Merge branch 'transactions-in-procedure'

apps/api-server/src/procedures/auth/signup.ts

@@ -269,13 +269,34 @@ export const signup = os.auth.signup.handler(async ({ input, context }) => {
     });
   }
 
-  // Create session (7 days, trusted mode false initially, no device)
-  const session = await createSession(context.db, {
-    userId,
-    deviceId: null,
-    trustedMode: false,
-    geo,
-    userAgent,
+  // Generate verification token
+  const verificationToken = generateSecureBase58Token();
+  const verificationExpiresAt = generateExpiry(
+    TOKEN_DURATIONS.EMAIL_VERIFICATION,
+  );
+
+  // Create session and email verification in transaction
+  const session = await context.db.transaction().execute(async (trx) => {
+    // Create session (7 days, trusted mode false initially, no device)
+    const newSession = await createSession(trx, {
+      userId,
+      deviceId: null,
+      trustedMode: false,
+      geo,
+      userAgent,
+    });
+
+    // Store verification token (store raw token, not hash - it's already high-entropy)
+    await trx
+      .insertInto("email_verifications")
+      .values({
+        user_id: userId,
+        token: verificationToken,
+        expires_at: verificationExpiresAt,
+      })
+      .execute();
+
+    return newSession;
   });
 
   // Set session cookie