Email verification

What this feature does

New accounts verify ownership of their email through Supabase and Resend before protected platform activity begins.

This guide describes the behavior implemented by Mallello, the people allowed to use it, and the operational checks that keep it dependable.

Detailed workflow

1. The signup form creates the authentication identity and profile request.
2. A modal confirms where the verification message was sent and offers spam guidance and resend.
3. The user opens the one-time link.
4. The auth callback exchanges the verification data for a signed-in session.
5. The callback redirects to the intended destination, including a pending vendor application flow.

Rules and permissions

• The next destination is allow-listed to local application paths.
• Resend requests are rate-limited to prevent abuse.
• Verification messages never ask for a password.
• The vendor-application account notice appears only in the vendor-intent signup flow.

Failure handling and edge cases

• Expired or already-used links should offer a safe resend path.
• Email delivery delays do not justify creating repeated accounts.
• A callback session failure should return to sign-in with a human-readable next action.