Auth/nextjs: The `onEmailVerify` fails with `no pkce verifier` when resending the verification email. about edgedb-js HOT 1 OPEN

Yeah, this is interesting. This seems to be an issue that we overlooked when extending the verification flow to allow just the email. We should've required email and challenge so that we can encode the challenge into the new verification token that is sent since that is what is validated server-side.

So, at the moment, if you send an email-only verification resend request, it just verifies the email and redirects you back to a provided redirect_to, or else returns a 204 No Content response, but the email is now verified and you can now perform a login flow. At the time I added that flow, I didn't consider that everything assumes that verification ends with an actual login.

I believe we have (at least) two options:

1. Handle email+challenge in the resend flow, and start a new PKCE flow when resending verification emails like in the password reset flow.
2. Handle the redirect_to and 204 No Content flow in a way that requires the user to explicitly log in after verification.

I think it would be useful to handle both of those cases in our auth helper libraries, but starting with the first one is probably the way to go here. I'll get this patched up now!

from edgedb-js.