Lemon-miaow d1ec40f738 fix(users): an admin email edit must clear the stale verification ...

UpdateUser wrote a new address but kept email_verified, so patching a verified
account asserted a proof of an address nobody had proven — and the
pre-session login mails and resolves on exactly that flag, so a typo'd edit
could hand the account's sign-in codes to the wrong mailbox.

Changing the address now clears the flag in the same write; a no-op patch that
passes the same value keeps it. The fake mirrors the semantics, and the pgint
suite pins both halves (same value keeps proof, new value drops it).

2026-09-23 03:19:55 +08:00

..

pgint_test.go

fix(users): an admin email edit must clear the stale verification

2026-09-23 03:19:55 +08:00