feat(fastify): add new-device session alerts and session list

[gaboesquivel]

Summary

• Email a new-device sign-in alert when a session’s browser/OS fingerprint is new for that user, persist device metadata on sessions, and expose JWT session list/delete plus a public revoke-from-email flow.
• Settings → Security now opens on Sessions; login notification and email-changed templates were restyled; unused @repo/notif was removed.
• Includes migration 0018, generated OpenAPI/client, React hooks, e2e coverage, and a macOS-safe test-server kill script.

Breaking changes

• Workspace package @repo/notif is gone. Mail goes through fastify.emailProvider.
• API needs WEB_APP_URL (defaults to http://localhost:3000) so revoke links in email stay on an allowlisted origin.
• Apply Drizzle migration 0018_kind_starfox before deploying.

Test plan

• Sign in from a new browser/OS and confirm one login-notification email with a working revoke CTA.
• Repeat sign-in from the same browser/OS and confirm no second new-device email.
• Open Settings → Security and confirm the Sessions tab lists the current session; sign out another device without dropping the setup session.
• Hit the email revoke URL while logged in and confirm that session is revoked (CAS-idempotent if replayed).
• Run pnpm run qa.

Summary by CodeRabbit

• New Features

  • Added security session management: view active devices, revoke individual sessions, and revoke sessions through secure email links.
  • Added new-device sign-in emails with device, location, sign-in method, and session review details.
  • Added React hooks for loading and revoking sessions.
  • Added React Email guidance, templates, editor, internationalization, styling, sending, and compliance tests.
  • Added plain-text email rendering and a solid button style.

• Documentation

  • Updated authentication, security, architecture, and email documentation.

• Removals

  • Removed the unused notification package and transaction email template.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
basilic-docs	Ready	Preview	Sep 4, 2026 4:26am UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
basilic-fastify	Ignored	Preview	Sep 4, 2026 4:26am UTC
basilic-next	Ignored	Preview	Sep 4, 2026 4:26am UTC

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: e41c6f57-36fb-4f3e-8825-3edeba09309d

📥 Commits

Reviewing files that changed from the base of the PR and between e567f35 and 9169bb5.

⛔ Files ignored due to path filters (12)

• apps/api/.env.defaults.example is excluded by !**/.env*
• apps/api/.env.test.example is excluded by !**/.env*
• apps/api/src/db/migrations/0018_kind_starfox.sql is excluded by !apps/api/src/db/migrations/**
• apps/api/src/db/migrations/meta/0018_snapshot.json is excluded by !apps/api/src/db/migrations/**
• apps/api/src/db/migrations/meta/_journal.json is excluded by !apps/api/src/db/migrations/**
• packages/core/src/api-client.gen.ts is excluded by !**/*.gen.ts
• packages/core/src/api-wrapper.gen.ts is excluded by !**/*.gen.ts
• packages/core/src/gen/index.ts is excluded by !**/gen/**, !**/gen/**
• packages/core/src/gen/sdk.gen.ts is excluded by !**/gen/**, !**/gen/**, !**/*.gen.ts
• packages/core/src/gen/types.gen.ts is excluded by !**/gen/**, !**/gen/**, !**/*.gen.ts
• packages/notif/tsconfig.json is excluded by !**/tsconfig*.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/pnpm-lock.yaml

📒 Files selected for processing (87)

• .agents/skills/react-email/README.md
• .agents/skills/react-email/SKILL.md
• .agents/skills/react-email/TESTS.md
• .agents/skills/react-email/references/COMPONENTS.md
• .agents/skills/react-email/references/EDITOR.md
• .agents/skills/react-email/references/I18N.md
• .agents/skills/react-email/references/PATTERNS.md
• .agents/skills/react-email/references/SENDING.md
• .agents/skills/react-email/references/STYLING.md
• README.md
• _first/basilic/ARCHITECTURE.md
• _first/basilic/DATA.md
• _first/basilic/JOURNEYS.md
• _first/basilic/PRODUCT.md
• _first/basilic/SECURITY.md
• apps/api/openapi/openapi.json
• apps/api/scripts/generate-openapi.ts
• apps/api/src/db/schema/tables/sessions.ts
• apps/api/src/db/schema/tables/verification.ts
• apps/api/src/lib/env.ts
• apps/api/src/lib/session.ts
• apps/api/src/lib/session/device.ts
• apps/api/src/lib/session/index.ts
• apps/api/src/lib/session/issue.ts
• apps/api/src/lib/session/notify.ts
• apps/api/src/lib/session/revoke.ts
• apps/api/src/lib/session/user.ts
• apps/api/src/routes/account/email/change/verify.test.ts
• apps/api/src/routes/account/email/change/verify.ts
• apps/api/src/routes/auth/magiclink/verify.ts
• apps/api/src/routes/auth/oauth/facebook/exchange.ts
• apps/api/src/routes/auth/oauth/github/exchange.ts
• apps/api/src/routes/auth/oauth/google/exchange.ts
• apps/api/src/routes/auth/oauth/google/verify-id-token.ts
• apps/api/src/routes/auth/oauth/twitter/exchange.ts
• apps/api/src/routes/auth/passkey/verify.ts
• apps/api/src/routes/auth/sessions/delete.test.ts
• apps/api/src/routes/auth/sessions/delete.ts
• apps/api/src/routes/auth/sessions/device.test.ts
• apps/api/src/routes/auth/sessions/list.test.ts
• apps/api/src/routes/auth/sessions/list.ts
• apps/api/src/routes/auth/sessions/notify.test.ts
• apps/api/src/routes/auth/sessions/revoke.test.ts
• apps/api/src/routes/auth/sessions/revoke.ts
• apps/api/src/routes/auth/sessions/sessions.spec.ts
• apps/api/src/routes/auth/web3/eip155/verify.ts
• apps/api/src/routes/auth/web3/solana/verify.ts
• apps/api/src/routes/test/verification-helpers.ts
• apps/docu/content/docs/architecture/authentication.mdx
• apps/docu/content/docs/architecture/esm-strategy.mdx
• apps/docu/content/docs/architecture/monorepo.mdx
• apps/docu/content/docs/architecture/security.mdx
• apps/docu/content/docs/deployment/publishing.mdx
• apps/docu/content/docs/development/index.mdx
• apps/docu/content/docs/development/packages.mdx
• apps/web/app/(dashboard)/settings/security/page.tsx
• apps/web/app/(dashboard)/settings/security/security-tabs.tsx
• apps/web/app/(dashboard)/settings/security/sessions-card.tsx
• apps/web/app/(dashboard)/settings/security/sessions/page.tsx
• apps/web/app/auth/session/revoke/page.tsx
• apps/web/e2e/dashboard.spec.ts
• apps/web/e2e/security/sessions.spec.ts
• apps/web/playwright.config.ts
• apps/web/proxy.ts
• biome.json
• packages/email/README.md
• packages/email/components/button.tsx
• packages/email/components/footer.tsx
• packages/email/emails/email-changed-notification.tsx
• packages/email/emails/login-notification.tsx
• packages/email/emails/transactions.tsx
• packages/email/render.ts
• packages/notif/README.md
• packages/notif/eslint.config.js
• packages/notif/package.json
• packages/notif/src/base.ts
• packages/notif/src/env.ts
• packages/notif/src/index.ts
• packages/notif/src/notification-types.ts
• packages/notif/src/schemas.ts
• packages/notif/src/services/email-service.ts
• packages/notif/src/types/login-notification.ts
• packages/notif/src/types/transactions-created.ts
• packages/react/src/hooks/use-sessions.ts
• packages/react/src/index.ts
• scripts/kill-test-servers.sh
• skills-lock.json

 ________________________________________________________________
< Just keep coding, just keep coding... I'll handle the reviews. >
 ----------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/session-device-alerts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}