fix email change issues (#973)

* fix email change

* isolated email update

* update email UI immediately

---------

Co-authored-by: Christian Beutel <>

db/hooks/users.go

@@ -87,17 +87,6 @@ func UpdateUserHandler(client meilisearch.ServiceManager) func(e *core.RecordEve
 	}
 }
 
-func ChangeUserEmailHandler() func(e *core.RecordRequestEmailChangeRequestEvent) error {
-	return func(e *core.RecordRequestEmailChangeRequestEvent) error {
-
-		e.Record.Set("email", e.NewEmail)
-		if err := e.App.Save(e.Record); err != nil {
-			return err
-		}
-		return nil
-	}
-}
-
 func createDefaultUserSettings(app core.App, userId string) error {
 	collection, err := app.FindCollectionByNameOrId("settings")
 	if err != nil {

db/main.go

@@ -88,7 +88,6 @@ func registerMigrations(app *pocketbase.PocketBase) {
 func setupEventHandlers(app *pocketbase.PocketBase, client meilisearch.ServiceManager) {
 	app.OnRecordAfterCreateSuccess("users").BindFunc(hooks.CreateUserHandler(client))
 	app.OnRecordAfterUpdateSuccess("users").BindFunc(hooks.UpdateUserHandler(client))
-	app.OnRecordRequestEmailChangeRequest("users").BindFunc(hooks.ChangeUserEmailHandler())
 
 	app.OnRecordAfterCreateSuccess("trails").BindFunc(hooks.CreateTrailHandler(client))
 	app.OnRecordAfterUpdateSuccess("trails").BindFunc(hooks.UpdateTrailHandler(client))
@@ -155,6 +154,7 @@ func registerRoutes(se *core.ServeEvent, client meilisearch.ServiceManager) {
 	se.Router.GET("/health", routes.Health)
 
 	se.Router.POST("/auth/token", routes.AuthToken)
+	se.Router.POST("/user/email", routes.UserEmailChange)
 	se.Router.POST("/waypoint/cluster", routes.WaypointCluster)
 
 	se.Router.POST("/trail-merge/suggest", routes.TrailMergeSuggest)

db/routes/user_email_change.go

@@ -0,0 +1,62 @@
+package routes
+
+import (
+	"errors"
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/routine"
+)
+
+func UserEmailChange(e *core.RequestEvent) error {
+	if e.Auth == nil {
+		return apis.NewUnauthorizedError("Authentication required", nil)
+	}
+
+	var data struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := e.BindBody(&data); err != nil {
+		return apis.NewBadRequestError("Failed to read request data", err)
+	}
+	if data.Email == "" {
+		return apis.NewBadRequestError("Email is required", nil)
+	}
+	if data.Password == "" {
+		return apis.NewBadRequestError("Current password is required", nil)
+	}
+	if !e.Auth.ValidatePassword(data.Password) {
+		return apis.NewBadRequestError("Invalid password", nil)
+	}
+
+	e.Auth.Set("email", data.Email)
+	e.Auth.Set("verified", false)
+	if err := e.App.Save(e.Auth); err != nil {
+		var verr validation.Errors
+		if errors.As(err, &verr) {
+			return apis.NewBadRequestError("Validation failed", verr)
+		}
+		return err
+	}
+
+	app := e.App
+	routine.FireAndForget(func() {
+		if err := mails.SendRecordVerification(app, e.Auth); err != nil {
+			app.Logger().Error("Failed to send verification email", "error", err)
+		}
+	})
+
+	token, err := e.Auth.NewAuthToken()
+	if err != nil {
+		return err
+	}
+
+	return e.JSON(http.StatusOK, map[string]any{
+		"token":  token,
+		"record": e.Auth,
+	})
+}