- Skip profile redirect when already on /account/setup so users
who just signed up/logged in land on the page without looping
- Add test for the skip-redirect case
- Append ?verified=true to callbackURL in verification link
- Login page reads query param and shows green success banner
when user lands after email verification
- Register action now returns success instead of redirecting to /account/setup
so users without a session (duplicate email with requireEmailVerification)
see a 'check your email' message instead of crashing
- Protected layout guards against null/undefined locals.user before querying
Prisma (was passing id: undefined)
- Updated register page to show success banner with verification instructions
- Updated test to match new action response
- Fix email verification link using Better Auth's url parameter (was hardcoded to google.com)
- Make App.Locals session/user types nullable to match reality
- Add explicit rate limiting config (60s window, 100 max)
- Add trusted origins for localhost:5173 and production domain
- Add Forgot Password? and Register links to login page
- Remove unused dead code from auth-client.ts
- Remove outdated known-bug note from AGENTS.md (register redirect is fixed)
- Fix register redirect bug where successful signup returned 400 instead
of redirecting to /account/setup (use isRedirect() to re-throw redirects)
- Add error display to register page and fix Svelte 5 syntax (on:click)
- Add await to Google sign-in on login page and register page
- Fix logout to await signOut and redirect to /
- Implement full password reset flow:
- Add sendResetPassword callback to auth.ts config
- Create forgot-password page with email submission
- Create reset-password page with one-time token validation
- Guard reset page: redirect to / if no valid token in URL
- Add ghlContactId field to Profile model for future Go High Level integration
- Add Prisma migration for ghl_contact_id column
- Update register test to expect redirect instead of broken 400
19 new tests across 5 test files covering the protected layout redirect,
account page load, registration action (documenting the redirect bug),
and login/register component rendering. Includes shared test utilities.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add self-referential parent/child relation on AffirmationCategory for
one-level hierarchy. Update AffirmationForm with two-level category and
sub-category dropdowns, server actions with find-or-create hierarchy
logic, AffirmationList with Parent
This page is not behind (protected) because it must not use the (protected)/layout.
This means that this page also needs to handle it's own authentication, because it should not be open to the public either.
This is a pretty far-developed starting point. Authentication has been intialized with Better-Auth, a database has been setup with Prisma, and Google + email logins have been enabled, as well as Google + Email registration.
NeilClack