feat: add sendOnSignIn option to make sending verification link in sign in route explicit (#2422)

* feat(signin): make verification sending in sign in route explicit

* lint

* add option in docs

---------

Co-authored-by: Kinfe123 <kinfishtech@gmail.com>

docs/content/docs/reference/options.mdx

@@ -132,6 +132,7 @@ export const auth = betterAuth({
 
 - `sendVerificationEmail`: Function to send verification email
 - `sendOnSignUp`: Send verification email automatically after sign up (default: `false`)
+- `sendOnSignIn`: Send verification email automatically on sign in when the user's email is not verified (default: `false`)
 - `autoSignInAfterVerification`: Auto sign in the user after they verify their email
 - `expiresIn`: Number of seconds the verification token is valid for (default: `3600` seconds)
 

packages/better-auth/src/api/routes/sign-in.ts

@@ -502,23 +502,29 @@ export const signInEmail = createAuthEndpoint(
 					message: BASE_ERROR_CODES.EMAIL_NOT_VERIFIED,
 				});
 			}
-			const token = await createEmailVerificationToken(
-				ctx.context.secret,
-				user.user.email,
-				undefined,
-				ctx.context.options.emailVerification?.expiresIn,
-			);
-			const url = `${
-				ctx.context.baseURL
-			}/verify-email?token=${token}&callbackURL=${ctx.body.callbackURL || "/"}`;
-			await ctx.context.options.emailVerification.sendVerificationEmail(
-				{
-					user: user.user,
-					url,
-					token,
-				},
-				ctx.request,
-			);
+
+			if (ctx.context.options?.emailVerification?.sendOnSignIn) {
+				const token = await createEmailVerificationToken(
+					ctx.context.secret,
+					user.user.email,
+					undefined,
+					ctx.context.options.emailVerification?.expiresIn,
+				);
+				const url = `${
+					ctx.context.baseURL
+				}/verify-email?token=${token}&callbackURL=${
+					ctx.body.callbackURL || "/"
+				}`;
+				await ctx.context.options.emailVerification.sendVerificationEmail(
+					{
+						user: user.user,
+						url,
+						token,
+					},
+					ctx.request,
+				);
+			}
+
 			throw new APIError("FORBIDDEN", {
 				message: BASE_ERROR_CODES.EMAIL_NOT_VERIFIED,
 			});

packages/better-auth/src/types/options.ts

@@ -162,6 +162,13 @@ export type BetterAuthOptions = {
 		 * @default false
 		 */
 		sendOnSignUp?: boolean;
+		/**
+		 * Send a verification email automatically
+		 * on sign in when the user's email is not verified
+		 *
+		 * @default false
+		 */
+		sendOnSignIn?: boolean;
 		/**
 		 * Auto signin the user after they verify their email
 		 */