No Email Verification

// BAD: account created and immediately usable without email verification
async function register(email: string, password: string) {
  const user = await createUser({ email, password, verified: true }); // no verification
  return createSession(user);
}

// GOOD: send verification email and require confirmation before full access
async function register(email: string, password: string) {
  const user = await createUser({ email, password, verified: false });
  const token = generateVerificationToken();
  await saveVerificationToken(user.id, token);
  await sendVerificationEmail(email, token);
  return { message: 'Check your email to verify your account' };
}