Wave-3 user feedback (points 1–3):
- Email templates: extract de/en/fr/es/it copy into emailTemplates.ts
and pick the user's language. Signup forwards navigator.language and
the API also respects Accept-Language; resend/reset reuse user.language.
- Verify link: the email button now points at the client page instead of
the API GET handler, so corporate inbox scanners (M365 Safe Links etc.)
can no longer pre-fetch and silently consume the one-shot token. The
client page requires a real click before calling PATCH /api/auth/
verify-email. The legacy GET handler now just redirects to the client
page so old in-flight emails keep working.
- Code expired UX: when users land via an expired-link redirect we no
longer leave them with a blank email field — the page exposes an email
input so the resend button has something to act on. The verify-email
redirect also forwards the email param.
Misc: tsconfig migrated to moduleResolution=bundler and dropped
downlevelIteration to clear the TS 7.0 deprecation errors.
v1.101.0
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- tsconfig: remove deprecated downlevelIteration (es2017 has native iterators),
change moduleResolution from node to bundler
- auth: set allowDangerousEmailAccountLinking=false on all OAuth providers,
restrict debug mode to development only
- prisma: replace new PrismaClient() with singleton import in 10 API routes
to prevent connection pool exhaustion
- goal API: validate user-supplied quote URLs to block SSRF (private IPs,
non-http(s) schemes)
- email: guard DEV verification/reset link console.logs behind NODE_ENV check
v1.98.0
- Notion OAuth integration: start/callback routes, calendar-events dispatch,
CRUD operations (create/update/delete via Notion API)
- New notion-calendar.ts provider library with database discovery
- Onboarding wizard: expanded to 6 steps (header/tasks/display design),
improved preview fidelity, universal dummy content, Notion in connect step
- Apple Calendar: label changed to "events only", added warning that
Reminders are unsupported since iOS 13 (no CalDAV/API from Apple)
- Fixed 12h time format on now-line, wizard settings apply on completion
v1.57.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- API now handles two cases: send reset link (email only) and
reset password (token + newPassword)
- Generates UUID token stored on user with 1-hour expiry
- Sends styled HTML email with reset link via SMTP
- Prevents email enumeration (always returns success)
v1.23.0
- Email verification: 6-digit code + one-click link on signup
- SMTP integration with nodemailer (lazy-init, auto-detect TLS)
- Verify-email page with 6 input boxes, paste support, auto-submit
- Resend verification with 60s rate limiting
- Block login for unverified email accounts
- Auto-save settings: debounced 800ms save on all profile changes
- Redirect to calendar settings after OAuth connection
- Fix Google Calendar connection display after connecting
- Task actions hover toolbar: fix z-index/overflow clipping on first row
- Make day header sticky with proper stacking context
