Accounts auth
Email verification
Tokenized email verification gates login until the user confirms their address.
Implemented Verified from source User-facing
In one sentence
A 64-character verification token emailed at registration (or resend) marks email_verified=1 when opened.
Current behavior
auth_verify_email_token() validates token length, finds the user, rejects already-verified or expired tokens, then clears token fields and sets email_verified=1. Resend generates a new token without revealing whether the email exists.
Evidence
arcana.auth_email_verification.php— schema alter, token generate/verify, SMTP send.arcana.verify.php,arcana.resend_verification.php.
Known limitations
- Verification URL is built from request host, not necessarily
APP_BASE_URL. - Changing email on the account page does not reset verification.