feat: E1 — Auth & Accounts ## Goal Better-auth is wired up. Round out

[fly-productivity-manager]

Summary

All three fixes are in place. Here's a summary of what was done and what the E1 state looks like:

---

E1 Status: Complete (with 3 bug fixes applied)

The full auth & accounts epic was already implemented in the codebase. I found and fixed three real issues:

Bugs fixed

1. Captcha plugin always-on bug (src/auth/index.ts)
captcha({ secretKey: env.TURNSTILE_SECRET_KEY || '' }) unconditionally registered the plugin, which requires an x-captcha-response header on every auth request. But the frontend only renders the Turnstile widget when VITE_TURNSTILE_SITE_KEY is set. Any environment without both env vars would silently block all sign-up and sign-in. Fixed with the same conditional pattern used for social providers.

2. Email change didn't reset verification (src/workers/account.ts)
PUT /api/account/email updated the address but left emailVerified = true, meaning a user could claim any email address and appear verified without ever confirming it. Fixed: the UPDATE now sets emailVerified = 0 so the new address must be confirmed.

3. Resend button used stale session email (src/frontend/pages/AccountSettings.tsx)
After saving a new email, the "Resend verification email" button called resendVerificationEmail(session.user.email) — but the session is cookie-cached for 5 minutes, so it would send the verification link to the old address. Fixed: it now uses emailDraft (which is refreshed by reload() after save) with the session email as a fallback.

Already complete

• Email verification on signup + resend UI
• Password reset flow (forgot/reset pages + email delivery)
• Profile with avatar/banner upload to R2
• Account settings (email, password, notifications, storage quota)
• GDPR account deletion (30-day grace, cancel, cascade)
• Google + GitHub OAuth with account linking
• Session management UI (list, revoke individual, revoke all others)
• Onboarding flow (username → avatar → first upload)
• Profile data rendering on channel page (avatar, banner, displayName, bio, subscriber count)

Tests

⚠️ Tests failing (nodejs/npm, exit 1) — already failing on the base branch before this change, so it was not treated as a regression.

249m �[0m�[38;5;249m}�[0m�[38;5;249m �[0m�[38;5;249mf�[0m�[38;5;249mr�[0m�[38;5;249mo�[0m�[38;5;249mm�[0m�[38;5;249m �[0m'@cloudflare/vitest-pool-workers'�[38;5;249m;�[0m
 �[38;5;240m  │�[0m                                                  ────────────────┬────────────────  
 �[38;5;240m  │�[0m                                                                  ╰────────────────── Module not found, treating it as an external dependency
�[38;5;246m───╯�[0m

failed to load config from /tmp/fly-run_f37055b275f24bf7aea7fbc6c3e87700-Y292Ct/spooool/vitest.workers.config.ts

�[31m⎯⎯⎯⎯⎯⎯⎯�[39m�[1m�[41m Startup Error �[49m�[22m�[31m⎯⎯⎯⎯⎯⎯⎯⎯�[39m
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@cloudflare/vitest-pool-workers' imported from /tmp/fly-run_f37055b275f24bf7aea7fbc6c3e87700-Y292Ct/spooool/node_modules/.vite-temp/vitest.workers.config.ts.timestamp-1786951303322-a583132d0e552.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:855:18)
    at defaultResolve (node:internal/modules/esm/resolve:985:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:747:20)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:320:38)
    at ModuleJob._link (node:internal/modules/esm/module_job:182:49) {
  code: 'ERR_MODULE_NOT_FOUND'
}

---

Opened automatically by fly-dev run run_f37055b275f24bf7aea7fbc6c3e87700.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	editor	c7039ff	Aug 17 2026, 07:24 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	spooool	c7039ff	Aug 17 2026, 07:24 AM