Sign in verified accounts automatically and require eight-character passwords

apps/server/src/app.ts

@@ -12,6 +12,7 @@ import { timingSafeEqual } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { z } from 'zod';
 import {
+  PASSWORD_MIN_LENGTH,
   devicePatch,
   requestInput,
   spaceInput,
@@ -676,12 +677,20 @@ export async function createApp(cfg: Config, options: { mailer?: Mailer } = {})
       secure: cfg.production,
       sameSite: 'lax',
     });
+  const setAccountCookie = (reply: any, result: { token: string; expiresAt: number }) =>
+    reply.setCookie('hop_account', result.token, {
+      httpOnly: true,
+      secure: cfg.production,
+      sameSite: 'lax',
+      path: '/',
+      expires: new Date(result.expiresAt),
+    });
   app.get('/api/auth/me', async (req) => {
     const current = service.auth.session(req.cookies.hop_account);
     return {
       account: current ? service.auth.serialize(current.user) : null,
       registrationOpen: cfg.registrationMode === 'open',
-      passwordMinLength: cfg.production ? 12 : 1,
+      passwordMinLength: PASSWORD_MIN_LENGTH,
     };
   });
   app.post('/api/auth/register', async (req) => {
@@ -705,9 +714,11 @@ export async function createApp(cfg: Config, options: { mailer?: Mailer } = {})
       input.setupToken,
     );
   });
-  app.post('/api/auth/verify-email', async (req) =>
-    service.auth.verify(tokenInput.parse(req.body).token),
-  );
+  app.post('/api/auth/verify-email', async (req, reply) => {
+    const result = service.auth.verify(tokenInput.parse(req.body).token, req.cookies.hop_account);
+    setAccountCookie(reply, result);
+    return { ok: true, account: result.account };
+  });
   app.post('/api/auth/verify-email-change', async (req) =>
     service.auth.verifyEmailChange(tokenInput.parse(req.body).token),
   );
@@ -729,13 +740,7 @@ export async function createApp(cfg: Config, options: { mailer?: Mailer } = {})
       ip(req) ?? 'unknown',
       req.cookies.hop_account,
     );
-    reply.setCookie('hop_account', result.token, {
-      httpOnly: true,
-      secure: cfg.production,
-      sameSite: 'lax',
-      path: '/',
-      expires: new Date(result.expiresAt),
-    });
+    setAccountCookie(reply, result);
     return { account: result.account };
   });
   app.post('/api/auth/logout', async (req, reply) => {