47 lines
2.2 KiB
Markdown
47 lines
2.2 KiB
Markdown
|
---
|
||
|
|
kind: task
|
||
|
|
slug: manual-email-verification
|
||
|
|
title: Manual email verification — add an email outside an OAuth provider
|
||
|
|
plan_slug: multitenant-saas-hardening
|
||
|
|
epic_slug: tenant-lifecycle
|
||
|
|
status: draft
|
||
|
|
priority: P2
|
||
|
|
tenant_id: global
|
||
|
|
owner: unassigned
|
||
|
|
cursor_todo_id: null
|
||
|
|
updated_at: "2026-06-02"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Task summary
|
||
|
|
|
||
|
|
Let a user add a new email to their profile (one they don't have an OAuth account for) by typing it, receiving a one-time verification code, and entering the code. Required so people can accept invites sent to emails they only use for forwarding / aliases / etc.
|
||
|
|
|
||
|
|
## Why deferred from the invites convoy
|
||
|
|
|
||
|
|
`Task-multi-email-identity` populates the identities table from OAuth provider claims only. That covers the common case (sign in via GitHub, GitHub knows your verified GitHub email). It does NOT cover: "I have a personal Gmail I never use to log in, and someone invited me at that address."
|
||
|
|
|
||
|
|
This is real product surface but requires:
|
||
|
|
|
||
|
|
- Verification token table (or reuse `verification_tokens` which NextAuth already provides).
|
||
|
|
- An outbound email send — needs a chosen provider (Resend / Postmark / SES). The invites convoy explicitly deferred email-send to a follow-up because picking a provider is its own discussion.
|
||
|
|
- Rate-limit on code requests (3/hour/email) — overlaps with `Task-rate-limit-and-abuse-guardrails`.
|
||
|
|
- A code-entry UI on the profile page.
|
||
|
|
|
||
|
|
## Scope (sketch — refine when scheduled)
|
||
|
|
|
||
|
|
- Profile UI: "Add email" button → input → "Send code" → 6-digit code entry.
|
||
|
|
- Backend: `identity.requestEmailVerification({ email })` (rate-limited), `identity.confirmEmailVerification({ email, code })`.
|
||
|
|
- On confirm, insert `user_email_identities` with `source='manual'`, `verified_at=now()`.
|
||
|
|
- Reject if the email is already a verified identity on another user (same rule as OAuth case).
|
||
|
|
|
||
|
|
## Acceptance criteria (draft)
|
||
|
|
|
||
|
|
- [ ] User can add a verified email to their profile without going through OAuth.
|
||
|
|
- [ ] Codes expire in 15 minutes; max 3 sends per email per hour.
|
||
|
|
- [ ] Confirmed emails appear in the "Linked emails" section with `source='manual'`.
|
||
|
|
|
||
|
|
## Links
|
||
|
|
|
||
|
|
- Epic: `./Epic-tenant-lifecycle.md`
|
||
|
|
- Depends on: `./Task-multi-email-identity.md`, transactional email provider decision.
|