Complete verification links and preserve verified login email (#60)

frontend/packages/sxchnge_auth/test/backend_test.dart

@@ -10,6 +10,48 @@ import 'package:sxchnge_auth/sxchnge_auth.dart';
 void main() {
   http.Response response(Map<String, Object?> data, [int status = 202]) =>
       http.Response(jsonEncode({'data': data}), status);
+  test(
+    'activation maps only a confirmed response to the verified email',
+    () async {
+      var confirmed = true;
+      final service = BackendAuthServices(
+        baseUri: Uri.parse('https://api.example/api/v1'),
+        clientId: 'web',
+        client: MockClient((request) async {
+          expect(request.url.path, '/api/v1/accounts/verification/confirm');
+          expect(jsonDecode(request.body), {'token': 'opaque-link'});
+          return response({
+            'verified': confirmed,
+            'email': 'alias@example.com',
+          });
+        }),
+      );
+      addTearDown(service.close);
+      final accepted = await service.confirm(token: 'opaque-link');
+      expect(accepted.verifiedEmail, 'alias@example.com');
+      expect(accepted.isSimulated, isFalse);
+      confirmed = false;
+      await expectLater(
+        service.confirm(token: 'opaque-link'),
+        throwsA(isA<VerificationException>()),
+      );
+    },
+  );
+  test(
+    'activation remains compatible with a verified response without email',
+    () async {
+      final service = BackendAuthServices(
+        baseUri: Uri.parse('https://api.example/api/v1'),
+        clientId: 'web',
+        client: MockClient((_) async => response({'verified': true})),
+      );
+      addTearDown(service.close);
+      expect(
+        (await service.confirm(token: 'opaque-link')).verifiedEmail,
+        isNull,
+      );
+    },
+  );
   test(
     'signup distinguishes support recovery and keeps the retry key',
     () async {

frontend/packages/sxchnge_auth/test/verification_test.dart

@@ -42,6 +42,12 @@ void main() {
       addTearDown(provider.dispose);
       await provider.confirm(scenario.key);
       expect(provider.state.status, scenario.value);
+      expect(
+        provider.state.result?.verifiedEmail,
+        scenario.value == VerificationStatus.verified
+            ? 'alex@example.com'
+            : null,
+      );
       expect(
         provider.state.isSimulated,
         scenario.value == VerificationStatus.verified,
@@ -75,7 +81,23 @@ void main() {
     service.pending.complete(const VerificationResult(isSimulated: true));
     await operation;
     expect(provider.state.status, VerificationStatus.idle);
+    expect(provider.state.result, isNull);
   });
+  test(
+    'a later failed confirmation clears the previous verified identity',
+    () async {
+      final provider = VerificationProvider(
+        const DummyVerificationService(delay: Duration.zero),
+      );
+      addTearDown(provider.dispose);
+      await provider.confirm('demo-valid');
+      expect(provider.state.result?.verifiedEmail, 'alex@example.com');
+      final operation = provider.confirm('bad');
+      expect(provider.state.result, isNull);
+      await operation;
+      expect(provider.state.result, isNull);
+    },
+  );
   test('dispose discards late exception', () async {
     final service = PendingService();
     final provider = VerificationProvider(service);