fix(email): manual OTP instead of better-auth

[waleedlatif1]

Summary

manual OTP instead of better-auth

Type of Change

• Bug fix

Testing

Tested manually.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
sim	🔄 Building (Inspect)	Visit Preview	💬 Add feedback	Aug 9, 2025 1:49am

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
docs	⬜️ Skipped (Inspect)			Aug 9, 2025 1:49am

[greptile-apps]

Greptile Summary

This PR implements a change from better-auth's automatic email verification system to a manual OTP (One-Time Password) implementation for user signup. The change involves two key modifications:

1. Auth Configuration Updates: The auth.ts file has been modified to disable automatic email verification by setting sendVerificationOnSignUp: false in both the emailAndPassword configuration and the emailOTP plugin. This prevents better-auth from automatically sending verification emails during the signup process.

2. Manual OTP Implementation: The signup-form.tsx file now explicitly calls client.emailOtp.sendVerificationOtp() after successful user creation, giving the application direct control over when verification emails are sent. The implementation includes error handling and logging to track any issues with OTP sending.

This change fits into the broader authentication system by maintaining the existing user verification flow while providing more granular control over email timing. The manual approach allows the application to handle edge cases and implement custom business logic around when verification emails should be sent, which is particularly important given the existing email validation systems like quickValidateEmail that are already in place. The OTP verification system continues to work with the existing useVerification hook and OTPVerificationEmail component, ensuring seamless integration with the current user interface and email templates.

Confidence score: 3/5

• This PR introduces potential issues that need attention, particularly around error handling and user experience
• Score reflects concerns about silent error handling and lack of user feedback when OTP sending fails
• Pay close attention to the signup form implementation and consider adding user-facing error handling

_{2 files reviewed, 1 comment}

_{Edit Code Review Bot Settings | Greptile}

[greptile-apps]

logic: OTP sending happens outside the signup success check. If signup fails but this code is reached, users might receive verification emails for failed accounts.

Suggested change

	// Send verification OTP manually
	try {
	await client.emailOtp.sendVerificationOtp({
	email: emailValue,
	type: 'email-verification',
	})
	} catch (otpError) {
	logger.error('Failed to send OTP:', otpError)
	// Continue anyway - user can use resend button
	}
	// Only send OTP if signup was successful
	if (response && !response.error) {
	// Send verification OTP manually
	try {
	await client.emailOtp.sendVerificationOtp({
	email: emailValue,
	type: 'email-verification',
	})
	} catch (otpError) {
	logger.error('Failed to send OTP:', otpError)
	// Continue anyway - user can use resend button
	}
	}