Questions regarding email change and checking if email is verified

[Alexandre-Chapelle]

Hey!

FLOW

Could anyone please confirm if this flow is correct or completely wrong? I checked many repositories on GitHub and read the official documentation, but I couldn't find any proper working examples.

I have a feature where the user can change their email address. The flow is as follows:

1. The user presses the "Change Email" button.

2. The user enters a new email address.

3. Check if the user has MFA enabled:

• If MFA is disabled, proceed to step 4.
• If MFA is enabled: check user's assurance level. If it's lower aal2 ask for the TOTP code and verify it, if correct, proceed to step 4, otherwise, if assurance level is already aal2: proceed to step 4.

4. Send OTP verification codes to both the old and new email addresses using:
   supabase.auth.updateUser({ email })

5. Ask the user to enter both OTP codes manually (note that the email template was modified to include only the TOKEN) and verify them using:
   supabase.auth.verifyOtp({ oldEmail, oldEmailOtpCode, "email_change" })
   supabase.auth.verifyOtp({ newEmail, newEmailOtpCode, "email_change" })

6. If successful, show a success dialog.

ISSUE

After the email change process is completed, the email_confirmed_at field is set to true, but the user_metadata.email_verified field is still false.

Could anyone help me understand the proper way to check if the user's email is verified or a way to update metadata?

CURRENT CODE:

 

   async changeEmail(email: string): Promise<UserResponse> {
    const resposne = await this.supabase.auth.updateUser({
      email,
      data: {
        email,
      },
    });
    return resposne;
  }
  
  async verifyOTP(
      email: string,
      token: string,
      type: EmailOtpType
  ): Promise<AuthResponse> {
      const response = await this.supabase.auth.verifyOtp({
        email,
        token,
        type: type,
   });

    return response;
  }

  isEmailVerified(session: Session): boolean {
    return !!session.user?.user_metadata?.email_verified;
  }

{
    "id": [VALUE],
    "aud": "authenticated",
    "role": "authenticated",
    "email": [VALUE],
    "email_confirmed_at": "2024-12-20T22:20:22.158613Z",
    "phone": "",
    "confirmed_at": "2024-12-20T22:20:22.158613Z",
    "recovery_sent_at": "2024-12-25T12:40:58.82592Z",
    "email_change_sent_at": "2024-12-25T16:11:13.170624Z",
    "last_sign_in_at": "2024-12-25T16:11:37.152645Z",
    "app_metadata": {
        "provider": "email",
        "providers": [
            "email"
        ]
    },
    "user_metadata": {
        "email": [VALUE],
        "email_verified": false,
        "phone_verified": false,
        "sub": [VALUE]
    },
    "factors": [
        {
            "id": [VALUE],
            "created_at": "2024-12-24T19:38:18.774094Z",
            "updated_at": "2024-12-25T16:11:54.893128Z",
            "status": "verified",
            "friendly_name": "TOTP",
            "factor_type": "totp",
            "phone": "",
            "last_challenged_at": "2024-12-25T16:11:54.892299Z"
        }
    ],
    "identities": [
        {
            "identity_id": [VALUE],
            "id": [VALUE],
            "user_id": [VALUE],
            "identity_data": {
                "email": [VALUE],
                "email_verified": true,
                "phone_verified": false,
                "sub": [VALUE]
            },
            "provider": "email",
            "last_sign_in_at": "2024-12-20T22:19:40.867263Z",
            "created_at": "2024-12-20T22:19:40.867323Z",
            "updated_at": "2024-12-25T16:11:37.150352Z",
            "email": [VALUE]
        }
    ],
    "created_at": "2024-12-20T22:19:40.862375Z",
    "updated_at": "2024-12-25T16:11:55.041884Z",
    "is_anonymous": false
}

OTHER

Additionally, if anyone has a fully functional open-source project that demonstrates full use of supabase, including:

• Login
• Register,
• Enable MFA, Disable MFA
• Change email
• Change password
• All proper checks for assurance level statuses, email_verified and so on
  ...

I would really appreciate it if someone could share it with me.