aneurinandClaude Sonnet 5
f9b65cc4a7
Backend - New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail() (the default fallback), and log-to-file transports, selected by MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token and sends the link (APP_URL/verify-email?token=...). - Migration 005: email_verifications table + users.verification_email_sent_at. - Registration now emails a verification link (best effort — a send failure doesn't fail registration). - POST /api/auth/verify-email consumes a token and returns a session, so opening the link verifies the address (or applies a pending email change) and logs the user in. Single-use; distinct 400s for invalid/used/expired. - POST /api/email/verification resends; POST /api/email/change requests a deferred change (current password required; link goes to the new address; users.email only updates when that link is opened). Both throttled to once per 60s, returning 429 + retry_after. - GET /api/me and every session payload now include pending_email. Shared SessionPayload builds the user/session JSON for all entry points. Frontend - /verify-email view: posts the token, adopts the returned session, redirects. - /profile view: shows address + status, a resend button with a live cooldown (driven by retry_after / 429), and a change-email form (new address + current password) that surfaces the pending change. - Header shows a "verify email" badge linking to the profile. Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle, and deferred change; AuthTest folded into ApiTestCase, which now routes mail to a per-test log. Suite: 32 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
56 lines
2.0 KiB
YAML
56 lines
2.0 KiB
YAML
services:
|
|
app:
|
|
build: .
|
|
image: php-todo-list
|
|
ports:
|
|
- "8080:80"
|
|
environment:
|
|
APP_DEBUG: "${APP_DEBUG:-false}"
|
|
# Generated files (SQLite DB + JWT signing key) go here, on their own
|
|
# volume so they don't overlap the bind mount below.
|
|
STORAGE_PATH: /var/www/storage
|
|
# Leave blank to auto-generate a secret into the storage volume on first run.
|
|
JWT_SECRET: "${JWT_SECRET:-}"
|
|
JWT_TTL: "${JWT_TTL:-86400}"
|
|
# Magic links point at the frontend dev server.
|
|
APP_URL: "${APP_URL:-http://localhost:5173}"
|
|
# The container has no MTA, so log emails to a file by default. View them with:
|
|
# docker compose exec app cat /var/www/storage/mail.log
|
|
# Set to "smtp" (with MAIL_SMTP_*) or "mail" to actually send.
|
|
MAIL_TRANSPORT: "${MAIL_TRANSPORT:-log}"
|
|
MAIL_FROM: "${MAIL_FROM:-no-reply@localhost}"
|
|
MAIL_SMTP_HOST: "${MAIL_SMTP_HOST:-}"
|
|
MAIL_SMTP_PORT: "${MAIL_SMTP_PORT:-587}"
|
|
MAIL_SMTP_USERNAME: "${MAIL_SMTP_USERNAME:-}"
|
|
MAIL_SMTP_PASSWORD: "${MAIL_SMTP_PASSWORD:-}"
|
|
MAIL_SMTP_ENCRYPTION: "${MAIL_SMTP_ENCRYPTION:-tls}"
|
|
volumes:
|
|
# Live source: edit on the host, no image rebuild needed.
|
|
- .:/var/www/html
|
|
# Persistent storage, kept outside /var/www/html to avoid a nested mount.
|
|
- storage:/var/www/storage
|
|
restart: unless-stopped
|
|
|
|
# Optional Vite dev server. Start it with: docker compose --profile frontend up -d
|
|
# Without the profile, `docker compose up -d` runs the API alone.
|
|
web:
|
|
build: ./web
|
|
image: php-todo-web
|
|
profiles: ["frontend"]
|
|
ports:
|
|
- "5173:5173"
|
|
environment:
|
|
# /api is proxied to the API container on the compose network.
|
|
VITE_PROXY_TARGET: "http://app:80"
|
|
volumes:
|
|
- ./web:/app
|
|
# Keep the image's platform-specific node_modules; don't let the host's shadow them.
|
|
- web_node_modules:/app/node_modules
|
|
depends_on:
|
|
- app
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
storage:
|
|
web_node_modules:
|