cloud/project-manager
3
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

Passwordless-only auth: drop registration and passwords entirely

Browse Source 
There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.

Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
  (race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
  find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
  authenticated and unverified); requestChange() drops the password check,
  now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
  resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
  all gone.

Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
  RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
  requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
  leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
  unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.

Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.

Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
aneurin
2026-09-04 14:47:46 +01:00
co-authored by Claude Sonnet 5
parent 8f8ad8593d
commit c82bdbbf0e
22 changed files with 277 additions and 727 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ApiTestCase.php
+9 -2
View File
@@ -107,14 +107,21 @@ abstract class ApiTestCase extends TestCase
}
/**
* Register a fresh user and return an `Authorization` header for them.
* Sign in (creating the account if needed) via the real magic-link flow and
* return an `Authorization` header for the resulting session.
*
* @return array<string, string>
*/
protected function authHeader(string $email = 'user@example.com'): array
{
// Clear any resend throttle so this works even if the address was just
// emailed a link earlier in the same test.
$this->db()->prepare('UPDATE users SET verification_email_sent_at = NULL WHERE email = :email')
->execute(['email' => $email]);
$this->request('POST', '/api/auth/magic-link', ['email' => $email]);
$token = $this->decode(
$this->request('POST', '/api/auth/register', ['email' => $email, 'password' => 'password123']),
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
)['token'];
return ['Authorization' => 'Bearer ' . $token];
tests/AuthTest.php
+44 -59
View File
@@ -4,79 +4,69 @@ declare(strict_types=1);
namespace Tests;
/**
* There is no register/login pair -- POST /api/auth/magic-link is the only way
* in, for both a brand-new address and a returning one.
*/
final class AuthTest extends ApiTestCase
{
public function test_registration_returns_a_user_and_token(): void
public function test_a_magic_link_request_always_responds_202(): void
{
$response = $this->request('POST', '/api/auth/register', [
'email' => 'Ada@example.com',
'password' => 'correct horse battery',
]);
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
self::assertSame(201, $response->getStatusCode());
self::assertSame(202, $response->getStatusCode());
}
public function test_a_magic_link_request_validates_the_address(): void
{
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'not-an-email']);
self::assertSame(422, $response->getStatusCode());
self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
}
public function test_opening_the_link_creates_the_account_and_signs_in(): void
{
$this->request('POST', '/api/auth/magic-link', ['email' => 'Ada@example.com']);
$response = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
self::assertSame(200, $response->getStatusCode());
$body = $this->decode($response);
self::assertSame('ada@example.com', $body['user']['email']);
self::assertFalse($body['user']['email_verified']);
self::assertNull($body['user']['email_verified_at']);
self::assertTrue($body['user']['email_verified']);
self::assertNotNull($body['user']['email_verified_at']);
self::assertNull($body['user']['pending_email']);
self::assertArrayNotHasKey('password', $body['user']);
self::assertArrayNotHasKey('password_hash', $body['user']);
self::assertNotEmpty($body['token']);
}
public function test_registration_rejects_a_duplicate_email(): void
public function test_a_second_request_signs_in_the_same_account(): void
{
$payload = ['email' => 'dupe@example.com', 'password' => 'password123'];
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
$firstId = $this->decode(
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
)['user']['id'];
$this->request('POST', '/api/auth/register', $payload);
$response = $this->request('POST', '/api/auth/register', $payload);
$this->db()->prepare('UPDATE users SET verification_email_sent_at = NULL WHERE email = :e')
->execute(['e' => 'ada@example.com']);
$this->request('POST', '/api/auth/magic-link', ['email' => 'ADA@EXAMPLE.COM']);
$secondId = $this->decode(
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
)['user']['id'];
self::assertSame(409, $response->getStatusCode());
self::assertSame($firstId, $secondId);
}
public function test_registration_validates_input(): void
public function test_the_link_is_not_sent_again_within_the_resend_interval(): void
{
$response = $this->request('POST', '/api/auth/register', [
'email' => 'not-an-email',
'password' => 'short',
]);
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
self::assertSame(422, $response->getStatusCode());
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
$body = $this->decode($response);
self::assertArrayHasKey('email', $body['error']['details']);
self::assertArrayHasKey('password', $body['error']['details']);
}
public function test_login_succeeds_with_correct_password(): void
{
$this->request('POST', '/api/auth/register', [
'email' => 'grace@example.com',
'password' => 'password123',
]);
$response = $this->request('POST', '/api/auth/login', [
'email' => 'grace@example.com',
'password' => 'password123',
]);
self::assertSame(200, $response->getStatusCode());
self::assertNotEmpty($this->decode($response)['token']);
}
public function test_login_fails_with_wrong_password(): void
{
$this->request('POST', '/api/auth/register', [
'email' => 'grace@example.com',
'password' => 'password123',
]);
$response = $this->request('POST', '/api/auth/login', [
'email' => 'grace@example.com',
'password' => 'wrong-password',
]);
self::assertSame(401, $response->getStatusCode());
self::assertSame(202, $response->getStatusCode());
self::assertCount(1, $this->sentEmails());
}
public function test_me_requires_a_valid_token(): void
@@ -84,12 +74,7 @@ final class AuthTest extends ApiTestCase
$unauthorised = $this->request('GET', '/api/me');
self::assertSame(401, $unauthorised->getStatusCode());
$token = $this->decode($this->request('POST', '/api/auth/register', [
'email' => 'linus@example.com',
'password' => 'password123',
]))['token'];
$response = $this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $token]);
$response = $this->request('GET', '/api/me', null, $this->authHeader('linus@example.com'));
self::assertSame(200, $response->getStatusCode());
self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
tests/EmailVerificationTest.php
+31 -119
View File
@@ -6,9 +6,9 @@ namespace Tests;
final class EmailVerificationTest extends ApiTestCase
{
public function test_registration_sends_a_verification_email(): void
public function test_the_magic_link_email_contains_a_verify_link(): void
{
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
$email = $this->lastEmail();
self::assertSame('ada@example.com', $email['to']);
@@ -16,21 +16,6 @@ final class EmailVerificationTest extends ApiTestCase
self::assertStringContainsString('https://app.test/verify-email?token=', $email['body']);
}
public function test_opening_the_magic_link_verifies_and_logs_in(): void
{
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$response = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
self::assertSame(200, $response->getStatusCode());
$body = $this->decode($response);
self::assertTrue($body['user']['email_verified']);
self::assertNotEmpty($body['token']);
$me = $this->decode($this->request('GET', '/api/me', null, ['Authorization' => 'Bearer ' . $body['token']]));
self::assertTrue($me['user']['email_verified']);
}
public function test_an_invalid_token_is_rejected(): void
{
$response = $this->request('POST', '/api/auth/verify-email', ['token' => 'not-a-real-token']);
@@ -39,7 +24,7 @@ final class EmailVerificationTest extends ApiTestCase
public function test_a_token_cannot_be_used_twice(): void
{
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
$token = $this->tokenFromEmail();
self::assertSame(200, $this->request('POST', '/api/auth/verify-email', ['token' => $token])->getStatusCode());
@@ -51,7 +36,7 @@ final class EmailVerificationTest extends ApiTestCase
public function test_an_expired_token_is_rejected(): void
{
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
$token = $this->tokenFromEmail();
$this->db()->prepare('UPDATE email_verifications SET expires_at = :past WHERE token_hash = :hash')->execute([
@@ -64,94 +49,15 @@ final class EmailVerificationTest extends ApiTestCase
self::assertStringContainsString('expired', $this->decode($response)['error']['message']);
}
public function test_resend_is_throttled_immediately_after_registration(): void
public function test_a_fresh_link_can_be_requested_once_the_interval_has_passed(): void
{
$auth = $this->authHeader('ada@example.com');
$response = $this->request('POST', '/api/email/verification', null, $auth);
self::assertSame(429, $response->getStatusCode());
self::assertArrayHasKey('retry_after', $this->decode($response)['error']['details']);
}
public function test_resend_works_once_the_interval_has_passed(): void
{
$auth = $this->authHeader('ada@example.com');
$this->cooldownElapsed('ada@example.com');
$response = $this->request('POST', '/api/email/verification', null, $auth);
self::assertSame(202, $response->getStatusCode());
self::assertCount(2, $this->sentEmails());
self::assertSame('ada@example.com', $this->lastEmail()['to']);
}
public function test_resend_conflicts_when_already_verified(): void
{
$auth = $this->authHeader('ada@example.com');
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
$this->cooldownElapsed('ada@example.com');
$response = $this->request('POST', '/api/email/verification', null, $auth);
self::assertSame(409, $response->getStatusCode());
}
public function test_magic_link_login_emails_a_link_that_signs_the_user_in(): void
{
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$this->cooldownElapsed('ada@example.com');
$requested = $this->request('POST', '/api/auth/magic-link', ['email' => 'ADA@example.com']);
self::assertSame(202, $requested->getStatusCode());
$login = $this->lastEmail();
self::assertSame('ada@example.com', $login['to']);
self::assertSame('Your login link', $login['subject']);
$session = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail($login)]);
self::assertSame(200, $session->getStatusCode());
$body = $this->decode($session);
self::assertSame('ada@example.com', $body['user']['email']);
self::assertTrue($body['user']['email_verified']);
self::assertNotEmpty($body['token']);
}
public function test_magic_link_login_verifies_an_unverified_account(): void
{
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$this->cooldownElapsed('ada@example.com');
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
$body = $this->decode(
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
);
self::assertTrue($body['user']['email_verified']);
}
public function test_magic_link_login_is_silent_for_an_unknown_address(): void
{
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'nobody@example.com']);
self::assertSame(202, $response->getStatusCode());
self::assertSame([], $this->sentEmails());
}
public function test_magic_link_login_does_not_resend_within_the_interval(): void
{
// Registration already sent a verification email moments ago.
$this->request('POST', '/api/auth/register', ['email' => 'ada@example.com', 'password' => 'password123']);
$this->cooldownElapsed('ada@example.com');
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
self::assertSame(202, $response->getStatusCode());
self::assertCount(1, $this->sentEmails()); // still just the registration email
}
public function test_magic_link_login_validates_the_address(): void
{
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'not-an-email']);
self::assertSame(422, $response->getStatusCode());
self::assertCount(2, $this->sentEmails());
}
public function test_email_change_is_deferred_until_the_new_address_is_confirmed(): void
@@ -159,10 +65,7 @@ final class EmailVerificationTest extends ApiTestCase
$auth = $this->authHeader('old@example.com');
$this->cooldownElapsed('old@example.com');
$change = $this->request('POST', '/api/email/change', [
'email' => 'New@example.com',
'password' => 'password123',
], $auth);
$change = $this->request('POST', '/api/email/change', ['email' => 'New@example.com'], $auth);
self::assertSame(202, $change->getStatusCode());
self::assertSame('new@example.com', $this->decode($change)['pending_email']);
@@ -182,18 +85,21 @@ final class EmailVerificationTest extends ApiTestCase
self::assertNull($body['user']['pending_email']);
}
public function test_email_change_requires_the_current_password(): void
public function test_email_change_requires_authentication(): void
{
$response = $this->request('POST', '/api/email/change', ['email' => 'new@example.com']);
self::assertSame(401, $response->getStatusCode());
}
public function test_email_change_validates_the_new_address(): void
{
$auth = $this->authHeader('old@example.com');
$this->cooldownElapsed('old@example.com');
$response = $this->request('POST', '/api/email/change', [
'email' => 'new@example.com',
'password' => 'wrong-password',
], $auth);
$response = $this->request('POST', '/api/email/change', ['email' => 'not-an-email'], $auth);
self::assertSame(422, $response->getStatusCode());
self::assertArrayHasKey('password', $this->decode($response)['error']['details']);
self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
}
public function test_email_change_rejects_an_address_already_in_use(): void
@@ -202,10 +108,7 @@ final class EmailVerificationTest extends ApiTestCase
$auth = $this->authHeader('mine@example.com');
$this->cooldownElapsed('mine@example.com');
$response = $this->request('POST', '/api/email/change', [
'email' => 'taken@example.com',
'password' => 'password123',
], $auth);
$response = $this->request('POST', '/api/email/change', ['email' => 'taken@example.com'], $auth);
self::assertSame(409, $response->getStatusCode());
}
@@ -215,15 +118,24 @@ final class EmailVerificationTest extends ApiTestCase
$auth = $this->authHeader('same@example.com');
$this->cooldownElapsed('same@example.com');
$response = $this->request('POST', '/api/email/change', [
'email' => 'same@example.com',
'password' => 'password123',
], $auth);
$response = $this->request('POST', '/api/email/change', ['email' => 'same@example.com'], $auth);
self::assertSame(422, $response->getStatusCode());
self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
}
public function test_email_change_is_throttled_immediately_after_signing_in(): void
{
// authHeader() just sent this user a magic link, so the resend window
// (shared with /email/change) hasn't elapsed yet.
$auth = $this->authHeader('throttle@example.com');
$response = $this->request('POST', '/api/email/change', ['email' => 'new@example.com'], $auth);
self::assertSame(429, $response->getStatusCode());
self::assertArrayHasKey('retry_after', $this->decode($response)['error']['details']);
}
/** Push the user's last-sent timestamp far enough back to clear the throttle. */
private function cooldownElapsed(string $email): void
{