3.3 KiB
Email accounts
/account offers registration, password login, email verification/resend, password
recovery, and logout.
/api/account/session returns the current account; other actions use same-origin POST.
Passwords require at least 12 characters and at most 256 UTF-8 bytes. Only verified
accounts can log in. Verification links expire after 30 minutes and are consumed once.
Session tokens expire after seven days; logout deletes the current token immediately.
Only token SHA-256 digests are stored. Passwords use individually salted scrypt.
Runtime configuration
Use the environment example and the root README to configure the Web, bootstrap, and worker processes. The repository no longer supplies CI/CD or Compose deployment configuration. Keep SMTP_PASSWORD and other credentials in the process environment or an operator-managed private file with restricted permissions, outside the repository. Do not put credentials in command arguments, logs, or chat.
Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and configure SMTP_HOST, SMTP_PORT, SMTP_USERNAME, SMTP_FROM, and SMTP_PASSWORD for the mail provider. TLS certificate validation stays enabled. Missing SMTP configuration returns a generic service failure; resend with the registration password can recover an account whose initial delivery failed.
Keep AUTH_CONFIG_FILE configured for administrator access. Missing administrator configuration fails closed. AUTH_DISABLED_FOR_TESTS is false by default and is enabled only for an explicitly isolated test environment; never enable it in production. Email account cookies never satisfy administrator authorization. With the current HTTP runtime origin use AUTH_COOKIE_SECURE=false; use true for HTTPS.
Limits persist in PostgreSQL: 10 logins and 3 registration/resend attempts per email per 15 minutes, plus 300 requests per 15 minutes globally. ACCOUNT_TRUST_PROXY defaults false. Enable it only when a trusted ingress overwrites x-forwarded-for; this changes the global cap to 60 per trusted client address. Do not enable it on the direct public port. Limits count failures and successes. Registration/resend always give the same success response for existing/unknown emails, and login uses a dummy KDF for unknown accounts. The rate limit itself can reveal recent activity for a known email; it does not reveal whether an account exists. Synchronous SMTP latency can still expose a timing side channel; a durable asynchronous mail queue would be needed to fully decouple delivery timing. Logout remains available when login/mail limits are exhausted. Password recovery uses a single-use reset link that expires after 30 minutes; resetting the password revokes existing sessions. Account deletion is not included.
Verification
There is no automatic verification pipeline. Turbo dry-runs only verify task planning;
they do not exercise account behavior. Runtime verification requires an explicitly
authorized environment with PostgreSQL and SMTP configuration. Cover token replay,
expired/revoked sessions, concurrent limits, password recovery, and rejection of
unverified logins. Verify separately that account cookies cannot authorize administrator
writes, that real email is delivered, and that the account page works in a browser.
Report the checks actually executed; merging into dev does not deploy the application.