fix(auth): persist signup verification sessions and supply delivery URLs
This commit is contained in:
1 parent
84e16ebc41
commit
f7fe3bb17b
12 files changed
+237
-8
No files matched your search
@@ -1,5 +1,12 @@
|
||||
# Changelog
|
||||
|
||||
## 0.8.19
|
||||
|
||||
- Pass the trusted HTTP origin into registration delivery, so signup verification links are populated without custom URL callbacks.
|
||||
- Add `onSignUp` as an alias for `onSuccessfulSignUp`, rejecting ambiguous duplicate hooks.
|
||||
- Add a `verificationSession` signup action and database-backed, hashed, purpose-bound verification cookies. Sessions survive engine reloads, do not authenticate users, and expire after 30 minutes by default.
|
||||
- Verification resend resolves the pending cookie's user before considering an anonymous identifier.
|
||||
|
||||
## 0.5.0
|
||||
|
||||
- Added `AuthEngineOptions.tokenUrl` for custom verification, reset, magic-link, and invitation page URLs without application-owned API handlers.
|
||||
|
||||
Reference in new issue
Block a user