boba/LoVisual
1
0
Fork 0
Code Issues Pull requests Releases 1 Wiki Activity Actions

feat(accounts): outgoing mail over SMTP (Resend), email verification, fail-closed password reset

Browse source 
- mail/ module (lettre, ru/en templates), links built only from PUBLIC_BASE_URL
- migration 0006: accounts.email_verified_at, shared email_tokens table (verify + reset), existing accounts marked verified
- reset mailer no longer logs tokens; RESET_MAIL_MODE=log is dev-only and refused with COOKIE_SECURE=true; Disabled by default answers 503
- forgot-password and resend-verification do their work in a background task (no timing oracle)
- device linking requires a verified email; email_verified exposed via /me and gRPC
- gateway rate limits, SMTP_* in compose and .env.example
- frontend: verify, forgot-password, reset-password pages, verify banner, ru/en strings
This commit is contained in:
loki5512344 2026-10-09 21:08:33 +02:00
parent 12ce6216b6
commit c57f851a8b
Signed by: boba
GPG key ID: 253067914055423B
48 changed files with 1810 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

2
backend/accounts-service/tests/device_flow.rs
View file

@ -15,6 +15,7 @@ async fn full_device_link_flow() {
&common::test_config(),
));
let (account_id, email) = common::register_account(&server).await;
common::mark_verified(&pool, account_id).await;
let code_response: serde_json::Value = server.post("/device/code").await.json();
let device_code = code_response["device_code"].as_str().unwrap();
@ -82,6 +83,7 @@ async fn unknown_device_code_and_user_code_return_404() {
&common::test_config(),
));
let (account_id, email) = common::register_account(&server).await;
common::mark_verified(&pool, account_id).await;
server
.post("/device/token")