Add email verification for account emails

[ultimate]

Motivation

• Ensure password resets are only possible for addresses that are actually owned by the user by requiring email verification before issuing reset tokens.
• Verify newly-registered emails and emails that are changed so password reset and account recovery remain reliable.
• Provide a user-facing verification flow and localized copy so users can confirm ownership via an emailed link.

Description

• Add persistent verification state and token storage by adding email_verified_at to the users table and a new email_verification_tokens table via app/lib/db/migrations/019_email_verification_tokens.sql and app/lib/db/schema.sql.
• Extend app/lib/users.ts to send verification emails on register and on email changes, clear email_verified_at on change, generate/verify verification tokens (sendEmailVerification, verifyEmailWithToken), and require email_verified_at before creating password reset tokens in requestPasswordReset.
• Add reusable mail sending helpers in app/lib/mailer.ts with sendEmailVerificationEmail and sendPasswordResetEmail, and use a dynamic nodemailer import so tests can run without an SMTP config.
• Add API and UI for verification: app/api/email-verification/confirm/route.ts and the client page at app/verify-email/page.tsx that consumes the verification link token and displays success/error messages.
• Add localized strings for verification emails and the verification UI in the app/lib/i18n/dictionaries/*.ts files.
• Add/extend tests in tests/app/lib/mailer.test.ts and tests/app/lib/users.test.ts to cover sending verification emails, verifying tokens, and gating password-reset token creation.

Testing

• Ran npm run lint and npm run typecheck, both succeeded.
• Ran unit tests via npm test (Vitest); all tests passed (including the new verification tests).
• Ran npm run build (Next.js build) and verified the /verify-email page renders; the production build completed successfully.
• Performed a small smoke check by navigating to /verify-email and capturing a screenshot to verify the page shows the expected messaging.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ultilog	Ready	Preview, Comment	Jul 11, 2026 9:06pm