feat: email verification + delete confirmation + smtp/cors/prod hardening

web/src/App.tsx

@@ -1,9 +1,41 @@
-import { Suspense } from "react";
-import { Outlet } from "react-router-dom";
+import { Suspense, useEffect, useState } from "react";
+import { Outlet, useLocation } from "react-router-dom";
+import { useQueryClient } from "@tanstack/react-query";
 import { SessionTimeoutWarning } from "./components/SessionTimeoutWarning";
 import NavBar from "./components/NavBar";
+import { useAuthSession } from "./hooks/useAuthSession";
+import { http } from "./api/http";
+import UpdateNoticeModal from "./components/UpdateNoticeModal";
 
 export default function App() {
+  const location = useLocation();
+  const qc = useQueryClient();
+  const session = useAuthSession({ retry: false });
+  const [dismissedVersion, setDismissedVersion] = useState<number | null>(null);
+
+  const notice = session.data?.updateNotice;
+  const isPublicRoute =
+    location.pathname.startsWith("/login") ||
+    location.pathname.startsWith("/register") ||
+    location.pathname.startsWith("/verify") ||
+    location.pathname.startsWith("/beta");
+
+  const showUpdateModal = !isPublicRoute && !!notice && dismissedVersion !== notice.version;
+
+  useEffect(() => {
+    setDismissedVersion(null);
+  }, [session.data?.userId]);
+
+  const acknowledgeNotice = async () => {
+    if (!notice) return;
+    await http("/app/update-notice/ack", {
+      method: "POST",
+      body: { version: notice.version },
+    });
+    setDismissedVersion(notice.version);
+    await qc.invalidateQueries({ queryKey: ["auth", "session"] });
+  };
+
   return (
     <>
       <SessionTimeoutWarning />
@@ -13,6 +45,13 @@ export default function App() {
           <Outlet />
         </Suspense>
       </main>
+      {showUpdateModal && notice ? (
+        <UpdateNoticeModal
+          title={notice.title}
+          body={notice.body}
+          onAcknowledge={acknowledgeNotice}
+        />
+      ) : null}
     </>
   );
 }