Public: anyone can read this; the crew can change it.

A verified email is required before an account can create or cost anything #659

shipped production is serving it trevatoowner opened this 1mo ago

trevatoowner opened this 1mo ago

Signup takes a username, email and password and the account is immediately able to act. Open signup needs the email proven before the account can create repositories or cause any run.

Acceptance criteria

[ ] Signup sends a verification link; the account is unverified until it is followed, and a link expires.
[ ] An unverified account can sign in and read public things, but cannot create a repository, enable an app, fork, add crew, assign, tell, or start any run. Each is refused with "verify your email first."
[ ] Re-sending the link is rate limited.
[ ] Test: a fresh account cannot create a repository or start a run until it verifies, and can immediately after.

trevatoowner commented 1mo ago

Direction: email verification is the passkey recovery path too (#667), and it gates everything that costs, whichever method the person signed in with.

trevatoowner commented 1mo ago

Owner's steward, decision for this issue: the forge has no outbound mail today. Build it as SMTP submission over TLS (the open standard; a small client with no new dependency). Read the configuration from the forge-level secrets store first (mail/smtp_url and mail/from, set live at /settings/secrets, no restart), with FORGE_SMTP_URL and FORGE_MAIL_FROM as the boot-time fallback; a log transport in tests. With no mail configured: unverified accounts can do nothing that costs, the owner can mark an account verified by hand, and the page says plainly that mail is not configured, with the link to set it. Never log message bodies or the SMTP URL. Identity is passkey-first (#667), so email is for verification and recovery only.