feat: use one-time code for login (#3)

src/routes/auth/confirm/+page.js

@@ -0,0 +1,10 @@
+import { redirect } from '@sveltejs/kit';
+
+export const load = async ({ url }) => {
+	const email = url.searchParams.get('email') ?? '';
+	if (!email) {
+		throw redirect(303, '/auth/login');
+	}
+
+	return { email };
+};

src/routes/auth/confirm/+page.server.js

@@ -0,0 +1,16 @@
+import { fail, redirect } from '@sveltejs/kit';
+
+export const actions = {
+	default: async ({ request, locals: { supabase } }) => {
+		const formData = await request.formData();
+		const email = formData.get('email');
+		const token = formData.get('token');
+
+		const { error } = await supabase.auth.verifyOtp({ email, token, type: 'email' });
+		if (error) {
+			return fail(500, { message: 'Server error. Try again later.', success: false, email });
+		}
+
+		throw redirect(303, '/');
+	},
+};

src/routes/auth/confirm/+page.svelte

@@ -0,0 +1,13 @@
+<script>
+	export let data;
+</script>
+
+<h1>Confirm Login</h1>
+<p>Check your email for a one-time code that you can use to confirm your login.</p>
+
+<form method="POST">
+	<input type="hidden" name="email" value={data.email} />
+	<label for="token">One-time code</label>
+	<input id="token" type="text" name="token" inputmode="numeric" autocomplete="one-time-code" />
+	<button type="submit">Finish logging in</button>
+</form>

src/routes/auth/login/+page.server.js

@@ -1,15 +1,15 @@
 import { fail, redirect } from '@sveltejs/kit';
 
 export const actions = {
-	default: async ({ request, url: { origin }, locals: { supabase } }) => {
+	default: async ({ request, locals: { supabase } }) => {
 		const formData = await request.formData();
 		const email = formData.get('email');
 
-		const { error } = await supabase.auth.signInWithOtp({ email, redirectTo: origin });
+		const { error } = await supabase.auth.signInWithOtp({ email });
 		if (error) {
 			return fail(500, { message: 'Server error. Try again later.', success: false, email });
 		}
 
-		throw redirect(303, '/auth/check-email');
+		throw redirect(303, `/auth/confirm?email=${email}`);
 	},
 };