Auth/nextjs: The onEmailVerify fails with no pkce verifier when resending the verification email.

[MiroslavPetrik]

Describe the bug
The emailpassword/verify route handler expects pkce verifier

edgedb-js/packages/auth-nextjs/src/shared.ts

Line 202 in a8f862e

if (!verifier) {

but the emailPasswordResendVerificationEmail action never sets it.

Expected behavior
the onEmailVerify should succeed with the emailPasswordResendVerificationEmail server action.

Versions (please complete the following information):

• OS: W11
• EdgeDB version (e.g. 2.0): 4.5+28216a1
• EdgeDB CLI version (e.g. 2.0): 4.1.0+127aeb9
  "@edgedb/auth-nextjs": "0.2.0-beta.0"

Additional context
A similar action - sendPasswordResetEmail is setting the verifier, so the fix should be analogical

edgedb-js/packages/auth-nextjs/src/app/index.ts

Line 103 in a8f862e

const { verifier } = await (

[scotttrinh]

Yeah, this is interesting. This seems to be an issue that we overlooked when extending the verification flow to allow just the email. We should've required email and challenge so that we can encode the challenge into the new verification token that is sent since that is what is validated server-side.

So, at the moment, if you send an email-only verification resend request, it just verifies the email and redirects you back to a provided redirect_to, or else returns a 204 No Content response, but the email is now verified and you can now perform a login flow. At the time I added that flow, I didn't consider that everything assumes that verification ends with an actual login.

I believe we have (at least) two options:

1. Handle email+challenge in the resend flow, and start a new PKCE flow when resending verification emails like in the password reset flow.
2. Handle the redirect_to and 204 No Content flow in a way that requires the user to explicitly log in after verification.

I think it would be useful to handle both of those cases in our auth helper libraries, but starting with the first one is probably the way to go here. I'll get this patched up now!