aneurinandClaude Sonnet 5
c82bdbbf0e
There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.
Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
(race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
authenticated and unverified); requestChange() drops the password check,
now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
all gone.
Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.
Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.
Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
60 lines
1.6 KiB
TypeScript
60 lines
1.6 KiB
TypeScript
import { createRouter, createWebHistory } from 'vue-router'
|
|
import { useAuthStore } from '../stores/auth'
|
|
|
|
const router = createRouter({
|
|
history: createWebHistory(import.meta.env.BASE_URL),
|
|
routes: [
|
|
{ path: '/', redirect: { name: 'dashboard' } },
|
|
{
|
|
path: '/dashboard',
|
|
name: 'dashboard',
|
|
component: () => import('../views/DashboardView.vue'),
|
|
meta: { requiresAuth: true, wide: true },
|
|
},
|
|
{
|
|
path: '/projects/:id(\\d+)',
|
|
name: 'project',
|
|
component: () => import('../views/ProjectView.vue'),
|
|
meta: { requiresAuth: true, wide: true },
|
|
},
|
|
{
|
|
path: '/profile',
|
|
name: 'profile',
|
|
component: () => import('../views/ProfileView.vue'),
|
|
meta: { requiresAuth: true },
|
|
},
|
|
{
|
|
// Magic-link target. Works signed in or out — verifying returns a session.
|
|
path: '/verify-email',
|
|
name: 'verify-email',
|
|
component: () => import('../views/VerifyEmailView.vue'),
|
|
},
|
|
{
|
|
path: '/login',
|
|
name: 'login',
|
|
component: () => import('../views/LoginView.vue'),
|
|
meta: { guestOnly: true },
|
|
},
|
|
{ path: '/:pathMatch(.*)*', redirect: { name: 'dashboard' } },
|
|
],
|
|
})
|
|
|
|
const DEFAULT_PATHS = new Set(['/', '/dashboard'])
|
|
|
|
router.beforeEach((to) => {
|
|
const auth = useAuthStore()
|
|
|
|
if (to.meta.requiresAuth && !auth.isAuthenticated) {
|
|
return {
|
|
name: 'login',
|
|
query: DEFAULT_PATHS.has(to.path) ? {} : { redirect: to.fullPath },
|
|
}
|
|
}
|
|
|
|
if (to.meta.guestOnly && auth.isAuthenticated) {
|
|
return { name: 'dashboard' }
|
|
}
|
|
})
|
|
|
|
export default router
|