Require email account authentication

apps/web/server/utils/stage-two-supabase.ts

@@ -7,7 +7,11 @@ const AuthEmailSchema = z.preprocess(
   value => value === null || value === '' ? undefined : value,
   z.string().email().optional(),
 )
-const AuthUserSchema = z.object({ id: UuidSchema, email: AuthEmailSchema })
+const AuthUserSchema = z.object({
+  id: UuidSchema,
+  email: AuthEmailSchema,
+  is_anonymous: z.boolean().optional().default(false),
+})
 
 interface RequestOptions extends RequestInit {
   prefer?: string
@@ -95,6 +99,9 @@ export async function requireStageTwoUser(event: H3Event): Promise<StageTwoUser>
   if (!response.ok) throw createError({ statusCode: 401, statusMessage: 'The access token is invalid or expired.' })
   const parsed = AuthUserSchema.safeParse(await response.json())
   if (!parsed.success) throw createError({ statusCode: 401, statusMessage: 'Supabase returned an invalid user.' })
+  if (parsed.data.is_anonymous || !parsed.data.email) {
+    throw createError({ statusCode: 403, statusMessage: 'A verified email account is required.' })
+  }
 
   const profiles = await stageTwoDatabase<Array<{ id: string }>>(`profiles?select=id&id=eq.${parsed.data.id}&limit=1`)
   if (!profiles[0]) throw createError({ statusCode: 403, statusMessage: 'This account is not enabled for the alpha.' })