Fix: legit logins only

script.js

@@ -267,7 +267,9 @@ function updateAuthControls() {
   if (authStatus) {
     authStatus.textContent = hasSupabase
       ? authSession
-        ? `Signed in as ${label}`
+        ? isEmailConfirmed(authSession)
+          ? `Signed in as ${label}`
+          : `Signed in as ${label}. Confirm your email to play ranked games.`
         : "Sign in with your email and password. If we cannot find your account, you can create one here."
       : "Supabase is not configured. Guest play is active."
   }
@@ -305,6 +307,12 @@ async function startRemoteHourlyRound() {
   const client = getSupabaseClient()
   if (!client || !authSession) return null
 
+  if (!isEmailConfirmed(authSession)) {
+    roundStatus.textContent = "Confirm email to play ranked"
+    showAlert("Confirm your email to save ranked scores", 3500)
+    return null
+  }
+
   try {
     const { data, error } = await client.rpc("start_hourly_round")
     if (error) throw error
@@ -320,6 +328,10 @@ async function startRemoteHourlyRound() {
   }
 }
 
+function isEmailConfirmed(session) {
+  return Boolean(session?.user?.email_confirmed_at || session?.user?.confirmed_at)
+}
+
 function getSupabaseClient() {
   const config = window.FANCY_WORDLE_SUPABASE || {}
   if (!config.url || !config.anonKey || !window.supabase) return null
@@ -606,7 +618,7 @@ async function signUpWithPassword(event) {
 
   authStatus.textContent = error
     ? readableAuthError(error)
-    : "Account created. Check your email if confirmation is required."
+    : "Account created. Check your email and confirm it before playing ranked games."
 }
 
 async function signInWithPassword(event) {
@@ -632,6 +644,12 @@ async function signInWithPassword(event) {
     return
   }
 
+  const { data: { session } } = await client.auth.getSession()
+  if (session && !isEmailConfirmed(session)) {
+    authStatus.textContent = "Signed in, but email is not confirmed yet. Check your inbox before playing ranked games."
+    return
+  }
+
   window.location.reload()
 }
 
@@ -714,6 +732,9 @@ function readableAuthError(error) {
   if (lowerMessage.includes("rate limit")) {
     return "Too many attempts. Wait a few minutes and try again."
   }
+  if (lowerMessage.includes("confirm")) {
+    return "Please confirm your email before playing ranked games."
+  }
 
   return message
 }