No Login Notification

// BAD: login creates a session with no user notification
async function login(email: string, password: string) {
  const user = await verifyCredentials(email, password);
  const session = await createSession(user);
  return session.token; // user has no idea someone just logged in
}

// GOOD: notify user of new logins from unknown devices
async function login(email: string, password: string, deviceInfo: DeviceInfo) {
  const user = await verifyCredentials(email, password);
  const session = await createSession(user, deviceInfo);
  if (!isKnownDevice(user, deviceInfo)) {
    await sendLoginAlert(user.email, deviceInfo); // email with revoke link
  }
  return session.token;
}