Passwordless-only auth: drop registration and passwords entirely
There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.
Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
(race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
authenticated and unverified); requestChange() drops the password check,
now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
all gone.
Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.
Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.
Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
+24
-31
@@ -31,19 +31,17 @@ build app` from the parent directory.
|
||||
```
|
||||
src/main.ts App bootstrap; resolves the stored session before mount
|
||||
src/router/index.ts Routes + guard (redirects to /login when unauthenticated)
|
||||
src/stores/auth.ts Pinia store: token in localStorage, register/login/fetchMe
|
||||
src/stores/auth.ts Pinia store: token in localStorage, magic-link + fetchMe
|
||||
src/stores/projects.ts Pinia store: the user's projects (fetch + create)
|
||||
src/stores/cards.ts Pinia store: one project's cards (CRUD + reorderColumn)
|
||||
src/lib/api.ts fetch wrapper, bearer token, typed ApiError
|
||||
src/components/AppSidebar.vue left nav: Dashboard link, divider, project list + new-project form
|
||||
src/components/CardRow.vue editable text + status chip + delete, one card
|
||||
src/components/KanbanCard.vue small draggable card for the board columns
|
||||
src/views/ DashboardView, ProjectView, LoginView, RegisterView,
|
||||
ProfileView, VerifyEmailView
|
||||
src/views/ DashboardView, ProjectView, LoginView, ProfileView,
|
||||
VerifyEmailView
|
||||
```
|
||||
|
||||
## Layout
|
||||
|
||||
Signed-in "app" routes (`meta.requiresAuth`) render inside a persistent shell:
|
||||
the top bar, then a left **sidebar** (`AppSidebar.vue`) beside the routed view.
|
||||
The sidebar stays mounted across navigation — it holds a **Dashboard** link, a
|
||||
@@ -55,7 +53,7 @@ sidebar → project → project navigation always does a fresh load.
|
||||
`/` redirects to `/dashboard` (`DashboardView.vue`), a full-width grid of
|
||||
project cards — each shows the project name and, under a **New** heading, its
|
||||
inbox cards (`status_id === null`), fetched per project. Signed-out routes
|
||||
(`/login`, `/register`, `/verify-email`) render without the sidebar.
|
||||
(`/login`, `/verify-email`) render without the sidebar.
|
||||
|
||||
## Project detail
|
||||
|
||||
@@ -93,32 +91,27 @@ new cards have no status, so they land straight in it.
|
||||
|
||||
## Auth flow
|
||||
|
||||
- The token from register / login / opening a magic link is kept in
|
||||
`localStorage` and sent as `Authorization: Bearer …`.
|
||||
- On load, `fetchMe()` validates the stored token via `GET /api/me`; a failure
|
||||
clears it.
|
||||
There is no password and no separate sign-up — `LoginView` is just an email
|
||||
field and a "Send sign-in link" button (`POST /api/auth/magic-link`), for a new
|
||||
address or a returning one alike. On success it shows a "check your email"
|
||||
message; it does not sign the caller in itself.
|
||||
|
||||
- `/verify-email?token=…` is the target for every magic link (sign-in and
|
||||
email-change confirmation both). `VerifyEmailView` POSTs the token via
|
||||
`auth.verifyEmail()`, which returns a session — opening the link is what
|
||||
actually signs the caller in — then redirects to the dashboard.
|
||||
- The token is kept in `localStorage` and sent as `Authorization: Bearer …`.
|
||||
On load, `fetchMe()` validates it via `GET /api/me`; a failure clears it.
|
||||
- Routes with `meta.requiresAuth` redirect to `/login` (preserving the intended
|
||||
path) when there is no authenticated user.
|
||||
- Registration signs the user in immediately; the new account's email is
|
||||
unverified (`user.email_verified === false`). The header shows a "verify
|
||||
email" badge linking to `/profile`.
|
||||
- `LoginView` defaults to **magic link**: an email field and a "Log in with
|
||||
email" button that calls `POST /api/auth/magic-link`. A "Log in with password"
|
||||
link reveals the password field and switches the button to a plain "Log in"
|
||||
(`POST /api/auth/login`); the link then reads "Get a magic link" to switch
|
||||
back.
|
||||
- Because the only way to get a session is opening a link, `user.email_verified`
|
||||
is always `true` for a signed-in user — the frontend doesn't show any
|
||||
verification nagging or resend UI.
|
||||
|
||||
## Email verification & profile
|
||||
## Profile
|
||||
|
||||
- `/verify-email?token=…` is the target for every magic link (verification,
|
||||
passwordless login, email change). `VerifyEmailView` POSTs the token to the
|
||||
API, which returns a session — so opening any link both verifies the address
|
||||
and signs the user in — then redirects to the projects.
|
||||
- `/profile` (`ProfileView`) shows the address and verification status. When
|
||||
unverified it offers a **Resend** button; the API throttles to once a minute,
|
||||
and the button shows a live countdown (driven by `retry_after`, and by `429`
|
||||
responses).
|
||||
- The **Change email** form takes the new address and the current password.
|
||||
On success the API has emailed a confirmation link to the *new* address and
|
||||
set `user.pending_email`; the change only lands when that link is opened. The
|
||||
resend and change actions share the one-minute cooldown.
|
||||
`/profile` (`ProfileView`) shows the current address and a **Change email**
|
||||
form (new address only, no password). On success the API has emailed a
|
||||
confirmation link to the *new* address and set `user.pending_email` (shown as a
|
||||
notice until it's opened); the change only lands once that link is opened. The
|
||||
button shows a live countdown driven by `retry_after` and by `429` responses.
|
||||
|
||||
Reference in New Issue
Block a user