iterate on feature

server/graphql/schemaV2.graphql

@@ -6132,10 +6132,20 @@ type HostApplication {
   """
   account: Account!
 
+  """
+  The host the collective applied to
+  """
+  host: Host!
+
   """
   The date on which the item was created
   """
   createdAt: DateTime!
+
+  """
+  The date on which the item was updated
+  """
+  updatedAt: DateTime!
   status: HostApplicationStatus
   message: String
   customData: JSON
@@ -8393,6 +8403,11 @@ type Collective implements Account & AccountWithHost & AccountWithContributions
   """
   hostFeePercent(paymentMethodService: PaymentMethodService, paymentMethodType: PaymentMethodType): Float
 
+  """
+  Returns the Fiscal Host application
+  """
+  hostApplication: HostApplication
+
   """
   How much platform fees are charged for this account
   """
@@ -8496,6 +8511,11 @@ interface AccountWithHost {
   """
   hostFeePercent(paymentMethodService: PaymentMethodService, paymentMethodType: PaymentMethodType): Float
 
+  """
+  Returns the Fiscal Host application
+  """
+  hostApplication: HostApplication
+
   """
   Fees percentage that the platform takes for this collective
   """
@@ -9574,6 +9594,11 @@ type Event implements Account & AccountWithHost & AccountWithContributions & Acc
   """
   hostFeePercent(paymentMethodService: PaymentMethodService, paymentMethodType: PaymentMethodType): Float
 
+  """
+  Returns the Fiscal Host application
+  """
+  hostApplication: HostApplication
+
   """
   How much platform fees are charged for this account
   """
@@ -15617,6 +15642,11 @@ type Fund implements Account & AccountWithHost & AccountWithContributions {
   """
   hostFeePercent(paymentMethodService: PaymentMethodService, paymentMethodType: PaymentMethodType): Float
 
+  """
+  Returns the Fiscal Host application
+  """
+  hostApplication: HostApplication
+
   """
   How much platform fees are charged for this account
   """
@@ -16465,6 +16495,11 @@ type Project implements Account & AccountWithHost & AccountWithContributions & A
   """
   hostFeePercent(paymentMethodService: PaymentMethodService, paymentMethodType: PaymentMethodType): Float
 
+  """
+  Returns the Fiscal Host application
+  """
+  hostApplication: HostApplication
+
   """
   How much platform fees are charged for this account
   """
@@ -17363,6 +17398,16 @@ type Mutation {
     currentPassword: String
   ): SetPasswordResponse!
 
+  """
+  Confirm email for Individual. Scope: "account".
+  """
+  confirmEmail(
+    """
+    The token to confirm the email.
+    """
+    token: String!
+  ): IndividualConfirmEmailResponse!
+
   """
   Submit a legal document
   """
@@ -19381,6 +19426,18 @@ type SetPasswordResponse {
   token: String
 }
 
+type IndividualConfirmEmailResponse {
+  """
+  The account that was confirmed
+  """
+  individual: Individual!
+
+  """
+  A new session token to use for the account. Only returned if user is signed in already.
+  """
+  sessionToken: String
+}
+
 """
 The `Upload` scalar type represents a file upload.
 """

server/graphql/v2/mutation/IndividualMutations.ts

@@ -115,9 +115,9 @@ const individualMutations = {
             type: new GraphQLNonNull(GraphQLIndividual),
             description: 'The account that was confirmed',
           },
-          token: {
+          sessionToken: {
             type: GraphQLString,
-            description: 'A new session token to use for the account. Only returned if not using OAuth.',
+            description: 'A new session token to use for the account. Only returned if user is signed in already.',
           },
         },
       }),
@@ -129,25 +129,28 @@ const individualMutations = {
       },
     },
     resolve: async (_, { token: confirmEmailToken }, req) => {
-      enforceScope(req, 'account');
+      // Forbid this route for OAuth and Personal Tokens. Remember to check the scope if you want to allow it.
+      // Also make sure to prevent exchanging OAuth/Personal tokens for session tokens.
+      if (req.userToken || req.personalToken) {
+        throw new Unauthorized('OAuth and Personal Tokens are not allowed for this route');
+      }
 
       const user = await confirmUserEmail(confirmEmailToken);
       const individual = await user.getCollective({ loaders: req.loaders });
 
       // The sign-in token
-      let token;
+      let sessionToken;
 
-      // We don't want OAuth tokens to be exchanged against a session token
-      if (req.remoteUser && !req.userToken && !req.personalToken) {
-        // Context: this is token generation when updating password
-        token = await user.generateSessionToken({
+      // Re-generate the session token if the user is already signed in
+      if (req.remoteUser) {
+        sessionToken = await req.remoteUser.generateSessionToken({
           sessionId: req.jwtPayload?.sessionId,
           createActivity: false,
           updateLastLoginAt: false,
         });
       }
 
-      return { individual, token };
+      return { individual, sessionToken };
     },
   },
 };