Repository navigation
AUTH-MAIL-002 — Make account-email delivery states honest and recoverable #120
Description
Officer impact: Members receive clear, accurate instructions when verification or password-recovery email is sent, delayed, or unavailable. Officers can point members to a safe recovery path without requesting passwords, codes, screenshots, or private links.
Officer documentation: Update docs/officers/EVENTS_SHOP_MEMBERS.md and docs/officers/EMERGENCY_AND_RECOVERY.md with the member-facing recovery wording, stop conditions, proof, undo, and escalation. Mark the revised behavior NOT AVAILABLE YET until the website publication is verified.
Deployment evidence: None at issue creation. Closure requires deterministic frontend tests, no-network provider mocks/emulators, merged source, website publication, runmprc.com verification, and a staged Auth-flow walkthrough using synthetic accounts. It does not require or authorize real email delivery from production.
Problem
Account registration currently catches a Firebase verification-email error, writes only a console warning, and can still tell the member to check the inbox. That makes account created and verification message sent look like the same successful state.
The resend path has no visible cooldown. Raw or inconsistent provider errors can confuse members, while detailed password-reset errors can reveal whether an account exists.
Atomic outcome
Represent identity and email-delivery outcomes separately and provide one simple recovery path:
- Account created.
- Verification message accepted for sending.
- Delivery request failed or is temporarily unavailable.
- Resend is available after a visible cooldown.
- Already verified, link expired/used, and wrong-account states have plain next steps.
The UI may suggest checking Spam and marking the approved sender as not spam, but must explain that this does not fix delivery for everyone.
Security and usability invariants
- Never claim a message was sent after the Firebase call failed.
- Password reset and public recovery responses remain generic and do not confirm whether an email/account exists.
- Do not display raw Firebase error codes, stack traces, email addresses, action links, or tokens.
- Do not log names, emails, request bodies, action links, or raw provider errors.
- Resend has a client-visible cooldown and must also tolerate provider throttling; it is not an authorization control.
- A retry cannot create another account, change membership, grant access, or lose the task the member was trying to complete.
- Controls and copy use large, clear actions and ordinary language suitable for elderly/nontechnical members.
- All tests use mocks/emulators and synthetic data; no production inbox or action link is used.
Acceptance criteria
- Registration distinguishes
account createdfromverification request acceptedandverification request failed. - A failed verification request shows a generic recovery action and never says to check the inbox as if success were proven.
- Resend shows a visible countdown, blocks accidental repeat clicks, and recovers after success, failure, refresh, and sign-in changes.
- Password-reset UI returns the same public result for existing, missing, malformed, throttled, and provider-failure cases where enumeration resistance requires it.
- Verification success, already verified, expired/used link, wrong account, offline, and provider-unavailable states have one clear next action.
- Spam guidance names the currently configured sender generically and can be updated after AUTH-MAIL-001 without a code fork.
- Screen-reader labels, focus movement, keyboard flow, readable control sizes, and loading/disabled states are tested.
- Unit/integration tests prove success, send failure, resend cooldown, retry, navigation preservation, and generic-error behavior without any network call.
- No logs, analytics, screenshots, fixtures, or errors contain an email address, action URL, code, or token.
- Officer guidance states what can be checked, what must never be requested from a member, and when to escalate.
Dependencies and coordination
- CI-001A — Repair the deterministic frontend test baseline #103 owns the deterministic frontend test baseline.
- SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 owns fail-closed local Firebase emulator isolation and navigation callback safety.
- OBS-001A — Remove personal data and session replay from current monitoring and logs #111 owns current monitoring/log redaction.
- AUTH-MAIL-001 — Brand and authenticate Firebase Authentication email #119 / AUTH-MAIL-001 owns sender-domain and Firebase/DNS configuration; this issue must not change DNS or implement a mail provider.
- AUTH-006 — Offer simple email/password and Google sign-in #109 owns the future combined email/password and Google entry screen. Keep this slice compatible, but do not widen AUTH-006 — Offer simple email/password and Google sign-in #109 or treat Google identity as membership.
- AUTH-004 — Link a Google identity to an existing Firebase member account #82 owns account-link/collision recovery.
- CI-001 — Establish trustworthy quality gates and protected deployment #105 owns staged and production website/deployment evidence.
The implementation becomes claimable after #103 and the required no-network test boundary are merged. Provider configuration may proceed separately under #119.
Explicitly out of scope
- Custom sender-domain DNS, SMTP/provider delivery, template administration, Google sign-in, membership approval, dues, discounts, or role grants.
- Reading a member mailbox, sending production test mail, or collecting message headers/action links in public systems.
Claim protocol
Creation is not a claim. Before editing, confirm dependencies, assign the issue, post CLAIMED by <canonical agent> at <UTC>; branch <branch>, and re-read all comments. Keep this as one tested UI/recovery outcome.
Activity
daliu commentedon Jul 13, 2026
#145 / AUTH-MAIL-002A child update
The registration/email-request truth slice is source-complete and merged through PR #148 as 46557c7. Exact PR and post-merge CI passed, and two independent exact-diff reviews approved.
This completes the source behavior for the first two parent acceptance outcomes: account creation is distinct from verification-request acceptance/failure, and a failed request never falsely says to check Inbox. The member keeps the account and receives a safe stop/escalation path.
Production remains NOT LIVE. Protected release run 29247125844 failed closed before build/cloud access because required public App Check configuration is absent; Firebase and Pages were skipped, and runmprc.com still serves the prior asset. Keep this parent open.
Remaining atomic work:
Do not advertise Resend as a verified recovery procedure until #118 backend/profile behavior, #120B source, staged behavior, and live publication are all proven.
daliu commentedon Jul 13, 2026
AUTH-MAIL-002B is now published and claimed as #153 for the My Account resend request result, 60-second visible client cooldown, double-click guard, accessibility, and no-network tests. It explicitly treats provider resolution as request acceptance, not delivery; refresh may reset the usability cooldown and does not bypass provider throttling. #119 and AUTH-MAIL-002C remain separate.
daliu commentedon Jul 13, 2026
Status correction: parent AUTH-MAIL-002 is now status:in-progress while claimed child #153 is active. #145 is source-merged but not published; #153 owns resend truth/cooldown; AUTH-MAIL-002C remains proposed. Parent closure still requires all child and deployment/live evidence.
daliu commentedon Jul 13, 2026
AUTH-MAIL-002 progress at 2026-07-13T13:08:36Z: child #153 completed and merged through PR #154 as 23bca8c. The first three parent acceptance boxes now reflect merged #145 registration truth plus merged #153 resend truth.
The parent stays OPEN and status:in-progress. Remaining work includes AUTH-MAIL-002C password-reset/action-code recovery states, #119 sender/provider configuration, and protected publication/live verification.
Deployment is not complete: release run 29252492614 stopped before build because the production environment lacks the public App Check site key. Firebase and Pages were skipped, so no website, Firebase, provider, mailbox, or production-behavior claim is made.
1 remaining item
daliu commentedon Jul 13, 2026
COORDINATION — #178 is validly claimed at 2026-07-13T20:29:16Z on
codex/issue-178-pause-profile-phone. It owns the My Account/profile-service phone-control hunks listed in #178 and preserves all merged AUTH-MAIL resend behavior. AUTH-MAIL-002C2 must not edit those exact hunks until #178 releases them; email/action-code behavior remains outside #178.daliu commentedon Jul 13, 2026
Coordination release — #178 merged as
6017493f3366790eefba5d00baf3df7211dfc380; post-merge CI passed and its ten-path claim is released. Future work should refresh from that SHA and preserve the source-only My Account phone pause and name-only owner update boundary. Firebase deploy/readback and production verification remain unproven; #178 did not change Functions, providers, or production data.daliu commentedon Jul 13, 2026
AUTH-MAIL-002C2 is now published/assigned/CLAIMED as #194 at 2026-07-13T23:38:15Z on
codex/issue-194-verify-email-action, exact baseaafd15c04fbcd09341092a78f23d513b09cca5d2.This is one verification-only source/test outcome: a deliberate-click
/account/verify-emailpage, closed Identity result projection, query/fragment scrub, capability telemetry/App Check guard, no-network tests, and minimum officer/status docs. It excludes My Account/profile/phone, password reset completion, recover-email mutation, providers/templates/DNS, Functions, Rules, packages, workflows, and live publication.Important release boundary: Firebase uses one configured custom action handler across verification, reset-password, and recover-email templates. #194 must remain SOURCE ONLY and must not be wired as the global handler until every enabled mode has separately reviewed safe coverage, or #119 retains Firebase's default multi-mode handler. Parent #120 remains in progress while this child is active; provider/live acceptance remains open.
daliu commentedon Jul 13, 2026
Pre-edit #194 route correction: the source path is
/auth/action, not/account/verify-email. Firebase configures one generic handler URL, so the generic route is the truthful future dispatcher shape. C2 still supports verification only and remains forbidden for global provider activation until every enabled mode is safely covered.daliu commentedon Jul 14, 2026
AUTH-MAIL-002C2 source update — 2026-07-14T00:17:06Z
Focused child #194 completed through PR #195 and merged as
e76b1ee01a0f0ce9951fdcc6e454b66288394b93. It adds the deliberate verification-only action, native/router capability scrub, strict syntax and provider-operation checks, fixed accessible results, telemetry startup suppression, and officer guidance. Exact-head and post-merge hosted CI passed.Parent #120 remains open. The source is not published on
runmprc.com; Firebase's global handler, templates, sender/DNS, Spam/delivery, enumeration protection, Firestore verification mirror, and live behavior remain unproven. Never configure the verification-only route as the project-wide handler while reset-password or recover-email modes would reach it.AUTH-MAIL-002: config-driven sender in account-email spam guidance (#120
AUTH-MAIL-002: config-driven sender in account-email spam guidance (#120
daliu commentedon Jul 17, 2026
C6 landed in PR #344 (
f98b62c).Verification and password-reset anti-spam copy now flows through a single
getSpamGuidance()seam that names the configured sender viaREACT_APP_ACCOUNT_EMAIL_SENDER(blank → generic "the club's account email"). This satisfies acceptance criterion C6 — "Spam guidance names the currently configured sender generically and can be updated after AUTH-MAIL-001 without a code fork." The guidance still refuses to over-promise (never "sent"/"delivered"; states that marking Not-spam does not fix delivery for everyone).Kept open intentionally. The remaining criteria are already honest in source but gated on work I can't complete autonomously:
blocked-owner) plus live verification against the deployed site (a green workflow alone does not prove the live behavior).Once #119 publishes the approved sender and it's set in the build config, this issue can be verified live and closed.
daliu commentedon Jul 18, 2026
Coordination only — AUTH-UX-001A #368 was published/assigned/CLAIMED at 2026-07-18T23:20:55Z on
codex/issue-368-account-signout, exact base73b46cbf37e204bd1e69000c396e0736d500cb07.#368 owns only the existing My Account sign-out control/state in
Account.tsx, an additive named sign-out test block inAccount.test.tsx, additive.account-sign-out*CSS, one separately named sign-out procedure inEVENTS_SHOP_MEMBERS.md, and only the profile symptom/missing-profile sign-out wording inEMERGENCY_AND_RECOVERY.md.Every merged #120 resend, account-email, password-reset, verification/action-handler, sender/Spam, and live/provider hunk is immutable. #368 does not alter parent acceptance or claim provider/live completion.
daliu commentedon Jul 18, 2026
Coordination release — 2026-07-18T23:52:30Z: child #368 is complete/closed via PR #371 at exact main df91460. Pull-request CI 29665823878 and exact-main CI 29665891927 passed all five jobs. Its exact five-path claim is released. This is source/test/merge evidence only: no protected release, website/runmprc.com verification, Firebase/Auth provider action, production account/session action, or live sign-out proof occurred. Parent #120 provider/live-email work remains separate.
daliu commentedon Jul 19, 2026
Coordination claim — 2026-07-19T00:00:48Z: #374 owns only the upcoming-registration empty-state hunk in Account.tsx, one named empty-state test block in Account.test.tsx, listMyRegistrations source/new tests, a named officer-guide section, and one SECURITY ledger row. All #120 verification-email/resend/action-handler/sign-out/profile/provider/live hunks are immutable. No current #120 source claim was found; please stop and coordinate before touching these exact #374 hunks.
daliu commentedon Jul 19, 2026
COORDINATION RELEASE — 2026-07-19T00:30:02Z
DATA-001A3/#374 merged as exact main
e414c828c3171f212737a5026d04aac05e61e1d1; exact-main CI29666951610passed. The slice removes email-based My Account registration ownership and keeps registration-load failure separate from empty success. It changes no verification-email, resend, action-handler, sender, profile, sign-out, or other #120 behavior. No deployment/live proof exists. The Account/list-registration/docs claims are released.daliu commentedon Jul 22, 2026
STATUS CORRECTION — 2026-07-22
The
status:in-progresslabel was stale. All named source children (#145, #153, #155, #194, and the C6 source change in #344) are merged and their claims are released. The 2026-07-19 coordination comment also records that no current #120 source claim exists.The remaining closure work is owner/release-gated: #119 must supply the approved sender/provider configuration, and #105/#133/#136 must provide protected publication plus exact live-site verification. No new #120 engineering child is dependency-clear.
The issue is therefore relabeled
status:blocked-owner. This tracking correction changes no source, website, Firebase/Auth configuration, mailbox, production data, or live behavior.