Render textured aerial maps and support legacy recovery links

app/auth/callback/route.ts

@@ -8,23 +8,35 @@ export async function GET(request: NextRequest) {
   const origin = requestOrigin(request, process.env.MINEGEO_URL);
   const code = request.nextUrl.searchParams.get("code");
   const tokenHash = request.nextUrl.searchParams.get("token_hash");
+  const legacyToken = request.nextUrl.searchParams.get("legacy_recovery_token");
   const type = request.nextUrl.searchParams.get("type");
   const next = authDestination(request.nextUrl.searchParams.get("next"));
   if (
     code ||
+    legacyToken ||
     (tokenHash &&
       (type === "email" || type === "recovery" || type === "magiclink"))
   ) {
     const client = await authClient();
-    const { data, error } = code
+    let { data, error } = code
       ? await client.auth.exchangeCodeForSession(code)
-      : await client.auth.verifyOtp({
-          token_hash: tokenHash!,
-          type: type as "email" | "recovery" | "magiclink",
-        });
+      : legacyToken
+        ? await client.auth.exchangeCodeForSession(legacyToken)
+        : await client.auth.verifyOtp({
+            token_hash: tokenHash!,
+            type: type as "email" | "recovery" | "magiclink",
+          });
+    // Older email templates could place a recovery token hash in /code=...
+    // instead of a PKCE code. Only Supabase can decide whether it is valid.
+    if (legacyToken && error)
+      ({ data, error } = await client.auth.verifyOtp({
+        token_hash: legacyToken,
+        type: "recovery",
+      }));
     if (!error && data.user) {
       await accountProfile(data.user);
-      const destination = type === "recovery" ? "/auth/reset-password" : next;
+      const destination =
+        type === "recovery" || legacyToken ? "/auth/reset-password" : next;
       const response = NextResponse.redirect(new URL(destination, origin));
       if (destination === "/auth/reset-password") {
         const { data: claims } = await client.auth.getClaims();