By: Michael Lynch <git@mtlynch.io>
Make dev/prod login branching explicit, fix prod token leak loginPost overloaded a single token-presence check to encode two unrelated decisions: whether the email was registered, and whether to redirect to the magic link (dev) or email it (prod). Because both dev and prod token creators return a real token for registered users, prod fell into the redirect branch, leaking the login token in the URL and bypassing email entirely. Separate the two decisions: - Handle ErrUnregisteredEmail explicitly by rendering the same confirmation page as a successful send, instead of subtly zeroing the entry. - Gate the dev "redirect to magic link" behavior on an explicit build-tagged skipLoginEmail flag plumbed through ServerParams, so prod never redirects to the token. Add TestLoginPostDoesNotLeakTokenInProdMode as a regression test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>