feat: Add OAuth providers (Google, Apple, Facebook) and email verification

[marcodejongh]

Summary

• Add Google, Apple, and Facebook OAuth providers to NextAuth configuration
• Implement email verification flow for credentials-based signup using Fastmail SMTP
• Create social login buttons component with proper branding
• Create verify-request and auth error pages
• Add comprehensive setup documentation

Changes

New Files

• packages/web/app/lib/email/email-service.ts - Nodemailer SMTP email service
• packages/web/app/api/auth/verify-email/route.ts - Email verification endpoint
• packages/web/app/api/auth/resend-verification/route.ts - Resend verification endpoint
• packages/web/app/components/auth/social-login-buttons.tsx - OAuth buttons component
• packages/web/app/auth/verify-request/ - Verification request page
• packages/web/app/auth/error/ - Auth error page
• docs/oauth-setup.md - Setup documentation

Modified Files

• packages/web/app/lib/auth/auth-options.ts - Added Apple/Facebook providers and verification callbacks
• packages/web/app/api/auth/register/route.ts - Added email verification on registration
• packages/web/app/auth/login/auth-page-content.tsx - Replaced disabled Google button with social buttons
• packages/web/app/components/auth/auth-modal.tsx - Same social buttons update

Test plan

• Set up OAuth credentials following docs/oauth-setup.md
• Test Google OAuth login
• Test Apple Sign-In (requires HTTPS)
• Test Facebook OAuth login
• Test email/password registration sends verification email
• Test verification link marks email as verified
• Test unverified users cannot login with credentials
• Test resend verification email functionality

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
boardsesh	Ready	Preview, Comment	Jan 1, 2026 10:55am

[claude]

Claude Review

Security Issues

1. Missing rate limiting on auth endpoints - resend-verification/route.ts and verify-email/route.ts have no rate limiting, allowing brute-force token guessing or email spam attacks.

2. Verification token enumeration - resend-verification/route.ts:39-42 reveals whether email is verified vs non-existent, leaking user registration status.

3. OAuth providers fail silently without env vars - auth-options.ts:20-31 uses non-null assertions (!) for OAuth secrets. If env vars are missing, the app will crash at runtime rather than gracefully disabling providers.

Code Issues

4. Transporter initialized at module load - email-service.ts:3-11 creates SMTP connection on module import, which will fail during build or if SMTP env vars are missing in non-email-required environments.

5. XSS in email template - email-service.ts:18 includes email parameter directly in HTML without escaping. While encodeURIComponent is used in the URL, the raw email could contain HTML if the email validation is bypassed.

6. Inconsistent error handling in registration - register/route.ts:90-108 sends verification email but if email sending fails, user is created without ability to verify (no cleanup/rollback).

Missing Tests

7. No tests for any auth endpoints - Critical auth flows (registration, verification, resend) have no test coverage for success cases, error handling, or edge cases like expired tokens.

Style Issues

8. Hardcoded colors - social-login-buttons.tsx:76-78, verify-request-content.tsx:91,96, auth-error-content.tsx:62 use hardcoded colors like #EF4444, #06B6D4 instead of design tokens per CLAUDE.md guidelines.

9. Inline styles - Multiple components use style prop extensively instead of CSS, violating CLAUDE.md guidelines.

[claude]

Claude Review

Security Issues

1. No rate limiting on email endpoints - /api/auth/resend-verification/route.ts and /api/auth/register/route.ts lack rate limiting, allowing attackers to spam verification emails or perform email enumeration via timing attacks.

2. Missing email input validation - resend-verification/route.ts:9 accepts raw email from request.json() without Zod validation (unlike register/route.ts which uses Zod).

3. Timing attack vulnerability - resend-verification/route.ts:30-34 returns immediately for non-existent/verified users but continues to send email for unverified users. The timing difference can leak user status despite the generic message.

Code Issues

4. Social buttons show even when providers not configured - social-login-buttons.tsx always renders all 3 OAuth buttons, but auth-options.ts conditionally adds providers. Users will see broken login buttons if env vars aren't set.

5. Hardcoded colors in email template - email-service.ts:51-70 uses hardcoded hex colors (#06B6D4, #333, etc.) instead of design tokens, violating the CLAUDE.md guideline.

6. Inconsistent error handling - verify-email/route.ts:57-60 updates emailVerified without checking if the user exists, silently succeeding even if the email doesn't match any user.

7. Missing @types/nodemailer in prod dependencies - package.json adds nodemailer to dependencies but @types/nodemailer to devDependencies. Since nodemailer is used in server code, the types should match the runtime dependency placement.

Missing Tests

8. No test coverage - This PR adds 4 new API endpoints and auth logic with no tests for: email verification flow, token expiration, resend functionality, OAuth signIn callback, or the createUser event.