Changed sign-up flow to require e-mail verification up front, preventing account existence leakage.

components/user/account.vue

@@ -23,6 +23,7 @@ const saving = ref(false);
 const submitted = ref(false);
 const verifying = ref(false);
 const verified = ref(false);
+const feedback = ref(null);
 
 function getFeedback() {
 	if (credentials.email && Object.entries(credentials).some(([key, value]) => key !== 'email' && value !== null)) {
@@ -38,13 +39,16 @@ function getFeedback() {
 
 async function updateAccount() {
 	saving.value = true;
+	feedback.value = null;
 
 	try {
+		const feedback = getFeedback();
+
 		await patch('/me', {
 			credentials,
 			password: currentPassword.value,
 		}, {
-			successFeedback: getFeedback(),
+			successFeedback: feedback,
 			errorFeedback: 'Failed to update account',
 			appendErrorMessage: true,
 		});
@@ -54,6 +58,7 @@ async function updateAccount() {
 		credentials.password = null;
 
 		submitted.value = true;
+		feedback.value = feedback;
 	}
 	finally {
 		saving.value = false;
@@ -175,7 +180,7 @@ async function verifyEmail() {
 			<strong
 				v-else-if="submitted"
 				class="success"
-			>{{ getFeedback() }}</strong>
+			>{{ feedback }}</strong>
 
 			<button
 				v-else