Passwordless-only auth: drop registration and passwords entirely

There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.

Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
  (race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
  find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
  authenticated and unverified); requestChange() drops the password check,
  now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
  resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
  all gone.

Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
  RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
  requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
  leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
  unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.

Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.

Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/README.md

@@ -31,19 +31,17 @@ build app` from the parent directory.
 ```
 src/main.ts             App bootstrap; resolves the stored session before mount
 src/router/index.ts     Routes + guard (redirects to /login when unauthenticated)
-src/stores/auth.ts      Pinia store: token in localStorage, register/login/fetchMe
+src/stores/auth.ts      Pinia store: token in localStorage, magic-link + fetchMe
 src/stores/projects.ts  Pinia store: the user's projects (fetch + create)
 src/stores/cards.ts     Pinia store: one project's cards (CRUD + reorderColumn)
 src/lib/api.ts          fetch wrapper, bearer token, typed ApiError
 src/components/AppSidebar.vue left nav: Dashboard link, divider, project list + new-project form
 src/components/CardRow.vue    editable text + status chip + delete, one card
 src/components/KanbanCard.vue small draggable card for the board columns
-src/views/              DashboardView, ProjectView, LoginView, RegisterView,
-                        ProfileView, VerifyEmailView
+src/views/              DashboardView, ProjectView, LoginView, ProfileView,
+                        VerifyEmailView
 ```
 
-## Layout
-
 Signed-in "app" routes (`meta.requiresAuth`) render inside a persistent shell:
 the top bar, then a left **sidebar** (`AppSidebar.vue`) beside the routed view.
 The sidebar stays mounted across navigation — it holds a **Dashboard** link, a
@@ -55,7 +53,7 @@ sidebar → project → project navigation always does a fresh load.
 `/` redirects to `/dashboard` (`DashboardView.vue`), a full-width grid of
 project cards — each shows the project name and, under a **New** heading, its
 inbox cards (`status_id === null`), fetched per project. Signed-out routes
-(`/login`, `/register`, `/verify-email`) render without the sidebar.
+(`/login`, `/verify-email`) render without the sidebar.
 
 ## Project detail
 
@@ -93,32 +91,27 @@ new cards have no status, so they land straight in it.
 
 ## Auth flow
 
-- The token from register / login / opening a magic link is kept in
-  `localStorage` and sent as `Authorization: Bearer …`.
-- On load, `fetchMe()` validates the stored token via `GET /api/me`; a failure
-  clears it.
+There is no password and no separate sign-up — `LoginView` is just an email
+field and a "Send sign-in link" button (`POST /api/auth/magic-link`), for a new
+address or a returning one alike. On success it shows a "check your email"
+message; it does not sign the caller in itself.
+
+- `/verify-email?token=…` is the target for every magic link (sign-in and
+  email-change confirmation both). `VerifyEmailView` POSTs the token via
+  `auth.verifyEmail()`, which returns a session — opening the link is what
+  actually signs the caller in — then redirects to the dashboard.
+- The token is kept in `localStorage` and sent as `Authorization: Bearer …`.
+  On load, `fetchMe()` validates it via `GET /api/me`; a failure clears it.
 - Routes with `meta.requiresAuth` redirect to `/login` (preserving the intended
   path) when there is no authenticated user.
-- Registration signs the user in immediately; the new account's email is
-  unverified (`user.email_verified === false`). The header shows a "verify
-  email" badge linking to `/profile`.
-- `LoginView` defaults to **magic link**: an email field and a "Log in with
-  email" button that calls `POST /api/auth/magic-link`. A "Log in with password"
-  link reveals the password field and switches the button to a plain "Log in"
-  (`POST /api/auth/login`); the link then reads "Get a magic link" to switch
-  back.
+- Because the only way to get a session is opening a link, `user.email_verified`
+  is always `true` for a signed-in user — the frontend doesn't show any
+  verification nagging or resend UI.
 
-## Email verification & profile
+## Profile
 
-- `/verify-email?token=…` is the target for every magic link (verification,
-  passwordless login, email change). `VerifyEmailView` POSTs the token to the
-  API, which returns a session — so opening any link both verifies the address
-  and signs the user in — then redirects to the projects.
-- `/profile` (`ProfileView`) shows the address and verification status. When
-  unverified it offers a **Resend** button; the API throttles to once a minute,
-  and the button shows a live countdown (driven by `retry_after`, and by `429`
-  responses).
-- The **Change email** form takes the new address and the current password.
-  On success the API has emailed a confirmation link to the *new* address and
-  set `user.pending_email`; the change only lands when that link is opened. The
-  resend and change actions share the one-minute cooldown.
+`/profile` (`ProfileView`) shows the current address and a **Change email**
+form (new address only, no password). On success the API has emailed a
+confirmation link to the *new* address and set `user.pending_email` (shown as a
+notice until it's opened); the change only lands once that link is opened. The
+button shows a live countdown driven by `retry_after` and by `429` responses.

web/src/App.vue

@@ -30,9 +30,6 @@ async function onLogout() {
       <span class="app__brand">Projects</span>
 
       <div v-if="auth.isAuthenticated" class="app__account">
-        <RouterLink v-if="!auth.emailVerified" to="/profile" class="badge badge--warn">
-          verify email
-        </RouterLink>
         <RouterLink to="/profile" class="app__email">{{ auth.user?.email }}</RouterLink>
         <button type="button" class="link" @click="onLogout">Log out</button>
       </div>

web/src/router/index.ts

@@ -35,12 +35,6 @@ const router = createRouter({
       component: () => import('../views/LoginView.vue'),
       meta: { guestOnly: true },
     },
-    {
-      path: '/register',
-      name: 'register',
-      component: () => import('../views/RegisterView.vue'),
-      meta: { guestOnly: true },
-    },
     { path: '/:pathMatch(.*)*', redirect: { name: 'dashboard' } },
   ],
 })

web/src/stores/auth.ts

@@ -22,7 +22,6 @@ export const useAuthStore = defineStore('auth', () => {
   setAuthToken(token.value)
 
   const isAuthenticated = computed(() => token.value !== null && user.value !== null)
-  const emailVerified = computed(() => user.value?.email_verified ?? false)
 
   function setToken(value: string | null): void {
     token.value = value
@@ -40,35 +39,20 @@ export const useAuthStore = defineStore('auth', () => {
     user.value = response.user
   }
 
-  async function register(email: string, password: string): Promise<void> {
-    adopt(
-      await apiRequest<AuthResponse>('/auth/register', {
-        method: 'POST',
-        body: { email, password },
-      }),
-    )
-  }
-
-  async function login(email: string, password: string): Promise<void> {
-    adopt(
-      await apiRequest<AuthResponse>('/auth/login', {
-        method: 'POST',
-        body: { email, password },
-      }),
-    )
-  }
-
   function logout(): void {
     setToken(null)
     user.value = null
   }
 
-  /** Ask for a passwordless login link to be emailed. */
+  /**
+   * Ask for a sign-in link to be emailed. Creates the account first if this
+   * address is new — there is no separate registration step.
+   */
   async function requestLoginLink(email: string): Promise<void> {
     await apiRequest('/auth/magic-link', { method: 'POST', body: { email } })
   }
 
-  /** Verify an email address from a magic-link token; the response logs the user in. */
+  /** Consume a magic-link token; the response signs the user in. */
   async function verifyEmail(magicToken: string): Promise<void> {
     adopt(
       await apiRequest<AuthResponse>('/auth/verify-email', {
@@ -78,24 +62,14 @@ export const useAuthStore = defineStore('auth', () => {
     )
   }
 
-  /** Resend the verification email. Returns the seconds to wait before the next request. */
-  async function resendVerification(): Promise<number> {
-    const { retry_after } = await apiRequest<{ retry_after: number }>('/email/verification', {
-      method: 'POST',
-      auth: true,
-    })
-    return retry_after
-  }
-
   /** Request a deferred email change. Returns the pending address and cooldown. */
   async function requestEmailChange(
     email: string,
-    password: string,
   ): Promise<{ pending_email: string; retry_after: number }> {
     const result = await apiRequest<{ pending_email: string; retry_after: number }>('/email/change', {
       method: 'POST',
       auth: true,
-      body: { email, password },
+      body: { email },
     })
     await fetchMe() // pick up user.pending_email
     return result
@@ -121,14 +95,10 @@ export const useAuthStore = defineStore('auth', () => {
     user,
     loading,
     isAuthenticated,
-    emailVerified,
-    register,
-    login,
     logout,
     fetchMe,
     requestLoginLink,
     verifyEmail,
-    resendVerification,
     requestEmailChange,
   }
 })

web/src/style.css

@@ -68,10 +68,6 @@ body {
   text-decoration: none;
 }
 
-a.badge {
-  text-decoration: none;
-}
-
 .app__body {
   display: flex;
   align-items: flex-start;
@@ -288,22 +284,6 @@ h1 {
   font-size: 0.85rem;
 }
 
-.badge {
-  padding: 0.1rem 0.45rem;
-  border-radius: 999px;
-  font-size: 0.75rem;
-  white-space: nowrap;
-  border: 1px solid var(--border);
-  background: var(--bg);
-  color: var(--muted);
-}
-
-.badge--warn {
-  border-color: var(--warn-border);
-  background: var(--warn-bg);
-  color: inherit;
-}
-
 /* --- project detail: cards ------------------------------------------ */
 
 .cards {

web/src/views/DashboardView.vue

@@ -2,11 +2,9 @@
 import { onMounted, ref } from 'vue'
 import { RouterLink } from 'vue-router'
 import { ApiError, apiRequest } from '../lib/api'
-import { useAuthStore } from '../stores/auth'
 import { useProjectsStore } from '../stores/projects'
 import type { Card } from '../types'
 
-const auth = useAuthStore()
 const projects = useProjectsStore()
 
 const loading = ref(true)
@@ -40,11 +38,6 @@ async function load() {
 
 <template>
   <div class="dashboard">
-    <div v-if="!auth.emailVerified" class="notice">
-      Your email address <strong>{{ auth.user?.email }}</strong> has not been
-      verified yet.
-    </div>
-
     <p v-if="loadError" class="form-error">{{ loadError }}</p>
     <p v-else-if="loading" class="muted">Loading…</p>
     <p v-else-if="projects.projects.length === 0" class="muted">

web/src/views/LoginView.vue

@@ -1,46 +1,21 @@
 <script setup lang="ts">
-import { computed, ref } from 'vue'
-import { useRoute, useRouter } from 'vue-router'
+import { ref } from 'vue'
 import { ApiError } from '../lib/api'
 import { useAuthStore } from '../stores/auth'
 
 const auth = useAuthStore()
-const router = useRouter()
-const route = useRoute()
 
-const mode = ref<'magic' | 'password'>('magic')
 const email = ref('')
-const password = ref('')
 const error = ref<ApiError | null>(null)
-const sentMessage = ref('')
+const sent = ref(false)
 const submitting = ref(false)
 
-const buttonLabel = computed(() => {
-  if (submitting.value) return mode.value === 'magic' ? 'Sending…' : 'Logging in…'
-  return mode.value === 'magic' ? 'Log in with email' : 'Log in'
-})
-
-function toggleMode() {
-  mode.value = mode.value === 'magic' ? 'password' : 'magic'
-  error.value = null
-  sentMessage.value = ''
-  password.value = ''
-}
-
 async function onSubmit() {
   submitting.value = true
   error.value = null
-  sentMessage.value = ''
   try {
-    if (mode.value === 'password') {
-      await auth.login(email.value, password.value)
-      const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
-      await router.push(redirect)
-    } else {
-      await auth.requestLoginLink(email.value)
-      sentMessage.value =
-        'If that address has an account, a login link is on its way. It expires in 15 minutes.'
-    }
+    await auth.requestLoginLink(email.value)
+    sent.value = true
   } catch (e) {
     error.value = e instanceof ApiError ? e : new ApiError('Something went wrong.', 0)
   } finally {
@@ -52,8 +27,19 @@ async function onSubmit() {
 <template>
   <section class="card">
     <h1>Log in</h1>
+    <p class="muted">
+      Enter your email and we'll send you a link to sign in — no password
+      needed. New here? The same link creates your account.
+    </p>
 
-    <form class="form" @submit.prevent="onSubmit">
+    <template v-if="sent">
+      <p>Check <strong>{{ email }}</strong> for a sign-in link. It expires in 15 minutes.</p>
+      <p class="muted">
+        <button type="button" class="link" @click="sent = false">Use a different address</button>
+      </p>
+    </template>
+
+    <form v-else class="form" @submit.prevent="onSubmit">
       <label>
         <span>Email</span>
         <input v-model="email" type="email" autocomplete="email" required />
@@ -62,30 +48,13 @@ async function onSubmit() {
         </small>
       </label>
 
-      <label v-if="mode === 'password'">
-        <span>Password</span>
-        <input v-model="password" type="password" autocomplete="current-password" required />
-        <small v-if="error?.fieldError('password')" class="field-error">
-          {{ error.fieldError('password') }}
-        </small>
-      </label>
-
       <p v-if="error && Object.keys(error.details).length === 0" class="form-error">
         {{ error.message }}
       </p>
-      <p v-if="sentMessage" class="muted">{{ sentMessage }}</p>
 
-      <button type="submit" :disabled="submitting">{{ buttonLabel }}</button>
-    </form>
-
-    <p class="muted">
-      <button type="button" class="link" @click="toggleMode">
-        {{ mode === 'magic' ? 'Log in with password' : 'Get a magic link' }}
+      <button type="submit" :disabled="submitting">
+        {{ submitting ? 'Sending…' : 'Send sign-in link' }}
       </button>
-    </p>
-
-    <p class="muted">
-      No account? <RouterLink to="/register">Create one</RouterLink>.
-    </p>
+    </form>
   </section>
 </template>

web/src/views/ProfileView.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, onBeforeUnmount, ref } from 'vue'
+import { onBeforeUnmount, ref } from 'vue'
 import { ApiError } from '../lib/api'
 import { useAuthStore } from '../stores/auth'
 
@@ -19,34 +19,8 @@ function startCooldown(seconds: number) {
 
 onBeforeUnmount(() => clearInterval(timer))
 
-// --- resend verification -------------------------------------------------
-const resending = ref(false)
-const resendMessage = ref('')
-const resendError = ref('')
-
-async function onResend() {
-  resending.value = true
-  resendMessage.value = ''
-  resendError.value = ''
-  try {
-    const retryAfter = await auth.resendVerification()
-    resendMessage.value = `Sent. Check ${auth.user?.email}.`
-    startCooldown(retryAfter)
-  } catch (e) {
-    if (e instanceof ApiError) {
-      resendError.value = e.message
-      if (e.status === 429) startCooldown(e.retryAfter ?? 60)
-    } else {
-      resendError.value = 'Could not send the email.'
-    }
-  } finally {
-    resending.value = false
-  }
-}
-
 // --- change email ------------------------------------------------------
 const newEmail = ref('')
-const password = ref('')
 const changing = ref(false)
 const changeMessage = ref('')
 const changeError = ref<ApiError | null>(null)
@@ -56,10 +30,9 @@ async function onChangeEmail() {
   changeMessage.value = ''
   changeError.value = null
   try {
-    const { pending_email, retry_after } = await auth.requestEmailChange(newEmail.value, password.value)
+    const { pending_email, retry_after } = await auth.requestEmailChange(newEmail.value)
     changeMessage.value = `Confirmation link sent to ${pending_email}. Your address changes once you open it.`
     newEmail.value = ''
-    password.value = ''
     startCooldown(retry_after)
   } catch (e) {
     changeError.value = e instanceof ApiError ? e : new ApiError('Could not request the change.', 0)
@@ -68,25 +41,14 @@ async function onChangeEmail() {
     changing.value = false
   }
 }
-
-const resendLabel = computed(() => {
-  if (resending.value) return 'Sending…'
-  if (cooldown.value > 0) return `Resend in ${cooldown.value}s`
-  return 'Resend verification email'
-})
 </script>
 
 <template>
   <section class="card">
-    <p><RouterLink to="/">&larr; Back to lists</RouterLink></p>
+    <p><RouterLink to="/">&larr; Dashboard</RouterLink></p>
     <h1>Your profile</h1>
 
     <p><strong>Email:</strong> {{ auth.user?.email }}</p>
-    <p>
-      <strong>Status:</strong>
-      <span v-if="auth.emailVerified">verified</span>
-      <span v-else class="badge badge--warn">not verified</span>
-    </p>
 
     <div v-if="auth.user?.pending_email" class="notice">
       A change to <strong>{{ auth.user.pending_email }}</strong> is pending. Open the
@@ -94,21 +56,12 @@ const resendLabel = computed(() => {
       after it was sent.
     </div>
 
-    <section v-if="!auth.emailVerified">
-      <h2>Verify your email</h2>
-      <p class="muted">
-        We sent a link to {{ auth.user?.email }}. It expires 15 minutes after
-        it's sent. You can resend it once a minute.
-      </p>
-      <button type="button" :disabled="resending || cooldown > 0" @click="onResend">
-        {{ resendLabel }}
-      </button>
-      <p v-if="resendMessage" class="muted">{{ resendMessage }}</p>
-      <p v-if="resendError" class="form-error">{{ resendError }}</p>
-    </section>
-
     <section>
       <h2>Change email address</h2>
+      <p class="muted">
+        We'll email a confirmation link to the new address; the change only
+        takes effect once you open it.
+      </p>
       <form class="form" @submit.prevent="onChangeEmail">
         <label>
           <span>New email</span>
@@ -117,13 +70,6 @@ const resendLabel = computed(() => {
             {{ changeError.fieldError('email') }}
           </small>
         </label>
-        <label>
-          <span>Current password</span>
-          <input v-model="password" type="password" autocomplete="current-password" required />
-          <small v-if="changeError?.fieldError('password')" class="field-error">
-            {{ changeError.fieldError('password') }}
-          </small>
-        </label>
 
         <p v-if="changeError && Object.keys(changeError.details).length === 0" class="form-error">
           {{ changeError.message }}

web/src/views/RegisterView.vue

@@ -1,75 +0,0 @@
-<script setup lang="ts">
-import { ref } from 'vue'
-import { useRouter } from 'vue-router'
-import { ApiError } from '../lib/api'
-import { useAuthStore } from '../stores/auth'
-
-const auth = useAuthStore()
-const router = useRouter()
-
-const email = ref('')
-const password = ref('')
-const error = ref<ApiError | null>(null)
-const submitting = ref(false)
-
-async function onSubmit() {
-  submitting.value = true
-  error.value = null
-  try {
-    await auth.register(email.value, password.value)
-    // Registration signs the user straight in (with an unverified email).
-    await router.push('/')
-  } catch (e) {
-    error.value = e instanceof ApiError ? e : new ApiError('Something went wrong.', 0)
-  } finally {
-    submitting.value = false
-  }
-}
-</script>
-
-<template>
-  <section class="card">
-    <h1>Create an account</h1>
-    <p class="muted">
-      You will be signed in immediately. Your email address starts out
-      unverified.
-    </p>
-
-    <form class="form" @submit.prevent="onSubmit">
-      <label>
-        <span>Email</span>
-        <input v-model="email" type="email" autocomplete="email" required />
-        <small v-if="error?.fieldError('email')" class="field-error">
-          {{ error.fieldError('email') }}
-        </small>
-      </label>
-
-      <label>
-        <span>Password</span>
-        <input
-          v-model="password"
-          type="password"
-          autocomplete="new-password"
-          minlength="8"
-          required
-        />
-        <small v-if="error?.fieldError('password')" class="field-error">
-          {{ error.fieldError('password') }}
-        </small>
-        <small v-else class="hint">At least 8 characters.</small>
-      </label>
-
-      <p v-if="error && Object.keys(error.details).length === 0" class="form-error">
-        {{ error.message }}
-      </p>
-
-      <button type="submit" :disabled="submitting">
-        {{ submitting ? 'Creating…' : 'Create account' }}
-      </button>
-    </form>
-
-    <p class="muted">
-      Already registered? <RouterLink to="/login">Log in</RouterLink>.
-    </p>
-  </section>
-</template>

web/src/views/VerifyEmailView.vue

@@ -37,17 +37,15 @@ onMounted(async () => {
     <p v-if="state === 'working'" class="muted">One moment…</p>
 
     <template v-else-if="state === 'done'">
-      <p>You're signed in. Your email address is verified.</p>
-      <p class="muted">Taking you to your lists…</p>
+      <p>You're signed in.</p>
+      <p class="muted">Taking you to your dashboard…</p>
       <RouterLink to="/">Go now</RouterLink>
     </template>
 
     <template v-else>
       <p class="form-error">{{ message }}</p>
       <p class="muted">
-        Request a fresh link from your
-        <RouterLink to="/profile">profile</RouterLink>, or
-        <RouterLink to="/login">log in</RouterLink>.
+        <RouterLink to="/login">Request a fresh link</RouterLink>.
       </p>
     </template>
   </section>