Signup now queues an activation email, and password login queues a code bound to its pending customer/client/device. Activation verifies the account; valid login-code verification creates the existing session response. Flutter selects real adapters through API URL/client configuration and retains the existing provider boundaries, recovery states and journey instrumentation.
Includes a TLS-authenticated notification adapter, English/Russian templates, cooldown/rate limits, replay handling, single-use verification, and flow outcome/latency metrics. Review also fixed Mongo matching for omitted empty targets and predictable automatic token keys. Localization outputs are removed from tracking and regenerated before frontend tests.
Validation: make test (Go race tests and all frontend suites), make lint-backend, flutter analyze in sxchnge_auth and app, and formatting of all 17 changed hand-written Dart files passed. New tests cover the real Mongo signup/activation/login flow, TLS authentication, delivery failure, invalid/single-use codes, resend payloads, Flutter session mapping and route recovery. No live email or optional security scan was run.
Deployment requires notification credentials/TLS/templates and a provisioned public client. Queue acceptance is not inbox delivery; product-side delivery gaps require resend, and session-response failures require restarting login. Session restore/refresh and wallet/settings backend adapters are excluded. See docs/auth-notifications.md for contracts, UX evidence and limitations.
Closes#38. Stacked on #37, which depends on #35. Merge #35, then #37, then this PR, retargeting dependent PRs to main. No merge performed.
Signup now queues an activation email, and password login queues a code bound to its pending customer/client/device. Activation verifies the account; valid login-code verification creates the existing session response. Flutter selects real adapters through API URL/client configuration and retains the existing provider boundaries, recovery states and journey instrumentation.
Includes a TLS-authenticated notification adapter, English/Russian templates, cooldown/rate limits, replay handling, single-use verification, and flow outcome/latency metrics. Review also fixed Mongo matching for omitted empty targets and predictable automatic token keys. Localization outputs are removed from tracking and regenerated before frontend tests.
Validation: make test (Go race tests and all frontend suites), make lint-backend, flutter analyze in sxchnge_auth and app, and formatting of all 17 changed hand-written Dart files passed. New tests cover the real Mongo signup/activation/login flow, TLS authentication, delivery failure, invalid/single-use codes, resend payloads, Flutter session mapping and route recovery. No live email or optional security scan was run.
Deployment requires notification credentials/TLS/templates and a provisioned public client. Queue acceptance is not inbox delivery; product-side delivery gaps require resend, and session-response failures require restarting login. Session restore/refresh and wallet/settings backend adapters are excluded. See docs/auth-notifications.md for contracts, UX evidence and limitations.
Closes #38. Stacked on #37, which depends on #35. Merge #35, then #37, then this PR, retargeting dependent PRs to main. No merge performed.
tech
self-assigned this 2026-09-12 13:08:09 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Signup now queues an activation email, and password login queues a code bound to its pending customer/client/device. Activation verifies the account; valid login-code verification creates the existing session response. Flutter selects real adapters through API URL/client configuration and retains the existing provider boundaries, recovery states and journey instrumentation.
Includes a TLS-authenticated notification adapter, English/Russian templates, cooldown/rate limits, replay handling, single-use verification, and flow outcome/latency metrics. Review also fixed Mongo matching for omitted empty targets and predictable automatic token keys. Localization outputs are removed from tracking and regenerated before frontend tests.
Validation: make test (Go race tests and all frontend suites), make lint-backend, flutter analyze in sxchnge_auth and app, and formatting of all 17 changed hand-written Dart files passed. New tests cover the real Mongo signup/activation/login flow, TLS authentication, delivery failure, invalid/single-use codes, resend payloads, Flutter session mapping and route recovery. No live email or optional security scan was run.
Deployment requires notification credentials/TLS/templates and a provisioned public client. Queue acceptance is not inbox delivery; product-side delivery gaps require resend, and session-response failures require restarting login. Session restore/refresh and wallet/settings backend adapters are excluded. See docs/auth-notifications.md for contracts, UX evidence and limitations.
Closes #38. Stacked on #37, which depends on #35. Merge #35, then #37, then this PR, retargeting dependent PRs to main. No merge performed.