aneurinandClaude Sonnet 5
f9b65cc4a7
Backend - New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail() (the default fallback), and log-to-file transports, selected by MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token and sends the link (APP_URL/verify-email?token=...). - Migration 005: email_verifications table + users.verification_email_sent_at. - Registration now emails a verification link (best effort — a send failure doesn't fail registration). - POST /api/auth/verify-email consumes a token and returns a session, so opening the link verifies the address (or applies a pending email change) and logs the user in. Single-use; distinct 400s for invalid/used/expired. - POST /api/email/verification resends; POST /api/email/change requests a deferred change (current password required; link goes to the new address; users.email only updates when that link is opened). Both throttled to once per 60s, returning 429 + retry_after. - GET /api/me and every session payload now include pending_email. Shared SessionPayload builds the user/session JSON for all entry points. Frontend - /verify-email view: posts the token, adopts the returned session, redirects. - /profile view: shows address + status, a resend button with a live cooldown (driven by retry_after / 429), and a change-email form (new address + current password) that surfaces the pending change. - Header shows a "verify email" badge linking to the profile. Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle, and deferred change; AuthTest folded into ApiTestCase, which now routes mail to a per-test log. Suite: 32 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
41 lines
1.4 KiB
Bash
41 lines
1.4 KiB
Bash
# Copy to .env and adjust as needed. All values are optional and have sane
|
|
# development defaults (see src/Support/Config.php).
|
|
|
|
# Show full exception details in API error responses. Never enable in production.
|
|
APP_DEBUG=false
|
|
|
|
# Directory for generated files: the SQLite database and the JWT signing key.
|
|
# Defaults to <project>/storage. The Docker setup points this at a volume
|
|
# outside the bind-mounted source.
|
|
STORAGE_PATH=storage
|
|
|
|
# Path to the SQLite database file (absolute, or relative to the project root).
|
|
# Defaults to <STORAGE_PATH>/database.sqlite.
|
|
DATABASE_PATH=storage/database.sqlite
|
|
|
|
# Secret used to sign JWTs. Leave blank to auto-generate one into storage/secret.key.
|
|
JWT_SECRET=
|
|
|
|
# How long an issued token stays valid, in seconds (default: 86400 = 24h).
|
|
JWT_TTL=86400
|
|
|
|
# Base URL of the frontend. Verification magic links point here, e.g.
|
|
# <APP_URL>/verify-email?token=... (default: http://localhost:5173).
|
|
APP_URL=http://localhost:5173
|
|
|
|
# Email delivery.
|
|
# mail — PHP's built-in mail() function (default)
|
|
# smtp — the SMTP server configured below
|
|
# log — append messages to MAIL_LOG_PATH instead of sending (dev/test)
|
|
MAIL_TRANSPORT=mail
|
|
MAIL_FROM=no-reply@localhost
|
|
MAIL_FROM_NAME=Todo List
|
|
MAIL_LOG_PATH=storage/mail.log
|
|
|
|
# Only used when MAIL_TRANSPORT=smtp.
|
|
MAIL_SMTP_HOST=
|
|
MAIL_SMTP_PORT=587
|
|
MAIL_SMTP_USERNAME=
|
|
MAIL_SMTP_PASSWORD=
|
|
MAIL_SMTP_ENCRYPTION=tls # tls | ssl | none
|