Identity
Accounts, recovery, mail
Industry-standard signup, hashed verify and reset tokens, transactional mail, and the demo inbox.
Signup requires name, email, password, confirm-password, and terms. Passwords follow NIST 800-63B (8–72, letter + digit, trimmed, HIBP on the way in). Demo shortcuts (owner@ / driver@ / admin@) skip verify so a pitch still works. Every other email gets a 48-hour hashed token.
Happy path
- POST signup → welcome mail with confirm link.
- GET /verify-email?token=… consumes the sha256 token, starts the session, redirects by role.
- Forgot password → one-hour reset mail. Success copy never says whether the address exists.
- Reset consumes the token once, then a “password changed” mail.
- Resend confirmation is on /verify-email.
Where tokens and mail live
| Thing | Demo | Production |
|---|---|---|
| Verify / reset token | sha256 in .data/auth-tokens.json | Same shape in Postgres |
| Mail body | .data/mail.json and /admin/mail | Resend (RESEND_API_KEY, MAIL_FROM) |
| Session | aether_session cookie | Supabase Auth |
| Google / Apple | Demo persona emails | Supabase OAuth |
- /signup — create account
- /login — email, Google, Apple, demo shortcuts
- /forgot-password
- /reset-password?token=
- /verify-email?token= (or resend form)
- /admin/mail — desk outbox