aneurinandClaude Sonnet 5
c82bdbbf0e
There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.
Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
(race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
authenticated and unverified); requestChange() drops the password check,
now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
all gone.
Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.
Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.
Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
83 lines
3.2 KiB
PHP
83 lines
3.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests;
|
|
|
|
/**
|
|
* There is no register/login pair -- POST /api/auth/magic-link is the only way
|
|
* in, for both a brand-new address and a returning one.
|
|
*/
|
|
final class AuthTest extends ApiTestCase
|
|
{
|
|
public function test_a_magic_link_request_always_responds_202(): void
|
|
{
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
self::assertSame(202, $response->getStatusCode());
|
|
}
|
|
|
|
public function test_a_magic_link_request_validates_the_address(): void
|
|
{
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'not-an-email']);
|
|
|
|
self::assertSame(422, $response->getStatusCode());
|
|
self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
|
|
}
|
|
|
|
public function test_opening_the_link_creates_the_account_and_signs_in(): void
|
|
{
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'Ada@example.com']);
|
|
|
|
$response = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
$body = $this->decode($response);
|
|
self::assertSame('ada@example.com', $body['user']['email']);
|
|
self::assertTrue($body['user']['email_verified']);
|
|
self::assertNotNull($body['user']['email_verified_at']);
|
|
self::assertNull($body['user']['pending_email']);
|
|
self::assertArrayNotHasKey('password', $body['user']);
|
|
self::assertArrayNotHasKey('password_hash', $body['user']);
|
|
self::assertNotEmpty($body['token']);
|
|
}
|
|
|
|
public function test_a_second_request_signs_in_the_same_account(): void
|
|
{
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
$firstId = $this->decode(
|
|
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
|
|
)['user']['id'];
|
|
|
|
$this->db()->prepare('UPDATE users SET verification_email_sent_at = NULL WHERE email = :e')
|
|
->execute(['e' => 'ada@example.com']);
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ADA@EXAMPLE.COM']);
|
|
$secondId = $this->decode(
|
|
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
|
|
)['user']['id'];
|
|
|
|
self::assertSame($firstId, $secondId);
|
|
}
|
|
|
|
public function test_the_link_is_not_sent_again_within_the_resend_interval(): void
|
|
{
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
self::assertSame(202, $response->getStatusCode());
|
|
self::assertCount(1, $this->sentEmails());
|
|
}
|
|
|
|
public function test_me_requires_a_valid_token(): void
|
|
{
|
|
$unauthorised = $this->request('GET', '/api/me');
|
|
self::assertSame(401, $unauthorised->getStatusCode());
|
|
|
|
$response = $this->request('GET', '/api/me', null, $this->authHeader('linus@example.com'));
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
|
|
}
|
|
}
|