enter.html: email-verification companion (#31) — verify-sent view, resend, verified/expired states #16

Merged

Cordy merged 3 commits from feat/enter-email-verify into main

2026-08-26 20:56:15 +00:00

Cordy commented

2026-08-26 20:51:06 +00:00

Owner

What it adds

verifysent view ("Check your inbox") — new <section id="v-verifysent"> in the existing .panels, reusing .vt/.sub/.btn/.linkrow. Tabs hidden here (added to show()'s hide condition and to VIEWS).
Register branches on the response — 201 {token} → enter() exactly as today (flag off); 202 {status:"verify_sent"} → the new screen with the email filled in. handle() gained an optional onSuccess hook; the three other callers are unchanged.
Unverified sign-in — post() now keeps err.reason; a 403 {reason:"unverified"} routes to the verify-sent screen (login-worded) instead of a generic error.
Resend — the Resend button posts /v1/verify/resend and reports "Sent — check your inbox again."
Email-link return — verifyConsume() (mirrors oauthConsume(), wired into the entry point and hashchange) handles #verified (green confirm on sign-in) and #verify-failed (red error → Create account).

Dormant by default

When the backend flag REQUIRE_EMAIL_VERIFICATION is off (today), register returns a token and signs in exactly as before — none of the new paths trigger. So this is safe to merge now and only comes alive when the flag is set.

Preview

Open enter.html#verifysent, #verified, #verify-failed to see each state without a running backend. Applied via anchored splices (assert count==1 each); both script blocks pass node --check.

Before flipping the backend flag later, confirm PUBLIC_ORIGIN points at wherever enter.html is served (so the verify link's …/enter.html#verified redirect lands here).

Frontend companion for the backend email-verification flow (cairn-license-server #34 / #31). Built surgically on the existing page — OAuth, topo hero, reset/invite views and all current behaviour untouched. ## What it adds - **`verifysent` view** ("Check your inbox") — new `<section id="v-verifysent">` in the existing `.panels`, reusing `.vt`/`.sub`/`.btn`/`.linkrow`. Tabs hidden here (added to `show()`'s hide condition and to `VIEWS`). - **Register branches on the response** — `201 {token}` → `enter()` exactly as today (flag off); `202 {status:"verify_sent"}` → the new screen with the email filled in. `handle()` gained an optional `onSuccess` hook; the three other callers are unchanged. - **Unverified sign-in** — `post()` now keeps `err.reason`; a `403 {reason:"unverified"}` routes to the verify-sent screen (login-worded) instead of a generic error. - **Resend** — the Resend button posts `/v1/verify/resend` and reports "Sent — check your inbox again." - **Email-link return** — `verifyConsume()` (mirrors `oauthConsume()`, wired into the entry point and `hashchange`) handles `#verified` (green confirm on sign-in) and `#verify-failed` (red error → Create account). ## Dormant by default When the backend flag `REQUIRE_EMAIL_VERIFICATION` is off (today), register returns a token and signs in exactly as before — none of the new paths trigger. So this is safe to merge now and only comes alive when the flag is set. ## Preview Open `enter.html#verifysent`, `#verified`, `#verify-failed` to see each state without a running backend. Applied via anchored splices (assert count==1 each); both script blocks pass `node --check`. Before flipping the backend flag later, confirm `PUBLIC_ORIGIN` points at wherever `enter.html` is served (so the verify link's `…/enter.html#verified` redirect lands here).

Cordy added 3 commits

2026-08-26 20:51:07 +00:00