feat(email): make verify-email org-aware like other transactional mail

Resolve the tenant org from the verification link callback URL (custom
domain, tenant subdomain, or ?org=) and apply org logo, theme color, from
name, and subject. Falls back to ClassroomIO branding on the main app.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

packages/db/src/auth/resolve-verification-org.ts

@@ -0,0 +1,123 @@
+import { TENANT_ROOT_DOMAIN, BRAND_ROOT_DOMAIN } from '@cio/utils/constants/domains';
+
+import type { TOrganization } from '../types';
+import {
+  getFirstOrganization,
+  getOrganizationByCustomDomain,
+  getOrganizationByProfileId,
+  getOrganizationBySiteName
+} from '../queries/organization/organization';
+
+function extractCallbackUrl(verificationUrl: string): URL | null {
+  try {
+    const parsed = new URL(verificationUrl);
+    const callback = parsed.searchParams.get('callbackURL');
+    if (!callback) {
+      return null;
+    }
+
+    return new URL(callback);
+  } catch {
+    return null;
+  }
+}
+
+function isTenantSubdomainHost(hostname: string): boolean {
+  const host = hostname.replace(/^www\./, '').toLowerCase();
+  const suffix = `.${TENANT_ROOT_DOMAIN}`;
+
+  return host.endsWith(suffix) && host.length > suffix.length;
+}
+
+function getTenantSiteName(hostname: string): string | null {
+  const host = hostname.replace(/^www\./, '').toLowerCase();
+  const suffix = `.${TENANT_ROOT_DOMAIN}`;
+  if (!host.endsWith(suffix)) {
+    return null;
+  }
+
+  const siteName = host.slice(0, -suffix.length);
+  if (!siteName || siteName.includes('.')) {
+    return null;
+  }
+
+  return siteName;
+}
+
+function isCustomDomainHost(hostname: string): boolean {
+  const host = hostname.replace(/^www\./, '').toLowerCase();
+  if (host.includes('localhost')) {
+    return false;
+  }
+
+  if (host === BRAND_ROOT_DOMAIN || host === `app.${BRAND_ROOT_DOMAIN}`) {
+    return false;
+  }
+
+  if (isTenantSubdomainHost(host)) {
+    return false;
+  }
+
+  return !host.endsWith(`.${BRAND_ROOT_DOMAIN}`);
+}
+
+async function resolveOrgFromCallbackUrl(callbackUrl: URL): Promise<TOrganization | null> {
+  const orgSiteName = callbackUrl.searchParams.get('org')?.trim();
+  if (orgSiteName) {
+    const org = await getOrganizationBySiteName(orgSiteName);
+    if (org) {
+      return org;
+    }
+  }
+
+  const hostname = callbackUrl.hostname.toLowerCase();
+
+  if (isCustomDomainHost(hostname)) {
+    const org = await getOrganizationByCustomDomain(hostname);
+    if (org) {
+      return org;
+    }
+  }
+
+  const siteName = getTenantSiteName(hostname);
+  if (siteName) {
+    return getOrganizationBySiteName(siteName);
+  }
+
+  return null;
+}
+
+/**
+ * Resolves the tenant org that should brand a verification email from the
+ * Better Auth verification URL's `callbackURL` (where the user started the
+ * flow), with fallbacks for self-hosted and existing memberships.
+ */
+export async function resolveVerificationOrg(options: {
+  verificationUrl: string;
+  userId?: string;
+}): Promise<TOrganization | null> {
+  const callbackUrl = extractCallbackUrl(options.verificationUrl);
+  if (callbackUrl) {
+    const org = await resolveOrgFromCallbackUrl(callbackUrl);
+    if (org) {
+      return org;
+    }
+  }
+
+  if (process.env.PUBLIC_IS_SELFHOSTED === 'true') {
+    const org = await getFirstOrganization();
+    if (org) {
+      return org;
+    }
+  }
+
+  if (options.userId) {
+    const memberships = await getOrganizationByProfileId(options.userId);
+    const org = memberships[0];
+    if (org) {
+      return org;
+    }
+  }
+
+  return null;
+}