Implement email authentication with login and registration by mahata · Pull Request #120 · mahata/mlack

mahata · 2026-03-25T11:48:11Z

Add email authentication functionality, including login and registration routes, and update the user interface accordingly. This change introduces a new user table in the database and implements password hashing for secure authentication. Additionally, it modifies the redirection behavior for unauthenticated users.

…n routes

Copilot

Pull request overview

This PR adds first-party email/password authentication to the Hono app (in addition to existing Google OAuth), introducing new login/registration routes and pages, a users table + migration, and updating unauthenticated redirect behavior to point to the new login page.

Changes:

Add /auth/login and /auth/register HTML routes, plus password hashing/verification utilities.
Introduce users table in Drizzle schema with a migration and snapshot metadata.
Update the root route (and its tests) to redirect unauthenticated users to /auth/login, and add an agent guide (AGENTS.md).

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
hono/routes/index.tsx	Redirect unauthenticated users to the new login route.
hono/routes/index.test.tsx	Update redirect test to expect `/auth/login`.
hono/routes/emailAuth.ts	New email login/registration handlers using DB + password hashing.
hono/routes/emailAuth.test.ts	Initial unit tests for email auth routes.
hono/db/schema.ts	Add `users` table definition.
hono/db/migrations/meta/_journal.json	Register new migration in Drizzle journal.
hono/db/migrations/meta/0001_snapshot.json	Add schema snapshot including `users` table.
hono/db/migrations/0001_nosy_rawhide_kid.sql	SQL migration creating `users` table.
hono/components/RegisterPage.tsx	New registration page UI.
hono/components/LoginPage.tsx	New login page UI.
hono/components/AuthPage.css	Styling for login/register pages.
hono/auth/password.ts	Implement scrypt-based password hashing + verification.
hono/auth/password.test.ts	Unit tests for hashing/verification behavior.
hono/app.tsx	Register the new `emailAuth` routes.
AGENTS.md	Add repo-specific contributor/agent guide and conventions.

Comments suppressed due to low confidence (2)

hono/auth/password.ts:25

In verifyPassword, the scrypt callback has the same issue as hashPassword: it calls reject(err) but then continues to resolve(derivedKey). Add an early return after rejecting (or switch to a promisified API) so failures don't fall through.

  const derivedKey = await new Promise<Buffer>((resolve, reject) => {
    scrypt(password, salt, KEY_LENGTH, (err, derivedKey) => {
      if (err) reject(err);
      resolve(derivedKey);
    });

hono/routes/emailAuth.ts:90

Email inputs are inserted as-is. Consider normalizing email (trim + lowercase) before the uniqueness check and insert; otherwise the DB unique constraint will allow case-variant duplicates (e.g., User@x.com vs user@x.com).

    const body = await c.req.parseBody();
    const name = body.name as string;
    const email = body.email as string;
    const password = body.password as string;

    if (!name || !email || !password) {
      return c.html(`<!DOCTYPE html>${await RegisterPage("All fields are required.")}`, 400);
    }

    if (password.length < 8) {
      return c.html(`<!DOCTYPE html>${await RegisterPage("Password must be at least 8 characters.")}`, 400);
    }

    // Check if user already exists
    const [existing] = await db.select().from(users).where(eq(users.email, email)).limit(1);

Copilot · 2026-03-25T11:51:55Z

+emailAuth.post("/auth/login", async (c) => {
+  try {
+    const body = await c.req.parseBody();
+    const email = body.email as string;
+    const password = body.password as string;


Tests for these routes currently cover validation/error paths, but don’t cover the primary success flows (successful login sets session + redirects; successful registration inserts user + sets session; existing-email conflict path; password verification true path). Add unit tests for these behaviors so the new auth feature is adequately covered.