fix: add email confirmation screen and auth callback redirect (#208)

[zacharias-ona]

Closes #208

What

The sign-up flow had no feedback after a user registered when email confirmation was enabled. Users saw no "check your inbox" screen and had no idea what to do next. Additionally, clicking the confirmation link in the email redirected to the landing page instead of the sign-in screen.

How

Three changes:

1. Sign-up page — after signUp(), detect when email confirmation is required (Supabase returns empty identities array) and show a "Check your inbox" confirmation screen with the user's email address, instead of attempting to redirect to a workspace. Also passes emailRedirectTo pointing to /auth/callback so the confirmation link lands in the right place.

2. Auth callback route (src/app/auth/callback/route.ts) — new server-side route that exchanges the Supabase auth code for a session, signs the user out (so they get a fresh sign-in), and redirects to /sign-in?confirmed=true. Added /auth/callback to the proxy's public routes list.

3. Sign-in page — reads the confirmed=true query param and displays a success message: "Email confirmed — you can now sign in." Wrapped in a Suspense boundary for useSearchParams() compatibility.

Testing

• Unit tests: Updated sign-up/page.test.tsx to verify the confirmation screen appears when identities is empty, and that emailRedirectTo is passed to signUp(). Updated sign-in/page.test.tsx to verify the confirmed banner appears/hides based on query param. Added auth/callback/route.test.ts covering code exchange success, failure, and missing code scenarios.
• E2E tests: Added 3 Playwright tests in e2e/auth.spec.ts — confirmation message visibility with/without query param, and auth callback redirect behavior.
• All 232 unit tests pass. All 8 auth E2E tests pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
memo	Ready	Preview, Comment	Apr 17, 2026 11:21pm

[zacharias-ona]

✅ UI verification passed — design spec compliance confirmed.

Files reviewed:

• src/app/(auth)/sign-in/page.tsx — confirmation message (text-xs text-accent), Suspense wrapper
• src/app/(auth)/sign-up/page.tsx — email confirmation pending screen using Card/CardHeader/CardContent

Static analysis (all pass):

Check	Result
Color tokens	✅ text-accent, text-foreground, text-muted-foreground — all valid design spec tokens
Typography	✅ text-2xl font-semibold for heading, text-xs for secondary text — matches scale
Spacing	✅ No arbitrary values
Component usage	✅ shadcn/ui Card, CardHeader, CardTitle, CardDescription, CardContent
Dark mode	✅ All colors use CSS variable tokens
Accessibility	✅ Links keyboard-accessible, text readable
Borders	✅ No custom box-shadows

Visual verification (6 screenshots — desktop dark + mobile for 3 routes):

• /sign-in — ✅ correct layout, spacing, typography
• /sign-in?confirmed=true — ✅ accent-colored confirmation message renders correctly between password field and submit button
• /sign-up — ✅ form layout consistent, no regressions
• All mobile views — ✅ proper responsive layout, adequate touch targets, no horizontal scroll

[zacharias-ona]

✅ Post-merge verification passed.

E2E suite: 57/57 tests passed (auth, editor, page CRUD, sidebar drag, search, workspace switcher, members, import/export).

Ad-hoc smoke tests:

• ✅ Landing page — loaded, has title
• ✅ /sign-in — rendered with email input
• ✅ /api/health — returned OK
• ✅ Authenticated login flow — signed in, redirected to workspace
• ✅ No console errors (unauthenticated or authenticated)

Skipped:

• /dashboard — route does not exist (404, not yet built)
• Editor navigation via sidebar — no page buttons with timestamp found in workspace (covered by E2E suite)