diff --git a/packages/api/src/routers/auth/auth_router.ts b/packages/api/src/routers/auth/auth_router.ts index b439b2bf2..109f202dd 100644 --- a/packages/api/src/routers/auth/auth_router.ts +++ b/packages/api/src/routers/auth/auth_router.ts @@ -467,11 +467,11 @@ export function authRouter() { cors({ ...corsConfig, maxAge: 600 }) ) - router.get( - '/confirm-email/:token', + router.post( + '/confirm-email', cors(corsConfig), async (req: express.Request, res: express.Response) => { - const token = req.params.token + const token = req.body.token try { // verify token diff --git a/packages/api/src/services/create_user.ts b/packages/api/src/services/create_user.ts index 4e1a93578..5248aee2a 100644 --- a/packages/api/src/services/create_user.ts +++ b/packages/api/src/services/create_user.ts @@ -138,10 +138,10 @@ export const sendConfirmationEmail = async (user: { }): Promise => { // generate confirmation link const confirmationToken = generateVerificationToken(user.id) - const confirmationLink = `${env.client.url}/api/auth/confirm-email/${confirmationToken}` + const confirmationLink = `${env.client.url}/confirm-email/${confirmationToken}` // send email return sendEmail({ - from: `Omnivore <${env.sender.message}>`, + from: env.sender.message, to: user.email, subject: 'Confirm your email', text: `Hey ${user.name},\n\nPlease confirm your email by clicking the link below:\n\n${confirmationLink}\n\n`, diff --git a/packages/api/test/routers/auth.test.ts b/packages/api/test/routers/auth.test.ts index 925e9c587..159a8cd00 100644 --- a/packages/api/test/routers/auth.test.ts +++ b/packages/api/test/routers/auth.test.ts @@ -263,17 +263,19 @@ describe('auth router', () => { describe('confirm-email', () => { const confirmEmailRequest = (token: string): supertest.Test => { - return request.get(`${route}/confirm-email/${token}`).send() + return request.post(`${route}/confirm-email`).send({ token }) } let user: User let token: string before(async () => { + sinon.replace(util, 'sendEmail', sinon.fake.resolves(true)) user = await createTestUser('pendingUser', undefined, 'password', true) }) after(async () => { + sinon.restore() await deleteTestUser(user.name) })