vocdoni / saas-backend / 27410631824

60%

Build Type

push

github

Committed by altergui

Commit Message

fix(users): send verification email on password recovery for unverified accounts

Unverified users who hit the password recovery endpoint were silently
getting a 200 OK with no email sent, leaving them unable to log in or
recover their account (deadlock). Now, if the account exists but is not
yet verified, the account verification email is re-sent so the user can
complete registration.

Email enumeration protection is preserved: non-existent addresses still
return 200 OK with no email.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Coverage Stats

9 of 23 new or added lines in 1 file covered. (39.13%)

6 existing lines in 1 file now uncovered.

7963 of 13251 relevant lines covered (60.09%)

42.65 hits per line