Invalid or expired link

This magic link has expired or has already been used.

\n Go back to ${appName}\n `,\n 400,\n );\n }\n\n const { token: sessionToken } = await sessionService.createUserSession(result.userId);\n const cookie = buildSessionCookie(sessionToken);\n\n // Check for OAuth flow cookie\n const flowCookieName = `${prefix}_oauth_flow`;\n const flowCookie = getCookie(c, flowCookieName);\n if (flowCookie) {\n try {\n const flow = JSON.parse(decodeURIComponent(flowCookie));\n const params = new URLSearchParams({\n response_type: \"code\",\n client_id: flow.client_id,\n redirect_uri: flow.redirect_uri,\n state: flow.state,\n });\n return new Response(null, {\n status: 302,\n headers: {\n Location: `/oauth/authorize?${params.toString()}`,\n \"Set-Cookie\": cookie,\n },\n });\n } catch {\n // Invalid flow cookie, fall through to default redirect\n }\n }\n\n return new Response(null, {\n status: 302,\n headers: {\n Location: \"/\",\n \"Set-Cookie\": cookie,\n },\n });\n });\n\n // POST /logout\n authApp.post(\"/logout\", async (c) => {\n const sessionToken = c.get(\"sessionToken\");\n\n if (sessionToken) {\n await sessionService.invalidateSession(sessionToken);\n }\n\n clearSessionCookie(c);\n return c.json({ success: true });\n });\n\n // POST /change-email — authenticated; sends a confirmation link to the new address\n authApp.post(\"/change-email\", async (c) => {\n const user = c.get(\"user\");\n if (!user) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n\n const { email } = await c.req.json();\n if (!email || typeof email !== \"string\") {\n return c.json({ error: \"Email is required\" }, 400);\n }\n\n const newEmail = email.trim().toLowerCase();\n if (!newEmail.includes(\"@\")) {\n return c.json({ error: \"Invalid email\" }, 400);\n }\n\n if (newEmail === user.email) {\n return c.json({ error: \"That is already your email address\" }, 400);\n }\n\n const existing = await queries.getUserByEmail(newEmail);\n if (existing) {\n return c.json({ error: \"That email is already in use\" }, 400);\n }\n\n const { token } = await magicLinkService.createEmailChangeToken(user.id, newEmail);\n const url = new URL(c.req.url);\n const changeUrl = `${url.origin}/auth/change-email/${token}`;\n\n await emailService.sendChangeEmailLink(newEmail, changeUrl);\n\n return c.json({ success: true });\n });\n\n // GET /change-email/:token — verify and update email\n authApp.get(\"/change-email/:token\", async (c) => {\n const token = c.req.param(\"token\");\n const result = await magicLinkService.verifyEmailChangeToken(token);\n\n if (!result) {\n return c.html(\n `\n

Invalid or expired link

This email change link has expired or has already been used.

\n Go back to ${appName}\n `,\n 400,\n );\n }\n\n return new Response(null, {\n status: 302,\n headers: { Location: \"/?email_changed=1\" },\n });\n });\n\n // GET /me — return current user or null\n authApp.get(\"/me\", async (c) => {\n const user = c.get(\"user\");\n return c.json({ user: user || null });\n });\n\n return authApp;\n}\n","deleted","label",[177,158],"backend","permalink","https://www.val.town/x/cricks_unmixed4u/studiokare-auth/code/backend/routes.ts","extension","actionData","errors"]