fix(auth): pass callbackPath through magic link sign-in flow

[RSO]

Summary

• Fix callbackPath being dropped when users sign in via the magic link method. OAuth flows (Google, GitHub, WorkOS, etc.) correctly threaded callbackPath through getSignInCallbackUrl(params), but handleSendMagicLink only sent the email address — ignoring params entirely.
• The backend already fully supported callbackUrl end-to-end (API route zod schema, email builder, magic link URL generator, verify-magic-link page). The only gap was the frontend never sending the value. This two-file change closes that gap.

Verification

• pnpm typecheck — passed
• pnpm lint (via pre-commit hook) — passed
• pnpm format:check (via pre-commit hook) — passed
• Manual browser test: navigated to /users/sign_in?callbackPath=/organizations/new, clicked "Continue with Email", confirmed flow reaches Turnstile with callbackPath still in the URL context (Turnstile challenge blocked full end-to-end automated test)

Visual Changes

N/A

Reviewer Notes

• The fix mirrors exactly how every OAuth provider in useSignInFlow.ts handles callbackPath — via getSignInCallbackUrl(params).
• Zero backend changes: the API route (/api/auth/magic-link), sendMagicLinkEmail, getMagicLinkUrl, and verify-magic-link page all already accepted and forwarded callbackUrl. Only the client-side call site was missing it.
• params was added to the useCallback dependency array for handleSendMagicLink since it now reads from it.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• src/hooks/useSignInFlow.ts
• src/lib/auth/send-magic-link.ts

---

_{Reviewed by gpt-5.4-20260305 · 145,720 tokens}