Add Email Magic Link Login

[2chanhaeng]

Overview

Add Email Magic Link Login. This is a method where a user requests a login link via email and, upon clicking that link, is granted an authenticated session.

API

GraphQL

• requestLogin(email: Email!): RequestLoginResult! mutation:
  If the email account exists, a one-time login link is sent to the email.
• viewer: Account query:
  Returns the currently authenticated account or null.

Example:

mutation {
  requestLogin(email: "email@example.com") {
    sent
  }
}

query {
  viewer {
    uuid
    name
    email
  }
}

HTTP

• GET /auth/callback?token=…:
  After verifying the link, creates a session, sets an HttpOnly cookie, and redirects.
• POST /auth/logout:
  Expires the session

Flow

Login:

1. requestLogin(email)
2. Send ${baseUrl}/auth/callback?token=<token> via email
3. User accesses ${baseUrl}/auth/callback?token=<token>
4. Set session cookie and redirect to the app

Logout: POST /auth/logout → Destroy session, delete cookie.

Data Model

• login_tokens
  • accountId
  • tokenHash
  • expires
  • consumed
• sessions
  • accountId
  • tokenHash
  • expires

Email Sending

Use Upyo

• Build message: @upyo/core
• Send: @upyo/smtp
• Test: @upyo/mock

Out of Scope / Follow-up Tasks

• Sign up
• PassKey
• rate limiting
• UI

[dahlia]

I believe it's better to have verification and revocation mutations in GraphQL instead of HTTP API.