Improve authentication recovery and mobile gameplay

app/auth/callback/route.ts

@@ -11,11 +11,13 @@ export async function GET(request: NextRequest) {
   const legacyToken = request.nextUrl.searchParams.get("legacy_recovery_token");
   const type = request.nextUrl.searchParams.get("type");
   const next = authDestination(request.nextUrl.searchParams.get("next"));
+  if (type === "magiclink")
+    return NextResponse.redirect(new URL("/log-in?auth=failed", origin));
   if (
     code ||
     legacyToken ||
     (tokenHash &&
-      (type === "email" || type === "recovery" || type === "magiclink"))
+      (type === "email" || type === "signup" || type === "recovery"))
   ) {
     const client = await authClient();
     let { data, error } = code
@@ -24,7 +26,7 @@ export async function GET(request: NextRequest) {
         ? await client.auth.exchangeCodeForSession(legacyToken)
         : await client.auth.verifyOtp({
             token_hash: tokenHash!,
-            type: type as "email" | "recovery" | "magiclink",
+            type: type as "email" | "signup" | "recovery",
           });
     // Older email templates could place a recovery token hash in /code=...
     // instead of a PKCE code. Only Supabase can decide whether it is valid.