psa-systems/lets-chat
Watch
9
0
Fork
You've already forked lets-chat
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(auth): defer account creation until 2FA enrollment completes #119

Merged
nrupard merged 1 commit from fix/2fa-before-registration into main 2026-05-15 20:20:39 +02:00
Conversation 0 Commits 1 Files changed 26 +471 -3
nrupard commented 2026-05-15 20:20:34 +02:00
Owner
Copy link

When the deployment requires 2FA (LETS_CHAT_SECRET_KEY set), POST /register no longer creates the user row up front. It validates the form, hashes the password, generates a TOTP secret, and stores the bundle in a new pending_registrations table keyed by a short-lived cookie. The user is redirected to /register/2fa which renders the QR/code form; a successful TOTP verification at POST /register/2fa is what actually creates the users row, sets the email, applies the digest default, runs the first-user promotion, and issues the session. Abandoning the flow now leaves no account behind (and no verification email already in flight) instead of squatting the username forever.

Touches the migration list (0015_pending_registrations.sql) so every hand-rolled setup_auth_pool in server/tests/ was patched to include it - per CLAUDE.md's migration-drift guidance.

When the deployment requires 2FA (LETS_CHAT_SECRET_KEY set), POST /register no longer creates the user row up front. It validates the form, hashes the password, generates a TOTP secret, and stores the bundle in a new pending_registrations table keyed by a short-lived cookie. The user is redirected to /register/2fa which renders the QR/code form; a successful TOTP verification at POST /register/2fa is what actually creates the users row, sets the email, applies the digest default, runs the first-user promotion, and issues the session. Abandoning the flow now leaves no account behind (and no verification email already in flight) instead of squatting the username forever. Touches the migration list (0015_pending_registrations.sql) so every hand-rolled setup_auth_pool in server/tests/ was patched to include it - per CLAUDE.md's migration-drift guidance.
fix(auth): defer account creation until 2FA enrollment completes
All checks were successful
Check / clippy + fmt + tests (pull_request) Successful in 1m11s
Details
bb78d41c47 
When the deployment requires 2FA (LETS_CHAT_SECRET_KEY set), POST /register no longer creates the user row up front. It validates the form, hashes the password, generates a TOTP secret, and stores the bundle in a new pending_registrations table keyed by a short-lived cookie. The user is redirected to /register/2fa which renders the QR/code form; a successful TOTP verification at POST /register/2fa is what actually creates the users row, sets the email, applies the digest default, runs the first-user promotion, and issues the session. Abandoning the flow now leaves no account behind (and no verification email already in flight) instead of squatting the username forever.

Touches the migration list (0015_pending_registrations.sql) so every hand-rolled setup_auth_pool in server/tests/ was patched to include it - per CLAUDE.md's migration-drift guidance.
nrupard deleted branch fix/2fa-before-registration 2026-05-15 20:20:39 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/lets-chat!119
No description provided.