Part of #2914 (one click from a stranger to their own forge).
Today a new account needs a passkey and an email (actions/users.ts, signupWithPasskey). The owner wants a stranger in with a username and a password, and no email needed.
Done when:
/signup and POST /api/v1/users take {username, password, email?} while signup is open (an invite forge still needs the invite). The password is hashed with Bun.password (argon2id), is at least 12 characters, and sign-in goes through verifyPasswordThrottled.
Email is optional and never required. When it is given, the existing verify mail goes out.
No open-platform, Forgejo or edge account is touched anywhere in the path. A test signs up and signs in on a forge with no FORGE_EDGE_* / origin configured.
A passkey stays offered beside the password. The comment saying password sign-in is going away (#1618) is updated to say it stays.
Tests: account made with neither passkey nor email signs in; short password refused; signup closed refuses; cross-origin POST refused.
Part of #2914 (one click from a stranger to their own forge).
Today a new account needs a passkey and an email (
actions/users.ts,signupWithPasskey). The owner wants a stranger in with a username and a password, and no email needed.Done when:
/signupandPOST /api/v1/userstake{username, password, email?}while signup isopen(aninviteforge still needs the invite). The password is hashed withBun.password(argon2id), is at least 12 characters, and sign-in goes throughverifyPasswordThrottled.FORGE_EDGE_*/ origin configured.closedrefuses; cross-origin POST refused.