Support both email and phone login

Auto-detect whether the user entered an email or phone number.
Email sends via Resend, phone sends via Twilio SMS. Users table
has nullable phone and email columns; verification_codes uses a
generic identifier field.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

auth.go

@@ -1,10 +1,12 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"database/sql"
 	"encoding/hex"
+	"encoding/json"
 	"fmt"
 	"log"
 	"math/big"
@@ -48,8 +50,8 @@ func (s *Server) sessionMiddleware(next http.Handler) http.Handler {
 		}
 		var u db.User
 		row := s.db.QueryRowContext(r.Context(),
-			"SELECT id, phone, name, created_at FROM users WHERE id = ?", sess.UserID)
-		if err := row.Scan(&u.ID, &u.Phone, &u.Name, &u.CreatedAt); err != nil {
+			"SELECT id, phone, email, name, created_at FROM users WHERE id = ?", sess.UserID)
+		if err := row.Scan(&u.ID, &u.Phone, &u.Email, &u.Name, &u.CreatedAt); err != nil {
 			next.ServeHTTP(w, r)
 			return
 		}
@@ -69,55 +71,83 @@ func (s *Server) requireAuth(next http.Handler) http.Handler {
 	})
 }
 
+// isEmail returns true if the input looks like an email address.
+func isEmail(s string) bool {
+	return strings.Contains(s, "@")
+}
+
 func (s *Server) handleLoginPage(w http.ResponseWriter, r *http.Request) {
 	if s.currentUser(r) != nil {
 		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
 		return
 	}
 	pageTmpl["login"].ExecuteTemplate(w, "layout", map[string]any{
-		"Step":        "phone",
+		"Step":        "identify",
 		"AuthEnabled": true,
 	})
 }
 
 func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
-	phone := normalizePhone(r.FormValue("phone"))
-	if phone == "" {
+	raw := strings.TrimSpace(r.FormValue("identifier"))
+	if raw == "" {
 		http.Redirect(w, r, "/login", http.StatusSeeOther)
 		return
 	}
 
+	var identifier string
+	var method string // "email" or "phone"
+	if isEmail(raw) {
+		identifier = strings.ToLower(raw)
+		method = "email"
+	} else {
+		identifier = normalizePhone(raw)
+		method = "phone"
+		if identifier == "" {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+	}
+
 	code := generateCode()
 	expiresAt := time.Now().Add(10 * time.Minute)
 	s.q.CreateVerificationCode(r.Context(), db.CreateVerificationCodeParams{
-		Phone:     phone,
-		Code:      code,
-		ExpiresAt: expiresAt,
+		Identifier: identifier,
+		Code:       code,
+		ExpiresAt:  expiresAt,
 	})
 
-	if err := sendVerificationSMS(phone, code); err != nil {
-		log.Printf("failed to send verification SMS to %s: %v", phone, err)
+	if method == "email" {
+		if err := sendVerificationEmail(identifier, code); err != nil {
+			log.Printf("failed to send verification email to %s: %v", identifier, err)
+		}
+	} else {
+		if err := sendVerificationSMS(identifier, code); err != nil {
+			log.Printf("failed to send verification SMS to %s: %v", identifier, err)
+		}
 	}
 
 	pageTmpl["login"].ExecuteTemplate(w, "layout", map[string]any{
 		"Step":        "code",
-		"Phone":       phone,
+		"Identifier":  identifier,
+		"Method":      method,
 		"AuthEnabled": true,
 	})
 }
 
 func (s *Server) handleVerifyCode(w http.ResponseWriter, r *http.Request) {
-	phone := normalizePhone(r.FormValue("phone"))
+	identifier := strings.TrimSpace(r.FormValue("identifier"))
+	method := r.FormValue("method")
 	code := strings.TrimSpace(r.FormValue("code"))
 
 	vc, err := s.q.GetVerificationCode(r.Context(), db.GetVerificationCodeParams{
-		Phone: phone,
-		Code:  code,
+		Identifier: identifier,
+		Code:       code,
 	})
 	if err != nil {
 		pageTmpl["login"].ExecuteTemplate(w, "layout", map[string]any{
 			"Step":        "code",
-			"Phone":       phone,
+			"Identifier":  identifier,
+			"Method":      method,
 			"Error":       "Invalid or expired code. Try again.",
 			"AuthEnabled": true,
 		})
@@ -127,9 +157,17 @@ func (s *Server) handleVerifyCode(w http.ResponseWriter, r *http.Request) {
 	s.q.MarkVerificationCodeUsed(r.Context(), vc.ID)
 
 	// Get or create user
-	user, err := s.q.GetUserByPhone(r.Context(), phone)
-	if err == sql.ErrNoRows {
-		user, err = s.q.CreateUser(r.Context(), phone)
+	var user db.User
+	if method == "email" {
+		user, err = s.q.GetUserByEmail(r.Context(), sql.NullString{String: identifier, Valid: true})
+		if err == sql.ErrNoRows {
+			user, err = s.q.CreateUserByEmail(r.Context(), sql.NullString{String: identifier, Valid: true})
+		}
+	} else {
+		user, err = s.q.GetUserByPhone(r.Context(), sql.NullString{String: identifier, Valid: true})
+		if err == sql.ErrNoRows {
+			user, err = s.q.CreateUserByPhone(r.Context(), sql.NullString{String: identifier, Valid: true})
+		}
 	}
 	if err != nil {
 		log.Printf("user lookup/create: %v", err)
@@ -278,3 +316,38 @@ func sendVerificationSMS(to, code string) error {
 	}
 	return nil
 }
+
+func sendVerificationEmail(to, code string) error {
+	apiKey := os.Getenv("RESEND_API_KEY")
+	if apiKey == "" {
+		log.Printf("RESEND_API_KEY not set — code for %s is: %s", to, code)
+		return nil
+	}
+
+	fromAddr := os.Getenv("BBQ_FROM_EMAIL")
+	if fromAddr == "" {
+		fromAddr = "bbq <noreply@bbq.torrtle.co>"
+	}
+
+	payload := map[string]any{
+		"from":    fromAddr,
+		"to":      []string{to},
+		"subject": fmt.Sprintf("Your login code: %s", code),
+		"html":    fmt.Sprintf(`<div style="font-family:sans-serif;max-width:400px;margin:0 auto;padding:40px 20px;"><h2 style="margin:0 0 16px;">Your login code</h2><div style="font-size:32px;font-weight:bold;letter-spacing:8px;background:#f5f0e8;border:2px solid #1a1a1a;padding:20px;text-align:center;margin:16px 0;">%s</div><p style="color:#555;font-size:14px;">This code expires in 10 minutes.</p></div>`, code),
+	}
+
+	body, _ := json.Marshal(payload)
+	req, _ := http.NewRequest("POST", "https://api.resend.com/emails", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer "+apiKey)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("resend API returned %d", resp.StatusCode)
+	}
+	return nil
+}