feat(auth): Enforce global email verification for all users, restrict dashboard if unverified, add verification badges and banners

api/middleware/auth.js

@@ -1,4 +1,13 @@
 const jwt = require('jsonwebtoken');
+const { Pool } = require('pg');
+
+const pgPool = new Pool({
+    host: process.env.PGHOST || 'postgres',
+    port: process.env.PGPORT || 5432,
+    user: process.env.PGUSER || 'postgres',
+    password: process.env.PGPASSWORD || 'postgres',
+    database: process.env.PGDATABASE || 'ckqr',
+});
 
 const verifyToken = (req, res, next) => {
   let token = req.headers['authorization'];
@@ -19,4 +28,17 @@ const verifyToken = (req, res, next) => {
   });
 };
 
-module.exports = { verifyToken };
+const requireEmailVerification = async (req, res, next) => {
+    try {
+        const userCheck = await pgPool.query('SELECT is_email_verified FROM users WHERE id = $1', [req.user.id]);
+        if (userCheck.rows.length === 0 || !userCheck.rows[0].is_email_verified) {
+            return res.status(403).json({ error: 'Email verification required' });
+        }
+        next();
+    } catch (err) {
+        console.error(err);
+        res.status(500).json({ error: 'Server error checking verification' });
+    }
+};
+
+module.exports = { verifyToken, requireEmailVerification };