fix: update email verification endpoint and improve error handling in apiFetch

backend/src/routes/auth.ts

@@ -1,6 +1,7 @@
 import { Router } from 'express'
 import rateLimit from 'express-rate-limit'
 import { validateBody } from '../middleware/validate.js'
+import { validateQuery } from '../middleware/validate.js'
 import { requireAuth } from '../middleware/auth.js'
 import { asyncHandler } from '../utils/asyncHandler.js'
 import * as authService from '../services/authService.js'
@@ -86,9 +87,9 @@ router.post(
 // GET /api/auth/verify
 router.get(
   '/verify',
-  validateBody(verifyEmailSchema),
+  validateQuery(verifyEmailSchema),
   asyncHandler(async (req, res) => {
-    await authService.verifyEmail(req.body)
+    await authService.verifyEmail(req.query as { token: string })
     res.json({ message: 'Email verified successfully' })
   })
 )

frontend/src/api/authApi.ts

@@ -38,7 +38,7 @@ export function changePassword(data: { currentPassword: string; newPassword: str
 }
 
 export function verifyEmailToken(token: string): Promise<{ message: string }> {
-  return apiFetch(`/api/auth/verify-email?token=${encodeURIComponent(token)}`)
+  return apiFetch(`/api/auth/verify?token=${encodeURIComponent(token)}`)
 }
 
 export function forgotPassword(email?: string): Promise<{ message: string }> {

frontend/src/utils/api.test.ts

@@ -1,5 +1,9 @@
-import { describe, it, expect } from 'vitest'
-import { ApiError } from './api'
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { apiFetch, ApiError } from './api'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
 
 describe('ApiError', () => {
   it('extends Error', () => {
@@ -18,3 +22,19 @@ describe('ApiError', () => {
     expect(err.name).toBe('ApiError')
   })
 })
+
+describe('apiFetch', () => {
+  it('uses message from error responses', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+      ok: false,
+      status: 403,
+      statusText: 'Forbidden',
+      json: vi.fn().mockResolvedValue({ message: 'Please verify your email before logging in' }),
+    }))
+
+    await expect(apiFetch('/api/auth/login')).rejects.toMatchObject({
+      status: 403,
+      message: 'Please verify your email before logging in',
+    })
+  })
+})

frontend/src/utils/api.ts

@@ -40,7 +40,8 @@ export async function apiFetch<T = unknown>(
 
   if (!res.ok) {
     const body = await res.json().catch(() => ({ error: res.statusText }))
-    throw new ApiError(res.status, (body as { error?: string }).error ?? 'Request failed')
+    const parsedBody = body as { error?: string; message?: string }
+    throw new ApiError(res.status, parsedBody.error ?? parsedBody.message ?? 'Request failed')
   }
 
   return res.json() as Promise<T>