Review collection does not require user email re-verification

Forcing re-verification on already-authenticated users tanks review submission rates — every extra step compounds drop-off, and CAPTCHA or email re-confirmation on an active session signals distrust of your own auth system. Submissions fall, aggregate ratings shrink, and schema.org AggregateRating eligibility suffers from thin review counts. The friction also pushes users to third-party review platforms where the data leaves your control.

Trust the active session in api/reviews/submit and skip CAPTCHA, email re-verification, and second-factor challenges for logged-in users. Reserve anonymous-path friction (email entry, lightweight CAPTCHA) for unauthenticated submissions only:

if (!session?.user) {
  const email = req.body.email
  await verifyAnonymousSubmitter(email)
} else {
  await db.reviews.create({
    data: { user_id: session.user.id, rating, text }
  })
}