Add an in-memory sliding-window rate limiter and wire it into signup,
resend-verification, reset-password, and verify-email routes. Store
password reset tokens as SHA-256 hashes, raise bcrypt cost to 12, and
switch verification codes to a CSPRNG. Stop echoing calendar
access/refresh tokens back to API clients, bound the weather cache
size, return JSON 401s for unauthenticated API calls instead of an
HTML redirect, and drop the dead mock login route.
v1.113.0
Wave-3 user feedback (points 1–3):
- Email templates: extract de/en/fr/es/it copy into emailTemplates.ts
and pick the user's language. Signup forwards navigator.language and
the API also respects Accept-Language; resend/reset reuse user.language.
- Verify link: the email button now points at the client page instead of
the API GET handler, so corporate inbox scanners (M365 Safe Links etc.)
can no longer pre-fetch and silently consume the one-shot token. The
client page requires a real click before calling PATCH /api/auth/
verify-email. The legacy GET handler now just redirects to the client
page so old in-flight emails keep working.
- Code expired UX: when users land via an expired-link redirect we no
longer leave them with a blank email field — the page exposes an email
input so the resend button has something to act on. The verify-email
redirect also forwards the email param.
Misc: tsconfig migrated to moduleResolution=bundler and dropped
downlevelIteration to clear the TS 7.0 deprecation errors.
v1.101.0
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Email verification: 6-digit code + one-click link on signup
- SMTP integration with nodemailer (lazy-init, auto-detect TLS)
- Verify-email page with 6 input boxes, paste support, auto-submit
- Resend verification with 60s rate limiting
- Block login for unverified email accounts
- Auto-save settings: debounced 800ms save on all profile changes
- Redirect to calendar settings after OAuth connection
- Fix Google Calendar connection display after connecting
- Task actions hover toolbar: fix z-index/overflow clipping on first row
- Make day header sticky with proper stacking context
