND_URL}/login?verified=1`);
   } catch (error) { next(error); }
 });