From f0078401ee759ad11f3e8ffe6755316d35c99542 Mon Sep 17 00:00:00 2001
From: pradeepkumar <kongupradeep@live.com>
Date: Mon, 22 Dec 2025 13:01:53 +0530
Subject: [PATCH] feat: Require email verification for user login and delay
 token issuance until email is verified.

---
 src/auth/auth.service.ts | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts
index 6b58647..dbbf0de 100644
--- a/src/auth/auth.service.ts
+++ b/src/auth/auth.service.ts
@@ -83,12 +83,6 @@ export class AuthService {
       });
     }
 
-    // Generate tokens
-    const tokens = await this.generateTokens(user.id, user.email, user.role);
-
-    // Create session
-    await this.createSession(user.id, tokens.accessToken, tokens.refreshToken);
-
     // Emit event for email verification (handled by email service)
     this.eventEmitter.emit('user.registered', {
       userId: user.id,
@@ -98,7 +92,9 @@ export class AuthService {
       lastName: dto.lastName,
     });
 
+    // Return message to verify email - no tokens until email is verified
     return {
+      message: 'Registration successful! Please check your email to verify your account before logging in.',
       user: {
         id: user.id,
         email: user.email,
@@ -106,7 +102,6 @@ export class AuthService {
         firstName: dto.firstName,
         lastName: dto.lastName,
       },
-      ...tokens,
     };
   }
 
@@ -136,6 +131,13 @@ export class AuthService {
       throw new UnauthorizedException('Account is not active');
     }
 
+    // Check if email is verified
+    if (!user.emailVerified) {
+      throw new UnauthorizedException(
+        'Please verify your email before logging in. Check your inbox for the verification link.',
+      );
+    }
+
     // Verify password
     const isPasswordValid = await argon2.verify(user.password, dto.password);