feat: Require email verification for user login and delay token issuance until email is verified.

src/auth/auth.service.ts

@@ -83,12 +83,6 @@ export class AuthService {
       });
     }
 
-    // Generate tokens
-    const tokens = await this.generateTokens(user.id, user.email, user.role);
-
-    // Create session
-    await this.createSession(user.id, tokens.accessToken, tokens.refreshToken);
-
     // Emit event for email verification (handled by email service)
     this.eventEmitter.emit('user.registered', {
       userId: user.id,
@@ -98,7 +92,9 @@ export class AuthService {
       lastName: dto.lastName,
     });
 
+    // Return message to verify email - no tokens until email is verified
     return {
+      message: 'Registration successful! Please check your email to verify your account before logging in.',
       user: {
         id: user.id,
         email: user.email,
@@ -106,7 +102,6 @@ export class AuthService {
         firstName: dto.firstName,
         lastName: dto.lastName,
       },
-      ...tokens,
     };
   }
 
@@ -136,6 +131,13 @@ export class AuthService {
       throw new UnauthorizedException('Account is not active');
     }
 
+    // Check if email is verified
+    if (!user.emailVerified) {
+      throw new UnauthorizedException(
+        'Please verify your email before logging in. Check your inbox for the verification link.',
+      );
+    }
+
     // Verify password
     const isPasswordValid = await argon2.verify(user.password, dto.password);