3.0 KiB
Email accounts
/account offers registration, password login, email verification/resend, and logout.
/api/account/session returns the current account; other actions use same-origin POST.
Passwords require at least 12 characters and at most 256 UTF-8 bytes. Only verified
accounts can log in. Verification links expire after 30 minutes and are consumed once.
Session tokens expire after seven days; logout deletes the current token immediately.
Only token SHA-256 digests are stored. Passwords use individually salted scrypt.
Runtime configuration
The existing production deployment reads /etc/prompt.env on ces-control. Set its
ownership to root and mode to 0600. The operator should update SMTP_PASSWORD there
through a secure remote session, without putting it in command arguments, repository,
CI output, release.env, or chat. Existing compose deployment reads this file without
copying credentials into the release directory. Do not run docker compose config
without --quiet against the production environment because interpolation shows secrets.
Docker administrators can inspect container environment; access to Docker is privileged.
Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and SMTP_HOST=smtpdm.aliyun.com, SMTP_PORT=465, SMTP_USERNAME and SMTP_FROM=noreply@notice.entroia.com. TLS certificate validation stays enabled. Missing SMTP configuration returns a generic service failure; resend with the registration password can recover an account whose initial delivery failed.
Keep AUTH_CONFIG_FILE configured for administrator access. Missing administrator configuration fails closed. AUTH_DISABLED_FOR_TESTS is false by default and is enabled only by the disposable legacy integration stack; never enable it in production. Email account cookies never satisfy administrator authorization. With the current HTTP acceptance origin use AUTH_COOKIE_SECURE=false; use true after enabling HTTPS.
Limits persist in PostgreSQL: 10 logins and 3 registration/resend attempts per email per 15 minutes, plus 300 requests per 15 minutes globally. ACCOUNT_TRUST_PROXY defaults false. Enable it only when a trusted ingress overwrites x-forwarded-for; this changes the global cap to 60 per trusted client address. Do not enable it on the direct public port. Limits count failures and successes. Registration/resend always give the same success response for existing/unknown emails, and login uses a dummy KDF for unknown accounts. The rate limit itself can reveal recent activity for a known email; it does not reveal whether an account exists. No password recovery or account deletion is included.
Verification
ces-control runs crypto/origin tests, PostgreSQL verification-token replay races, expired/revoked sessions, concurrent limit consumption and unverified login rejection. Production-auth exercises verify that account cookies cannot authorize legacy writes. Actual SMTP delivery and visual acceptance at http://8.211.154.134:18131/account require operator runtime configuration and the normal manually approved deployment.