feat: social auth account linking

app/(app)/settings/page.tsx

@@ -14,9 +14,19 @@
  * `<main>` below.
  */
 
-import { useState } from "react";
+import { Suspense, useEffect, useState } from "react";
 import Link from "next/link";
-import { ChevronLeft, ChevronRight } from "lucide-react";
+import { useRouter, useSearchParams } from "next/navigation";
+import {
+  AlertCircle,
+  Check,
+  ChevronLeft,
+  ChevronRight,
+  LogOut,
+} from "lucide-react";
+import { auth, AuthError } from "@/lib/auth";
+import { useAuth } from "@/components/auth/auth-provider";
+import { AddEmailModal } from "@/components/auth/add-email-modal";
 import { ChangePasswordModal } from "@/components/auth/change-password-modal";
 import { ReadingSettings } from "@/components/reading-settings";
 
@@ -29,9 +39,9 @@ export default function SettingsPage() {
       <header className="space-y-1">
         <Link
           href="/u/me"
-          className="inline-flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground transition-colors"
+          className="inline-flex items-center gap-1 text-base text-muted-foreground hover:text-foreground transition-colors"
         >
-          <ChevronLeft className="size-4" />
+          <ChevronLeft className="size-5" />
           Back to profile
         </Link>
         <h1 className="font-[family-name:var(--font-title)] text-3xl font-semibold text-foreground pt-2">
@@ -47,16 +57,56 @@ export default function SettingsPage() {
       </Section>
 
       <Section title="Authentication">
+        {/* Suspense boundary required because LinkResult reads
+            useSearchParams — Next.js bails out of SSR otherwise. */}
+        <Suspense fallback={null}>
+          <LinkResult />
+        </Suspense>
         <AuthenticationSection />
       </Section>
 
       <Section title="Legal">
         <LegalSection />
       </Section>
+
+      <SignOutSection />
     </main>
   );
 }
 
+function SignOutSection() {
+  const { logOut } = useAuth();
+  const router = useRouter();
+  const [busy, setBusy] = useState(false);
+
+  async function onSignOut() {
+    setBusy(true);
+    try {
+      await logOut();
+      router.push("/");
+      router.refresh();
+    } catch {
+      // Logout errors are silent — the cookie is cleared on the server
+      // either way and the next protected request will redirect anyway.
+      setBusy(false);
+    }
+  }
+
+  return (
+    <section className="pt-4">
+      <button
+        type="button"
+        onClick={onSignOut}
+        disabled={busy}
+        className="inline-flex items-center gap-2 rounded-md border border-destructive/30 bg-destructive/5 px-4 py-2.5 text-base font-medium text-destructive hover:bg-destructive/10 transition-colors disabled:opacity-60"
+      >
+        <LogOut className="size-5" />
+        {busy ? "Signing out…" : "Sign out"}
+      </button>
+    </section>
+  );
+}
+
 function Section({
   title,
   description,
@@ -69,11 +119,11 @@ function Section({
   return (
     <section className="space-y-4">
       <div className="border-b border-border pb-3">
-        <h2 className="font-[family-name:var(--font-title)] text-xl font-semibold text-foreground">
+        <h2 className="font-[family-name:var(--font-title)] text-2xl font-semibold text-foreground">
           {title}
         </h2>
         {description ? (
-          <p className="text-sm text-muted-foreground mt-1">{description}</p>
+          <p className="text-base text-muted-foreground mt-1">{description}</p>
         ) : null}
       </div>
       <div>{children}</div>
@@ -84,64 +134,226 @@ function Section({
 // ─── Authentication ────────────────────────────────────────────────────
 
 function AuthenticationSection() {
+  const { user } = useAuth();
   const [pwModalOpen, setPwModalOpen] = useState(false);
+  const [emailModalOpen, setEmailModalOpen] = useState(false);
+  const [linkedProviders, setLinkedProviders] = useState<Set<string> | null>(
+    null,
+  );
   const next = "/settings";
 
+  // Fetch linked providers on mount. A null set means "not yet loaded" — we
+  // render the rows as if nothing is connected until the answer comes back,
+  // which is fine because the only thing that changes after load is the
+  // "Connected" pill swapping in for "Connect".
+  useEffect(() => {
+    let cancelled = false;
+    auth
+      .linkedProviders()
+      .then(({ providers }) => {
+        if (!cancelled) setLinkedProviders(new Set(providers));
+      })
+      .catch(() => {
+        if (!cancelled) setLinkedProviders(new Set());
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
   function startOAuth(provider: "facebook" | "google") {
-    const u = new URL(`${BFF_BASE}/api/v1/auth/oauth/${provider}/start`);
+    // /link/start — links the provider to the currently-authenticated
+    // user (auth cookie travels on the top-level navigation). The login
+    // page still uses /start for sign-in / sign-up.
+    const u = new URL(
+      `${BFF_BASE}/api/v1/auth/oauth/${provider}/link/start`,
+    );
     u.searchParams.set("next", next);
     return u.toString();
   }
 
+  function providerAction(provider: "google" | "facebook") {
+    if (linkedProviders?.has(provider)) {
+      return <ConnectedPill />;
+    }
+    return (
+      <a
+        href={startOAuth(provider)}
+        className="text-base font-medium text-primary hover:underline"
+      >
+        Connect
+      </a>
+    );
+  }
+
+  // Three contextual states for the email-related rows:
+  //   • user has no email                   → "Add your email" row only
+  //   • user has email, NOT verified         → "Verify your email" row +
+  //                                            "Change your password" row
+  //   • user has email, verified             → "Change your password" row
+  const needsEmail = !user?.email;
+  const needsVerify = !!user?.email && !user.email_verified_at;
+
   return (
     <>
       <ul className="divide-y divide-border">
         <Row
           icon={<GoogleGlyph />}
           label="Connect your Google account"
-          action={
+          action={providerAction("google")}
-            <a
-              href={startOAuth("google")}
-              className="text-sm font-medium text-primary hover:underline"
-            >
-              Connect
-            </a>
-          }
         />
         <Row
           icon={<FacebookGlyph />}
           label="Connect your Facebook account"
-          action={
+          action={providerAction("facebook")}
-            <a
-              href={startOAuth("facebook")}
-              className="text-sm font-medium text-primary hover:underline"
-            >
-              Connect
-            </a>
-          }
-        />
-        <Row
-          label="Change your password"
-          description="Update the password you use to sign in."
-          action={
-            <button
-              type="button"
-              onClick={() => setPwModalOpen(true)}
-              className="text-sm font-medium text-primary hover:underline"
-            >
-              Change
-            </button>
-          }
         />
+        {needsEmail ? (
+          <Row
+            label="Add your email"
+            description="Required for password recovery. We'll send a verification link."
+            action={
+              <button
+                type="button"
+                onClick={() => setEmailModalOpen(true)}
+                className="text-base font-medium text-primary hover:underline"
+              >
+                Add email
+              </button>
+            }
+          />
+        ) : (
+          <>
+            {needsVerify ? <VerifyEmailRow email={user!.email!} /> : null}
+            <Row
+              label="Change your password"
+              description="Update the password you use to sign in."
+              action={
+                <button
+                  type="button"
+                  onClick={() => setPwModalOpen(true)}
+                  className="text-base font-medium text-primary hover:underline"
+                >
+                  Change
+                </button>
+              }
+            />
+          </>
+        )}
       </ul>
       <ChangePasswordModal
         open={pwModalOpen}
         onClose={() => setPwModalOpen(false)}
       />
+      <AddEmailModal
+        open={emailModalOpen}
+        onClose={() => setEmailModalOpen(false)}
+      />
     </>
   );
 }
 
+function VerifyEmailRow({ email }: { email: string }) {
+  const [busy, setBusy] = useState(false);
+  const [sent, setSent] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function onResend() {
+    setError(null);
+    setBusy(true);
+    try {
+      await auth.resendVerification();
+      setSent(true);
+    } catch (err) {
+      setError(
+        err instanceof AuthError
+          ? err.message
+          : "Could not send verification email.",
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <Row
+      label="Verify your email"
+      description={
+        sent
+          ? `✓ Verification email sent to ${email}.`
+          : error ?? `We need to confirm ${email} before it can be used for recovery.`
+      }
+      action={
+        sent ? (
+          <span className="text-base text-muted-foreground">Sent</span>
+        ) : (
+          <button
+            type="button"
+            onClick={onResend}
+            disabled={busy}
+            className="text-base font-medium text-primary hover:underline disabled:opacity-60"
+          >
+            {busy ? "Sending…" : "Resend"}
+          </button>
+        )
+      }
+    />
+  );
+}
+
+function LinkResult() {
+  const params = useSearchParams();
+  const router = useRouter();
+  const raw = params.get("link");
+
+  // Strip the param from the URL so a refresh doesn't re-show the banner.
+  useEffect(() => {
+    if (!raw) return;
+    const next = new URLSearchParams(params.toString());
+    next.delete("link");
+    const q = next.toString();
+    router.replace(q ? `/settings?${q}` : "/settings");
+  }, [raw, params, router]);
+
+  if (!raw) return null;
+
+  // Format: "<provider>:<status>" — `google:ok`, `facebook:claimed`, etc.
+  const [provider, status] = raw.split(":", 2);
+  const name = provider.charAt(0).toUpperCase() + provider.slice(1);
+
+  if (status === "ok") {
+    return (
+      <p className="mb-4 inline-flex items-center gap-2 rounded-md bg-emerald-500/10 text-emerald-700 dark:text-emerald-300 px-3 py-2 text-base">
+        <Check className="size-4" />
+        Connected your {name} account.
+      </p>
+    );
+  }
+  if (status === "claimed") {
+    return (
+      <p className="mb-4 inline-flex items-center gap-2 rounded-md bg-destructive/10 text-destructive px-3 py-2 text-base">
+        <AlertCircle className="size-4" />
+        That {name} account is already linked to another Prabhupāda Says
+        account.
+      </p>
+    );
+  }
+  return (
+    <p className="mb-4 inline-flex items-center gap-2 rounded-md bg-destructive/10 text-destructive px-3 py-2 text-base">
+      <AlertCircle className="size-4" />
+      Couldn&apos;t connect your {name} account. Please try again.
+    </p>
+  );
+}
+
+function ConnectedPill() {
+  return (
+    <span className="inline-flex items-center gap-1 rounded-full bg-emerald-500/10 text-emerald-700 dark:text-emerald-300 px-2.5 py-0.5 text-sm font-medium">
+      <Check className="size-3.5" />
+      Connected
+    </span>
+  );
+}
+
 // ─── Legal ─────────────────────────────────────────────────────────────
 
 function LegalSection() {
@@ -159,12 +371,12 @@ function LegalLink({ href, label }: { href: string; label: string }) {
     <li>
       <Link
         href={href}
-        className="flex items-center justify-between py-3 group"
+        className="flex items-center justify-between py-3.5 group"
       >
-        <span className="text-sm text-foreground group-hover:text-primary transition-colors">
+        <span className="text-base text-foreground group-hover:text-primary transition-colors">
           {label}
         </span>
-        <ChevronRight className="size-4 text-muted-foreground group-hover:text-foreground transition-colors" />
+        <ChevronRight className="size-5 text-muted-foreground group-hover:text-foreground transition-colors" />
       </Link>
     </li>
   );
@@ -175,7 +387,7 @@ function LegalLink({ href, label }: { href: string; label: string }) {
 function GoogleGlyph() {
   return (
     <svg
-      className="size-4"
+      className="size-5"
       viewBox="0 0 24 24"
       xmlns="http://www.w3.org/2000/svg"
       aria-hidden
@@ -203,7 +415,7 @@ function GoogleGlyph() {
 function FacebookGlyph() {
   return (
     <svg
-      className="size-4"
+      className="size-5"
       viewBox="0 0 24 24"
       xmlns="http://www.w3.org/2000/svg"
       aria-hidden
@@ -228,18 +440,17 @@ function Row({
   action: React.ReactNode;
 }) {
   return (
-    <li className="flex items-center justify-between gap-4 py-3">
+    <li className="flex items-center justify-between gap-4 py-3.5">
       <div className="min-w-0">
-        <div className="flex items-center gap-2">
+        <div className="flex items-center gap-2.5">
           {icon ? <span className="shrink-0">{icon}</span> : null}
-          <span className="text-sm text-foreground truncate">{label}</span>
+          <span className="text-base text-foreground truncate">{label}</span>
         </div>
         {description ? (
-          <p className="text-xs text-muted-foreground mt-0.5">{description}</p>
+          <p className="text-sm text-muted-foreground mt-1">{description}</p>
         ) : null}
       </div>
       <div className="shrink-0">{action}</div>
     </li>
   );
 }
-

components/auth/add-email-modal.tsx

@@ -0,0 +1,161 @@
+"use client";
+
+/**
+ * AddEmailModal — centred portal dialog with a single email input for
+ * users who signed up via OAuth and never shared an address. Mirrors
+ * the ChangePasswordModal pattern so the look and feel matches.
+ *
+ * On success: closes itself and updates the auth-provider's user so the
+ * rest of the app immediately sees the new email. The BFF stores the
+ * address as unverified and fires a verification link to it; the user
+ * sees that as the existing "verify your email" banner on the next
+ * render.
+ *
+ * Entry points:
+ *   • VerifyEmailBanner — top-of-page "Add an email" button
+ *   • /settings → Authentication → Add your email row
+ */
+
+import { useEffect, useState } from "react";
+import { createPortal } from "react-dom";
+import { X } from "lucide-react";
+import { useAuth } from "@/components/auth/auth-provider";
+import { auth, AuthError } from "@/lib/auth";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export function AddEmailModal({
+  open,
+  onClose,
+}: {
+  open: boolean;
+  onClose: () => void;
+}) {
+  const { setUser } = useAuth();
+  const [email, setEmail] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [submitting, setSubmitting] = useState(false);
+
+  // Blank slate every time the modal opens.
+  useEffect(() => {
+    if (open) return;
+    setEmail("");
+    setError(null);
+    setSubmitting(false);
+  }, [open]);
+
+  // Esc-to-close.
+  useEffect(() => {
+    if (!open) return;
+    function onKey(e: KeyboardEvent) {
+      if (e.key === "Escape") onClose();
+    }
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [open, onClose]);
+
+  // Body scroll-lock while open.
+  useEffect(() => {
+    if (!open) return;
+    const prev = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+    return () => {
+      document.body.style.overflow = prev;
+    };
+  }, [open]);
+
+  if (!open || typeof document === "undefined") return null;
+
+  async function onSubmit(e: React.SyntheticEvent) {
+    e.preventDefault();
+    setError(null);
+    setSubmitting(true);
+    try {
+      const updated = await auth.setEmail(email);
+      setUser(updated);
+      onClose();
+    } catch (err) {
+      setError(err instanceof AuthError ? err.message : "Could not save email.");
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  return createPortal(
+    <>
+      <div
+        className="fixed inset-0 z-100 bg-foreground/40 backdrop-blur-sm animate-in fade-in-0"
+        onClick={onClose}
+        aria-hidden
+      />
+      <div
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="add-email-title"
+        className="fixed left-1/2 top-1/2 z-101 w-full max-w-md -translate-x-1/2 -translate-y-1/2 px-4"
+      >
+        <div className="rounded-2xl border border-border bg-card shadow-xl overflow-hidden">
+          <header className="flex items-center justify-between px-5 py-4 border-b border-border">
+            <h2
+              id="add-email-title"
+              className="font-[family-name:var(--font-title)] font-semibold text-xl text-foreground"
+            >
+              Add your email
+            </h2>
+            <button
+              type="button"
+              onClick={onClose}
+              className="size-8 rounded-lg text-muted-foreground hover:text-foreground hover:bg-muted inline-flex items-center justify-center"
+              aria-label="Close"
+            >
+              <X className="size-4" />
+            </button>
+          </header>
+
+          <form onSubmit={onSubmit} className="px-5 py-5 space-y-4">
+            <p className="text-sm text-muted-foreground">
+              Add an email to enable password recovery and notifications.
+              We&apos;ll send a verification link to confirm it&apos;s yours.
+            </p>
+            <div className="space-y-1.5">
+              <Label htmlFor="ae-email">Email address</Label>
+              <Input
+                id="ae-email"
+                type="email"
+                autoComplete="email"
+                required
+                value={email}
+                onChange={(e) => setEmail(e.target.value)}
+                placeholder="you@example.com"
+              />
+            </div>
+
+            {error ? (
+              <p className="text-sm text-destructive">{error}</p>
+            ) : null}
+
+            <div className="flex items-center justify-end gap-2 pt-1">
+              <Button
+                type="button"
+                variant="ghost"
+                onClick={onClose}
+                className="h-10 px-4 text-sm"
+              >
+                Cancel
+              </Button>
+              <Button
+                type="submit"
+                disabled={submitting || email.trim() === ""}
+                className="h-10 px-4 text-sm"
+              >
+                {submitting ? "Saving…" : "Save email"}
+              </Button>
+            </div>
+          </form>
+        </div>
+      </div>
+    </>,
+    document.body,
+  );
+}

components/auth/auth-provider.tsx

@@ -21,11 +21,22 @@ import { auth, type User } from "@/lib/auth";
  * After a successful login/signup/logout the provider re-fetches /auth/me
  * to keep state in sync with the cookie.
  */
+/**
+ * LogInResult is either a completed session (regular case) or a signal
+ * that the BFF wants a one-time code before completing the login. Callers
+ * should branch on `kind` and, for `otp_required`, present an OTP field
+ * and call `verifyLoginOTP`.
+ */
+export type LogInResult =
+  | { kind: "session"; user: User }
+  | { kind: "otp_required" };
+
 type AuthContextValue = {
   user: User | null;
   loading: boolean;
   signUp: (email: string, password: string, name: string) => Promise<User>;
-  logIn: (email: string, password: string) => Promise<User>;
+  logIn: (email: string, password: string) => Promise<LogInResult>;
+  verifyLoginOTP: (email: string, password: string, otp: string) => Promise<User>;
   logOut: () => Promise<void>;
   refresh: () => Promise<void>;
   /** Replace the user state without a network round-trip (after profile edit). */
@@ -58,19 +69,42 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   }, []);
 
   const logIn = useCallback(async (email: string, password: string) => {
-    const u = await auth.logIn(email, password);
+    const res = await auth.logIn(email, password);
-    setUser(u);
+    if (res.kind === "session") {
-    return u;
+      setUser(res.user);
+    }
+    // For `otp_required` we deliberately leave `user` null so the rest of
+    // the app keeps showing the signed-out state until VerifyLoginOTP
+    // completes.
+    return res;
   }, []);
 
+  const verifyLoginOTP = useCallback(
+    async (email: string, password: string, otp: string) => {
+      const u = await auth.verifyLoginOTP(email, password, otp);
+      setUser(u);
+      return u;
+    },
+    [],
+  );
+
   const logOut = useCallback(async () => {
     await auth.logOut();
     setUser(null);
   }, []);
 
   const value = useMemo<AuthContextValue>(
-    () => ({ user, loading, signUp, logIn, logOut, refresh, setUser }),
+    () => ({
-    [user, loading, signUp, logIn, logOut, refresh],
+      user,
+      loading,
+      signUp,
+      logIn,
+      verifyLoginOTP,
+      logOut,
+      refresh,
+      setUser,
+    }),
+    [user, loading, signUp, logIn, verifyLoginOTP, logOut, refresh],
   );
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;

components/auth/login-form.tsx

@@ -5,12 +5,16 @@
  * the AuthGate modal that pops up when an unauthenticated user tries to use
  * a protected feature.
  *
- * `onSuccess` is invoked once login completes. Callers decide what happens
+ * Two stages:
- * next (a page redirect, a modal close, etc.). The form itself doesn't
+ *   1. Password — email + password. If the BFF signals `otp_required`
- * navigate — that keeps it environment-agnostic.
+ *      (account unverified for >30 days), the form advances to stage 2.
+ *   2. OTP — 6-digit code emailed to the user. Submitting verifies the
+ *      code, marks the email verified, and completes the session.
  *
- * `forgotPasswordHref` is configurable so the modal can override (it may
+ * `onSuccess` fires after the session is finalised (either at stage 1 for
- * want to dismiss itself or open a different mode).
+ * verified accounts or stage 2 for the OTP-gated path). Callers decide
+ * what happens next (page redirect, modal close, etc.) — the form itself
+ * doesn't navigate.
  */
 
 import { useState } from "react";
@@ -34,18 +38,26 @@ export function LoginForm({
   /** Post-OAuth redirect path on the frontend. */
   oauthNext?: string;
 }) {
-  const { logIn } = useAuth();
+  const { logIn, verifyLoginOTP } = useAuth();
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
+  const [otp, setOTP] = useState("");
+  // Two-stage state machine. "password" is the default; we advance to
+  // "otp" only after the BFF signals otp_required.
+  const [stage, setStage] = useState<"password" | "otp">("password");
   const [error, setError] = useState<string | null>(null);
   const [submitting, setSubmitting] = useState(false);
 
-  async function onSubmit(e: React.SyntheticEvent) {
+  async function onPasswordSubmit(e: React.SyntheticEvent) {
     e.preventDefault();
     setError(null);
     setSubmitting(true);
     try {
-      await logIn(email, password);
+      const res = await logIn(email, password);
+      if (res.kind === "otp_required") {
+        setStage("otp");
+        return;
+      }
       onSuccess?.();
     } catch (err) {
       setError(err instanceof AuthError ? err.message : "Login failed.");
@@ -54,46 +66,115 @@ export function LoginForm({
     }
   }
 
+  async function onOTPSubmit(e: React.SyntheticEvent) {
+    e.preventDefault();
+    setError(null);
+    setSubmitting(true);
+    try {
+      await verifyLoginOTP(email, password, otp);
+      onSuccess?.();
+    } catch (err) {
+      setError(
+        err instanceof AuthError ? err.message : "Could not verify the code.",
+      );
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  if (stage === "otp") {
+    return (
+      <form onSubmit={onOTPSubmit} className="space-y-5">
+        <div className="space-y-1.5">
+          <Label htmlFor="login-otp">Enter the 6-digit code</Label>
+          <Input
+            id="login-otp"
+            type="text"
+            inputMode="numeric"
+            autoComplete="one-time-code"
+            pattern="[0-9]{6}"
+            maxLength={6}
+            required
+            value={otp}
+            onChange={(e) =>
+              setOTP(e.target.value.replace(/\D/g, "").slice(0, 6))
+            }
+            placeholder="123456"
+            className="tracking-[0.4em] text-center text-lg"
+          />
+          <p className="text-xs text-muted-foreground">
+            We sent a code to <span className="font-medium">{email}</span>.
+            Your account has been unverified for a while, so we need this
+            extra step. The code expires in 10 minutes.
+          </p>
+        </div>
+        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        <Button
+          type="submit"
+          disabled={submitting || otp.length !== 6}
+          className="w-full h-11 text-base"
+        >
+          {submitting ? "Verifying…" : "Verify and log in"}
+        </Button>
+        <button
+          type="button"
+          onClick={() => {
+            setStage("password");
+            setOTP("");
+            setError(null);
+          }}
+          className="block mx-auto text-xs text-muted-foreground hover:text-foreground"
+        >
+          ← Use a different email
+        </button>
+      </form>
+    );
+  }
+
   return (
     <div className="space-y-5">
       <OAuthButtons next={oauthNext} />
-      <form onSubmit={onSubmit} className="space-y-5">
+      <form onSubmit={onPasswordSubmit} className="space-y-5">
-      <div className="space-y-1.5">
+        <div className="space-y-1.5">
-        <Label htmlFor="login-email">Email</Label>
+          <Label htmlFor="login-email">Email</Label>
-        <Input
+          <Input
-          id="login-email"
+            id="login-email"
-          type="email"
+            type="email"
-          autoComplete="email"
+            autoComplete="email"
-          required
+            required
-          value={email}
+            value={email}
-          onChange={(e) => setEmail(e.target.value)}
+            onChange={(e) => setEmail(e.target.value)}
-        />
+          />
-      </div>
-      <div className="space-y-1.5">
-        <div className="flex items-center justify-between">
-          <Label htmlFor="login-password">Password</Label>
-          {showForgotLink ? (
-            <Link
-              href={forgotPasswordHref}
-              className="text-xs text-muted-foreground hover:text-foreground"
-            >
-              Forgot?
-            </Link>
-          ) : null}
         </div>
-        <Input
+        <div className="space-y-1.5">
-          id="login-password"
+          <div className="flex items-center justify-between">
-          type="password"
+            <Label htmlFor="login-password">Password</Label>
-          autoComplete="current-password"
+            {showForgotLink ? (
-          required
+              <Link
-          value={password}
+                href={forgotPasswordHref}
-          onChange={(e) => setPassword(e.target.value)}
+                className="text-xs text-muted-foreground hover:text-foreground"
-        />
+              >
-      </div>
+                Forgot?
-      {error ? <p className="text-sm text-destructive">{error}</p> : null}
+              </Link>
-      <Button type="submit" disabled={submitting} className="w-full h-11 text-base">
+            ) : null}
-        {submitting ? "Logging in…" : "Log in"}
+          </div>
-      </Button>
+          <Input
+            id="login-password"
+            type="password"
+            autoComplete="current-password"
+            required
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </div>
+        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        <Button
+          type="submit"
+          disabled={submitting}
+          className="w-full h-11 text-base"
+        >
+          {submitting ? "Logging in…" : "Log in"}
+        </Button>
       </form>
     </div>
   );

components/auth/verify-email-banner.tsx

@@ -2,6 +2,7 @@
 
 import { useState } from "react";
 import { auth, AuthError } from "@/lib/auth";
+import { AddEmailModal } from "./add-email-modal";
 import { useAuth } from "./auth-provider";
 
 /**
@@ -9,10 +10,11 @@ import { useAuth } from "./auth-provider";
  * without an address) or present-but-unverified.
  *
  * Two modes:
- *   • Missing email — an inline "Add your email" input that POSTs to
+ *   • Missing email — "Add an email" button that opens AddEmailModal.
- *     /auth/email. On success the user state refreshes and the banner
+ *     The modal POSTs to /auth/email and refreshes the user; on success
- *     automatically flips into the "verify your email" mode.
+ *     this banner flips into the verify-your-email mode automatically.
- *   • Unverified email — existing "Resend verification" call to action.
+ *   • Unverified email — "Resend verification" button calls
+ *     auth.resendVerification().
  *
  * Renders nothing when:
  *   - auth state is still loading
@@ -22,12 +24,12 @@ import { useAuth } from "./auth-provider";
  *     but reset on full page refresh)
  */
 export function VerifyEmailBanner() {
-  const { user, loading, setUser } = useAuth();
+  const { user, loading } = useAuth();
   const [sent, setSent] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
   const [dismissed, setDismissed] = useState(false);
-  const [newEmail, setNewEmail] = useState("");
+  const [emailModalOpen, setEmailModalOpen] = useState(false);
 
   if (loading || !user || user.email_verified_at || dismissed) return null;
 
@@ -48,87 +50,55 @@ export function VerifyEmailBanner() {
     }
   }
 
-  async function onSetEmail(e: React.FormEvent) {
-    e.preventDefault();
-    setError(null);
-    setBusy(true);
-    try {
-      const updated = await auth.setEmail(newEmail);
-      setUser(updated);
-      setSent(true);
-    } catch (err) {
-      setError(err instanceof AuthError ? err.message : "Could not save email.");
-    } finally {
-      setBusy(false);
-    }
-  }
-
   return (
-    <div className="w-full bg-amber-50 dark:bg-amber-950/40 text-amber-900 dark:text-amber-100 border-b border-amber-200/60 dark:border-amber-800/60">
+    <>
-      <div className="max-w-5xl mx-auto px-4 py-2 flex flex-wrap items-center justify-between gap-3 text-sm">
+      <div className="w-full bg-amber-50 dark:bg-amber-950/40 text-amber-900 dark:text-amber-100 border-b border-amber-200/60 dark:border-amber-800/60">
-        {sent ? (
+        <div className="max-w-5xl mx-auto px-4 py-2 flex flex-wrap items-center justify-between gap-3 text-sm">
           <p>
-            {needsEmail
+            {sent
-              ? "✓ Email saved — check your inbox for a verification link."
+              ? "✓ Verification email sent — check your inbox."
-              : "✓ Verification email sent — check your inbox."}
+              : error
+                ? error
+                : needsEmail
+                  ? "Add an email to enable password recovery and notifications."
+                  : `Verify your email (${user.email}) to secure your account.`}
           </p>
-        ) : needsEmail ? (
+          <div className="flex items-center gap-2">
-          <form
+            {!sent ? (
-            onSubmit={onSetEmail}
+              needsEmail ? (
-            className="flex flex-1 flex-wrap items-center gap-2"
+                <button
-          >
+                  type="button"
-            <label htmlFor="banner-email" className="shrink-0">
+                  onClick={() => setEmailModalOpen(true)}
-              Add an email to your account:
+                  className="font-medium underline-offset-2 hover:underline"
-            </label>
+                >
-            <input
+                  Add email
-              id="banner-email"
+                </button>
-              type="email"
+              ) : (
-              required
+                <button
-              value={newEmail}
+                  type="button"
-              onChange={(e) => setNewEmail(e.target.value)}
+                  onClick={onResend}
-              placeholder="you@example.com"
+                  disabled={busy}
-              className="flex-1 min-w-[12rem] rounded-md border border-amber-300/70 dark:border-amber-800/70 bg-white/70 dark:bg-amber-950/30 px-2 py-1 text-amber-900 dark:text-amber-50 placeholder:text-amber-700/50 dark:placeholder:text-amber-200/40"
+                  className="font-medium underline-offset-2 hover:underline disabled:opacity-60"
-            />
+                >
-            <button
+                  {busy ? "Sending…" : "Resend email"}
-              type="submit"
+                </button>
-              disabled={busy || newEmail.trim() === ""}
+              )
-              className="font-medium underline-offset-2 hover:underline disabled:opacity-60"
-            >
-              {busy ? "Saving…" : "Save"}
-            </button>
-            {error ? (
-              <span className="text-amber-900/80 dark:text-amber-100/80">
-                {error}
-              </span>
             ) : null}
-          </form>
-        ) : (
-          <p>
-            {error ?? `Verify your email (${user.email}) to secure your account.`}
-          </p>
-        )}
-
-        <div className="flex items-center gap-2">
-          {!sent && !needsEmail ? (
             <button
               type="button"
-              onClick={onResend}
+              onClick={() => setDismissed(true)}
-              disabled={busy}
+              aria-label="Dismiss"
-              className="font-medium underline-offset-2 hover:underline disabled:opacity-60"
+              className="opacity-70 hover:opacity-100"
             >
-              {busy ? "Sending…" : "Resend email"}
+              ✕
             </button>
-          ) : null}
+          </div>
-          <button
-            type="button"
-            onClick={() => setDismissed(true)}
-            aria-label="Dismiss"
-            className="opacity-70 hover:opacity-100"
-          >
-            ✕
-          </button>
         </div>
       </div>
-    </div>
+      <AddEmailModal
+        open={emailModalOpen}
+        onClose={() => setEmailModalOpen(false)}
+      />
+    </>
   );
 }

lib/auth.ts

@@ -83,10 +83,43 @@ export const auth = {
       body: JSON.stringify({ email, password, name }),
     }),
 
-  logIn: (email: string, password: string) =>
+  /**
-    authFetch<User>("/auth/login", {
+   * Submits email/password. Three outcomes:
+   *   - kind: "session"      → fully signed in; auth-provider sets the user.
+   *   - kind: "otp_required" → account has been unverified for >30 days;
+   *     a 6-digit code was emailed. Caller must show an OTP form and call
+   *     `verifyLoginOTP(email, password, otp)` to complete sign-in.
+   * Throws AuthError on credential / server errors.
+   */
+  logIn: async (
+    email: string,
+    password: string,
+  ): Promise<
+    | { kind: "session"; user: User }
+    | { kind: "otp_required" }
+  > => {
+    const data = await authFetch<User | { otp_required: true }>(
+      "/auth/login",
+      {
+        method: "POST",
+        body: JSON.stringify({ email, password }),
+      },
+    );
+    if (data && typeof data === "object" && "otp_required" in data) {
+      return { kind: "otp_required" };
+    }
+    return { kind: "session", user: data as User };
+  },
+
+  /**
+   * Completes a login that was paused by the OTP gate. Re-checks the
+   * password (the OTP alone isn't enough — defence in depth), validates
+   * the code, marks the email verified, and sets the session cookie.
+   */
+  verifyLoginOTP: (email: string, password: string, otp: string) =>
+    authFetch<User>("/auth/verify-login-otp", {
       method: "POST",
-      body: JSON.stringify({ email, password }),
+      body: JSON.stringify({ email, password, otp }),
     }),
 
   logOut: () => authFetch<{ ok: boolean }>("/auth/logout", { method: "POST" }),
@@ -133,6 +166,14 @@ export const auth = {
       body: JSON.stringify({ email }),
     }),
 
+  /**
+   * Returns the list of OAuth provider names already linked to the
+   * signed-in user (e.g. `["google", "facebook"]`). The settings page
+   * uses this to flip per-provider rows between "Connect" / "Connected".
+   */
+  linkedProviders: () =>
+    authFetch<{ providers: string[] }>("/auth/linked-providers"),
+
   /**
    * Replaces the signed-in user's password. The BFF verifies the current
    * password, hashes the new one, and re-issues the session cookie so this