375 one time email verification by karenunify · Pull Request #452 · berkmancenter/frankly

karenunify · 2026-05-22T18:05:55Z

What is in this PR?

One time email verification on sign-up/login if not already verified using Firebase Auth.

Changes in the codebase

When a user creates a new account or is logging back in, once their email is submitted, a query is made to Firebase Auth to see if that user's email has been verified. When creating the account, they see a page prompting them to check their email and verify their account with a link that is valid for 30 minutes and should not be able to get past that page until their email is verified. Same when logging back in with an existing account that has not had the email verified.

Changes outside the codebase

The app domain needs to be whitelisted in Firebase Auth, and Firebase Auth email verification template/action settings need to be modified:

In the Firebase console, go to Security > Authentication.
In the Sign-in method tab, enable the Email/Password sign-in method. Note that email/password sign-in must be enabled to use email link sign-in.
In the same section, enable the Email link (passwordless sign-in) sign-in provider.
Click Save.

Testing this PR

Create a new account:

after signing up, a user should be redirected to a page prompting them to verify their email
they should not be able to get past this page until email has been verified, either by refreshing the page, or signing in from another tab

Log in with an existing account where the user has not verified their email:

once submitting their email/password, an existing user should be redirected to a page prompting them to verify their email
they should not be able to get past this page until email has been verified, either by refreshing the page, or signing in from another tab

PR Checklist

[ x] Where applicable, I have added localization (l10n) entries to my feature for user-facing text.

AI tools used (if applicable):
Claude Code extension in VS code for best practices and debugging

Copilot

Pull request overview

Implements a one-time email verification flow for email/password users by requiring emailVerified for “signed in” status, sending verification “magic links”, and presenting a dedicated verification UI when a user is authenticated but unverified.

Changes:

Added SignInState.awaitingEmailVerification and updated sign-in gating to require emailVerified.
Implemented sending/handling of email sign-in links and verifyAndChangeEmail action codes in UserService, with pending link state stored in shared preferences.
Added a verification screen that lets users resend the link and edit/resend when they mistyped their email.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 10 comments.

File	Description
`client/lib/features/user/data/services/user_service.dart`	Adds email-link verification helpers, URL handling for auth action codes, and changes “signed in” semantics to require verified email.
`client/lib/core/widgets/initial_loading_widget.dart`	Displays a new verification screen when the user is signed in but email-unverified; provides resend/edit UX.
`client/lib/core/data/services/shared_preferences_service.dart`	Persists pending verification email + timestamp to support email-link handling and expiry messaging.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    await sharedPreferencesService.clearPendingEmailVerification();
+    await _firebaseAuth.signInWithEmailLink(email: email, emailLink: emailLink);


+  Future<void> sendMagicVerificationLink(String email) async {
+    _emailVerificationError = null;
+    await sharedPreferencesService.setPendingEmailVerification(email);
+    await _firebaseAuth.sendSignInLinkToEmail(
+      email: email,


+  String? get emailVerificationError => _emailVerificationError;
+
+  Future<void> sendMagicVerificationLink(String email) async {
+    _emailVerificationError = null;


+  }
+
+  Future<void> updateEmailAndResendVerification(String newEmail) async {
+    await _currentUser?.verifyBeforeUpdateEmail(


+            oobCode != null) {
+          _verifyAndChangeEmailHandled = true;
+          await _firebaseAuth.applyActionCode(oobCode);
+          // authStateChanges fires again with the updated verified user — return early here.


+    final svc = context.watch<UserService>();
+    final email = svc.firebaseAuth.currentUser?.email ?? '';
+    final linkError = svc.emailVerificationError;
+    return Scaffold(


+  Future<void> _resend() async {
+    final email = userService.firebaseAuth.currentUser?.email;
+    if (email == null) return;


+    if (!user.isAnonymous && !user.emailVerified) {
+      _signInState = SignInState.awaitingEmailVerification;
+    } else {
+      _signInState = SignInState.signedIn;
+    }


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…karenunify/kh into 375-one-time-email-verification

karenunify · 2026-05-26T18:17:18Z

@katherineqian if you wouldn't mind deploying this branch to the staging environment so I can test the verification email from Firebase Auth is actually being sent and works (rather than the mocked link generated in the local auth emulator), that would be much appreciated!

I believe this is the only change that's needed in Firebase Console/Auth of the project for the email verification to work:

Enable the "Email link (passwordless sign-in)" method under Authentication → Sign-in methods in the Firebase console

katherineqian · 2026-05-27T15:27:12Z

Hi @karenunify, thank you for leading this work! Here is the preview deployment I generated: https://gen-hls-bkc-7627--email-verification-4-74t50cj1.web.app/ I also enabled passwordless sign-in as shown below.

karenunify · 2026-05-27T16:16:38Z

@katherineqian I'm working on fixing this PR! I think I have too much built in to work with the local auth emulator, rather than allowing a the firebase authentication to work its own magic.

I'll let you know when it's ready to be redeployed to staging, and in the meantime feel free to deploy any other branch that might need testing. Thank you!!

…d of sendSignInLinkToEmail

karenunify · 2026-05-28T22:26:06Z

@katherineqian when you have a chance, could you redeploy this branch to staging? I've hopefully simplified the flow a bit.

katherineqian · 2026-06-02T22:42:56Z

Hi @karenunify, here is the new preview link! Will also send on Slack :) https://gen-hls-bkc-7627--email-verification-new-umc5m3nu.web.app

karenunify · 2026-06-05T22:33:22Z

@katherineqian or @mikewillems, whenever you have a spare moment, could one of you deploy the latest updates to this branch to staging, and update the whitelisted domains to match in firebase? Thank you!!!

karenunify · 2026-06-11T18:08:33Z

@katherineqian whenever you have a moment, could you deploy the latest updates to this branch to staging, and update the whitelisted domains to match in firebase? Thank you!!!

johnnycrich · 2026-06-12T14:53:51Z

+                ),
+              ),
+            SizedBox(height: 9),
+            if (_formError.isNotEmpty) AccountErrorMessage(errorCode: _formError),


Hi @karenunify! @mwmarino pointed me to an issue in your changes that I investigated on his behalf. It looks like AccountErrorMessage is being shown twice when there is a _formError. It's should show only above the form. Thanks!

@johnnycrich eeek! My apologies! Will get this cleaned up asap!

karenunify · 2026-06-12T19:05:32Z

@katherineqian I think this is finally ready for review. A couple things to note:

In the verify_email_page.dart there are 2 blocks of commented out code which is terrible, I know. The reason for this is the requirements in the ticket specify allowing users to modify their email address right after account creation in the case of a type, however during Matt's design review it was determined confusing/unnecessary at that point. I was going to bring it up at the next sync
Users are still being shown the Firebase auth confirmation page, rather than being redirected to the app, despite following Firebase's documentation to avoid this. While this isn't ideal, it is not a show stopper while I continue to look into it.

katherineqian · 2026-06-12T20:15:04Z

Great, thank you @karenunify for all your hard work and revisions on this! I will take a look. Updated preview link here for anyone else testing: https://gen-hls-bkc-7627--email-verification-0611-69kazsg5.web.app/

karenunify added 2 commits May 21, 2026 11:28

initial implementation of email verification on account creation

c4a8f14

set verification email to expire after 30 minutes

0e6041f

Copilot AI review requested due to automatic review settings May 22, 2026 18:05

karenunify marked this pull request as draft May 22, 2026 18:06

karenunify temporarily deployed to staging May 22, 2026 18:06 — with GitHub Actions Inactive

Copilot started reviewing on behalf of karenunify May 22, 2026 18:06 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

Potential fix for pull request finding

d63d573

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

karenunify temporarily deployed to staging May 22, 2026 19:09 — with GitHub Actions Inactive

karenunify added 2 commits May 22, 2026 12:34

update with coplilot review suggestions

b1d9889

Merge branch '375-one-time-email-verification' of https://github.com/…

a31505d

…karenunify/kh into 375-one-time-email-verification

karenunify temporarily deployed to staging May 22, 2026 19:35 — with GitHub Actions Inactive

remove rethrow causing json error from local emulator

f814d03

karenunify temporarily deployed to staging May 22, 2026 20:43 — with GitHub Actions Inactive

karenunify marked this pull request as ready for review May 26, 2026 18:11

karenunify and others added 3 commits May 28, 2026 12:43

fix url flow

111e749

simplify email verification using sendEmailVerification method instea…

633d778

…d of sendSignInLinkToEmail

Merge branch 'staging' into 375-one-time-email-verification

c0eda3f

karenunify temporarily deployed to staging May 28, 2026 22:19 — with GitHub Actions Inactive

revert data type to string

b84c9ab

karenunify temporarily deployed to staging May 28, 2026 22:24 — with GitHub Actions Inactive

mikewillems temporarily deployed to staging June 1, 2026 18:01 — with GitHub Actions Inactive

add emailVerified boolean back and move verification message to own page

669a299

karenunify temporarily deployed to staging June 4, 2026 18:06 — with GitHub Actions Inactive

katherineqian self-requested a review June 8, 2026 21:34

karenunify and others added 3 commits June 9, 2026 15:49

allow for browsers that block Firestore's webchannel

02a90b2

ui/ux changes

eb5eada

Merge branch 'staging' into 375-one-time-email-verification

dfda15a

karenunify had a problem deploying to staging June 11, 2026 18:08 — with GitHub Actions Failure

fix formatting error

1a6169c

karenunify had a problem deploying to staging June 11, 2026 18:17 — with GitHub Actions Failure

fix merge conflicts

d6a0ec7

karenunify temporarily deployed to staging June 11, 2026 18:34 — with GitHub Actions Inactive

ux updates

87bad3f

karenunify temporarily deployed to staging June 11, 2026 20:49 — with GitHub Actions Inactive

style updates

b8931b3

karenunify temporarily deployed to staging June 11, 2026 21:53 — with GitHub Actions Inactive

replace deprecated method

2595a73

karenunify temporarily deployed to staging June 11, 2026 22:01 — with GitHub Actions Inactive

revert handleCodeInApp boolean

a718455

karenunify temporarily deployed to staging June 11, 2026 23:21 — with GitHub Actions Inactive

johnnycrich reviewed Jun 12, 2026

View reviewed changes

johnnycrich mentioned this pull request Jun 12, 2026

Login error messaging appearing twice #483

Open

fix messy file

2ca9810

karenunify temporarily deployed to staging June 12, 2026 18:37 — with GitHub Actions Inactive

clean up duplicate code

308fa10

karenunify had a problem deploying to staging June 12, 2026 18:59 — with GitHub Actions Error

karenunify deployed to staging June 12, 2026 21:19 — with GitHub Actions Active

		await sharedPreferencesService.clearPendingEmailVerification();
		await _firebaseAuth.signInWithEmailLink(email: email, emailLink: emailLink);

Conversation

karenunify commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is in this PR?

Changes in the codebase

Changes outside the codebase

Testing this PR

PR Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

karenunify commented May 26, 2026

Uh oh!

katherineqian commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

karenunify commented May 27, 2026

Uh oh!

karenunify commented May 28, 2026

Uh oh!

katherineqian commented Jun 2, 2026

Uh oh!

karenunify commented Jun 5, 2026

Uh oh!

karenunify commented Jun 11, 2026

Uh oh!

johnnycrich Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

karenunify Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

karenunify commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

katherineqian commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

karenunify commented May 22, 2026 •

edited

Loading

katherineqian commented May 27, 2026 •

edited

Loading

karenunify commented Jun 12, 2026 •

edited

Loading