Wave 3b of PLAN-1933 turns ON Pad Cloud email/password self-registration
with mandatory email verification.
- DR-6: relax handleRegister to allow self-serve signup when
cloudMode && emailConfigured. emailConfigured = s.email != nil AND a
USABLE public base URL (non-empty, not a 0.0.0.0/:: bind-all host), so
no unverifiable user is ever created. Self-serve is the ONLY path that
writes email_verified_at = NULL (UserCreate.Unverified); admin-created
and invited signups stay verified. Mints + sends a verification email.
- DR-5: POST /auth/verify-email (ConsumeEmailVerification → flips
email_verified_at → returns fresh user) and POST /auth/resend-verification
(always-200, enumeration-safe; minting a new token invalidates the prior
one). Both wired into the rate-limiter path switch (PasswordReset bucket).
- DR-1: handleAcceptInvitation verifies an unverified account on accept
(email-bound invite proves email control), via new store method
SetUserEmailVerified.
- DR-11: keep the existing clear 409 on duplicate email at signup.
Session freshness: currentUser is re-read fresh from the DB per request
(ValidateSession → GetUser), so flipping email_verified_at unblocks the
same session's subsequent mutations immediately under RequireVerifiedEmail
(Wave 3a) — no session-row rewrite needed. Test covers verify → same-session
mutation succeeds.
Claude-Session: https://claude.ai/code/session_01HxBkAMiFBtCRJ2tKSCt3ST
xarmian
4a7c054223