From c6fd7ea89b6e0a96eb1d81989de891b4768b1044 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 31 Aug 2026 17:19:17 +0200 Subject: feat: email verification for registration, email change, and invitations Registration now creates a pending account and sends a 6-digit code via email; the account activates only after verification. Email changes on the profile page follow the same flow. Group invitations send a notification email to the invitee (without revealing their address to the inviter) containing the invite code and hub link. Backend: blind HMAC-SHA256 email index for uniqueness without decryption, mail.py for localhost Postfix delivery, verification endpoints, cleanup of expired codes and stale pending accounts, startup backfill of email_hash for existing users. Frontend: 3-phase register page, inline email change verification on profile, invite-notify call with status display. All 10 locales updated. Co-Authored-By: Claude Opus 4.6 --- .../d4e5f6a7b8c9_add_email_verification.py | 53 ++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py (limited to 'packages/meshbay-hub/src/meshbay_hub/db/migrations') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py new file mode 100644 index 0000000..20ba29d --- /dev/null +++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py @@ -0,0 +1,53 @@ +"""add_email_verification + +Add email_hash blind index to users (for uniqueness without decryption), +and the email_verifications table for registration, email change, and +invitation codes. + +Revision ID: d4e5f6a7b8c9 +Revises: c3d4e5f6a7b8 +Create Date: 2026-08-31 14:00:00.000000 + +""" +from typing import Sequence, Union + +from alembic import op +import sqlalchemy as sa + + +revision: str = 'd4e5f6a7b8c9' +down_revision: Union[str, Sequence[str], None] = 'c3d4e5f6a7b8' +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + + +def upgrade() -> None: + op.add_column('users', + sa.Column('email_hash', sa.String(64), nullable=True)) + op.create_index('ix_users_email_hash', 'users', ['email_hash'], unique=True) + + op.create_table('email_verifications', + sa.Column('id', sa.String(36), nullable=False), + sa.Column('email_hash', sa.String(64), nullable=False), + sa.Column('email_encrypted', sa.String(256), nullable=True), + sa.Column('code', sa.String(16), nullable=False), + sa.Column('purpose', sa.String(16), nullable=False), + sa.Column('user_id', sa.String(36), sa.ForeignKey('users.id'), nullable=True), + sa.Column('group_id', sa.String(36), sa.ForeignKey('groups.id'), nullable=True), + sa.Column('created_at', sa.DateTime(timezone=True), + server_default=sa.text("(now() at time zone 'utc')")), + sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False), + sa.Column('verified_at', sa.DateTime(timezone=True), nullable=True), + sa.Column('attempts', sa.Integer, server_default='0'), + sa.PrimaryKeyConstraint('id'), + ) + op.create_index('ix_email_verif_hash', 'email_verifications', ['email_hash']) + op.create_index('ix_email_verif_user', 'email_verifications', ['user_id']) + + +def downgrade() -> None: + op.drop_index('ix_email_verif_user') + op.drop_index('ix_email_verif_hash') + op.drop_table('email_verifications') + op.drop_index('ix_users_email_hash', table_name='users') + op.drop_column('users', 'email_hash') -- cgit v1.2.3