12 commits

Author	SHA1	Message	Date
cschlaefke	7d094a6732	fix(auth): treat SMTP failures like success on enumeration-sensitive calls ... Refs #37 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 12:03:04 +01:00
cschlaefke	aa421b12b0	test(auth): address review findings for e2e ... Refs #38 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 10:55:27 +01:00
cschlaefke	7c2f684098	fix(auth): address review findings for password reset ... Finish the recovery guard only after the password change, mark the change in the repository so a late userUpdated event is harmless, keep the form locked after success, carry from through the reset check-email page, share the password error texts and focus the continue button. Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 09:58:31 +01:00
cschlaefke	3b2995463e	docs(auth): document 01c deviations, reset mode route and AppBanner actionEnabled ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 09:50:42 +01:00
cschlaefke	87c0d7d1ec	feat(auth): add password reset (forgot password, recovery link, new password) ... ForgotPasswordScreen with neutral reaction (F12), CheckEmail reset mode on its own path, recovery link handling and ResetPasswordScreen with the recovery guard held until the user confirms the success message. Carries the from parameter between login, register and forgot password. Removes the route placeholders. Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 09:47:03 +01:00
cschlaefke	239d0e1ac2	fix(auth): address review findings for registration ... - expose legal links to screen readers on web - allow only http(s) legal URLs, prevent double submit - detect transport errors without runtimeType, keep extra in memory - ship third-party license text, document decisions Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 00:47:42 +01:00
cschlaefke	3158abc344	docs(auth): use trim_ws in spec ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:58:11 +01:00
cschlaefke	9f36cd0c33	feat(db): reject U+200B in display names ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:51:56 +01:00
cschlaefke	fb0f4b9d3f	fix(db): trim all Unicode whitespace in display name, harden templates ... - add public.trim_ws mirroring Dart String.trim - require JSON string metadata, tolerate non-string locale in templates - add tests, align docs with review Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:48:01 +01:00
cschlaefke	47721a48e8	docs(auth): align spec with spike results and add AUTH-CFG-25 ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:26:03 +01:00
cschlaefke	395816609f	feat(db): enforce registration rules and add terms_version ... Adds display name validation, terms_version, locale sync trigger and pgTAP tests (KTO-01 criteria 1, 2, 10, 11). Includes GoTrue spike results. Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 22:36:21 +01:00
cschlaefke	e56f75a5e1	docs(auth): add spec for KTO-01 registration, login and password reset ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 20:10:07 +01:00