Signup endpoint with e-mail verification flow #13

New Issue

fable-5 · 2026-07-04T14:52:02+02:00

fable-5 commented

2026-07-04 14:52:02 +02:00

Context

Self-registration with double opt-in is a kickoff requirement; unverified accounts must not create content.

Scope

Endpoints: POST /auth/signup (username, email, password; Zod-validated; creates user with status pending_verification, enqueues verification mail with single-use hashed token, 24 h expiry), POST /auth/verify-email (consumes token, activates account), POST /auth/resend-verification (rate-limited). Respect instance_settings.registration_mode (open/closed — closed returns a localized 403). Apply rate limits (signup 5/h/IP).

Acceptance criteria

happy path: signup → mail in MailHog → verify → status active
expired/reused tokens fail with distinct localized errors
signup with taken username/email returns a field-level validation error without leaking which accounts exist beyond the necessary
registration_mode=closed blocks signup but not later logins
e2e test covers the full flow

Technical notes

ADR 0007, data-model.md (auth_tokens).
Password policy: min 10 chars, no composition rules; check against a small common-password list.

Dependencies

Depends on #10, #11, #12.

Size: ~1.5 days

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Self-registration with double opt-in is a kickoff requirement; unverified accounts must not create content. ## Scope Endpoints: `POST /auth/signup` (username, email, password; Zod-validated; creates user with status `pending_verification`, enqueues verification mail with single-use hashed token, 24 h expiry), `POST /auth/verify-email` (consumes token, activates account), `POST /auth/resend-verification` (rate-limited). Respect `instance_settings.registration_mode` (`open`/`closed` — closed returns a localized 403). Apply rate limits (signup 5/h/IP). ## Acceptance criteria - [ ] happy path: signup → mail in MailHog → verify → status `active` - [ ] expired/reused tokens fail with distinct localized errors - [ ] signup with taken username/email returns a field-level validation error without leaking which accounts exist beyond the necessary - [ ] `registration_mode=closed` blocks signup but not later logins - [ ] e2e test covers the full flow ## Technical notes - ADR 0007, data-model.md (`auth_tokens`). - Password policy: min 10 chars, no composition rules; check against a small common-password list. ## Dependencies Depends on #10, #11, #12. **Size**: ~1.5 days --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M1 — Accounts & authentication milestone 2026-07-04 14:52:02 +02:00

fable-5 added the

auth

backend

labels 2026-07-04 14:52:02 +02:00

fable-5 referenced this issue

2026-07-04 14:52:03 +02:00

Password reset flow #15

fable-5 referenced this issue

2026-07-04 14:52:04 +02:00

Auth pages in the SPA (signup, verify, login, reset) #16

fable-5 referenced this issue