fix: distinguish magic-link login from confirmation

lib/who_need_help_web/controllers/user_session_controller.ex

@@ -24,16 +24,21 @@ defmodule WhoNeedHelpWeb.UserSessionController do
   end
 
   # magic link login
-  def create(conn, %{"user" => %{"token" => token} = user_params} = params)
+  def create(conn, %{"user" => %{"token" => token} = user_params})
       when is_binary(token) do
-    info =
-      case params do
-        %{"_action" => "confirmed"} -> gettext("User confirmed successfully.")
-        _ -> gettext("Welcome back!")
+    was_confirmed? =
+      case Accounts.get_user_by_magic_link_token(token) do
+        %Accounts.User{confirmed_at: confirmed_at} -> not is_nil(confirmed_at)
+        _missing_or_invalid -> false
       end
 
     case Accounts.login_user_by_magic_link(token) do
       {:ok, {user, _expired_tokens}} ->
+        info =
+          if was_confirmed?,
+            do: gettext("Welcome back!"),
+            else: gettext("User confirmed successfully.")
+
         conn
         |> put_flash(:info, info)
         |> maybe_connect_pending_google(user)

test/who_need_help_web/controllers/user_session_controller_test.exs

@@ -208,11 +208,14 @@ defmodule WhoNeedHelpWeb.UserSessionControllerTest do
 
       conn =
         post(conn, ~p"/users/log-in", %{
-          "user" => %{"token" => token}
+          "user" => %{"token" => token},
+          "_action" => "confirmed"
         })
 
       assert get_session(conn, :user_token)
       assert redirected_to(conn) == ~p"/"
+      assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "Welcome back!"
+      refute Phoenix.Flash.get(conn.assigns.flash, :info) =~ "User confirmed successfully."
 
       # Now do a logged in request and assert on the menu
       conn = get(conn, ~p"/")