Repository navigation
feat(auth): self-registration with email verification (v0.6.2) - #92
Merged
Merged
Conversation
rant 2026-08-19T14:36:19: 支持用户自助注册 — POST /api/auth/register + 登录页注册入口（方案 B 完整验证码）。 - POST /api/auth/register: 邮箱格式 + 密码≥8 校验；email 已存在 409；创建未验证用户 (verified=0, role=user) + 6 位数字验证码（10 分钟有效，sha256 存储，5 次错误失效） - POST /api/auth/verify: 校验验证码 → 激活用户 + 建 quotas(0) - POST /api/auth/resend-code: 60 秒重发限频 - login: 未验证邮箱 403「邮箱未验证」 - [mail] 配置段（lettre SMTP STARTTLS）；未配置 → dev 模式验证码打日志/响应 - users.verified 迁移 v6（默认 1：存量用户视为已信任，升级不锁号） - UI: 登录页注册表单 + 验证码页（中英 i18n + ERR_MAP） - README 快速上手 §④ 注册账号 + [mail] 说明 - 111/111 tests + clippy + fmt + node check + live smoke 全过
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rant 2026-08-19T14:36:19: 支持用户自助注册 — POST /api/auth/register + 登录页注册入口（宿主选方案 B 完整验证码）。
Self-service registration for regular users (previously only the bootstrap admin existed, with no registration endpoint).
Changes
POST /api/auth/register: email format + password ≥8 validation; 409 if email taken; creates unverified user (verified=0, role=user) + 6-digit numeric code (10 min validity, sha256 stored, 5 wrong attempts invalidates)POST /api/auth/verify: validates code → activates user (verified=1) + creates quotas(0)POST /api/auth/resend-code: 60s resend rate limitlogin: unverified email → 403 邮箱未验证[mail]config section (lettre SMTP STARTTLS, default 587); when unconfigured → dev mode: code logged + returned asdev_codein response (local testing); production must configure SMTPusers.verified(default 1 — existing users treated as trusted, no lockout on upgrade; registrations explicitly set 0) +email_verificationstableTests
cargo test: 111/111 (5 new: register→verify→login full flow incl. daily gift, duplicate 409, invalid input 400, wrong-code/expiry/attempt-limit, resend rate-limit)cargo fmt --checkcleancargo clippy --all-targets -- -D warningscleannode --checkon ui/js/*.jsChecklist