feat(auth): Introduce 5-day grace period for email verification before lockout

api/middleware/auth.js

@@ -30,9 +30,17 @@ const verifyToken = (req, res, next) => {
 
 const requireEmailVerification = async (req, res, next) => {
     try {
-        const userCheck = await pgPool.query('SELECT is_email_verified FROM users WHERE id = $1', [req.user.id]);
-        if (userCheck.rows.length === 0 || !userCheck.rows[0].is_email_verified) {
-            return res.status(403).json({ error: 'Email verification required' });
+        const userCheck = await pgPool.query('SELECT is_email_verified, created_at FROM users WHERE id = $1', [req.user.id]);
+        if (userCheck.rows.length === 0) return res.status(403).json({ error: 'User not found' });
+        
+        const user = userCheck.rows[0];
+        if (!user.is_email_verified) {
+            const createdAt = new Date(user.created_at);
+            const now = new Date();
+            const daysSinceCreation = (now.getTime() - createdAt.getTime()) / (1000 * 60 * 60 * 24);
+            if (daysSinceCreation > 5) {
+                return res.status(403).json({ error: 'Email verification grace period expired (5 days)' });
+            }
         }
         next();
     } catch (err) {

api/routes/auth.js

@@ -94,7 +94,7 @@ router.post('/login', async (req, res) => {
 const { verifyToken } = require('../middleware/auth');
 router.get('/me', verifyToken, async (req, res) => {
     try {
-        const userQuery = await pgPool.query('SELECT id, email, role, is_email_verified FROM users WHERE id = $1', [req.user.id]);
+        const userQuery = await pgPool.query('SELECT id, email, role, is_email_verified, created_at FROM users WHERE id = $1', [req.user.id]);
         if (userQuery.rows.length === 0) return res.status(404).json({ error: 'User not found' });
         res.json({ user: userQuery.rows[0] });
     } catch (err) {