Suite 38 — password-required accounts + decoupled newsletter - #39
Merged
Conversation
…led newsletter Track A — password-required accounts: - Remove passwordless lazy-auth (/enter) plugin; portal signup now collects email+password+confirm in one step via Better Auth signUp.email (38.A1/A2) - Delete set-password route/form/API + AccountBanner nag (38.A2) - Drop derived has_password from /auth/me and /events/me/profile (38.A3) - Add rollover management command + runbook for existing passwordless accounts (38.A4, prepare-only — reset flow needs wiring before send; see doc) Track B — decoupled newsletter + digests: - NewsletterSubscriber.manage_token (unique UUID) as single digest source (38.B1) - POST /newsletter/subscribe (email-only + welcome mail) and public token-managed GET/PATCH /newsletter/manage?token=; me PATCH NEVER now deactivates, not deletes (38.B2) - One NewsletterSubscriber-driven recipient resolver backs tasks + command; add scheduled monthly digest + manage/unsubscribe link in every email (38.B3) - Footer inline signup, public /newsletter/manage page, Sidebar/DigestCTA no longer route to account creation (38.B4) Docs refreshed for password-required auth + decoupled newsletter (38.D1) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Suite 38 — password-required accounts + decoupled newsletter
Orchestrated build of all 8 tickets. Backend 114 tests OK,
makemigrations --checkclean; frontendpnpm build+pnpm test33/33 green.Track A — password-required accounts
/enter) plugin; keepjwt()/nextCookies().signUp.email; delete set-password route/form/API + AccountBanner nag.has_passwordfrom/auth/me+/events/me/profile; deleteuser_has_passwordhelper + frontend types/tests.rollover_passwordless_accountsmanagement command +docs/suite-38-passwordless-rollover.md. No emails sent.Track B — decoupled newsletter + digests
NewsletterSubscriber.manage_token(unique UUID) + migration0019with per-row backfill./auth/subscribe→POST /newsletter/subscribe(+ welcome email); publicGET/PATCH /newsletter/manage?token=;mePATCHNEVERnow deactivates (row + token survive) instead of deleting.NewsletterSubscriber-driven_build_recipientsresolver backs both tasks and command;fan_out_monthly_digest+ beat seed0020(1st @ 18:00 ET); manage/unsubscribe footer in every digest email./newsletter/managepage,Sidebar/DigestCTAPusherno longer route to/join.Docs
ARCHITECTURE.md,PROJECT_CONTEXT.md, root/backend/webAGENTS.md,docs/redis-celery-handoff.mdcorrected — no live doc describes passwordless/has_password//auth/subscribe.sendResetPasswordisn't configured (→RESET_PASSWORD_DISABLED), and/forgot-passwordis a stale stub that calls no API (no/reset-password/[token]page). Existing passwordless accounts have no working path to set a password until the reset flow is wired. Command + runbook are ready to send once it is.BetterAuthAccount.user_idis a DjangoTextFieldbut liveneon_auth.account."userId"isuuid(ORM joins fail withoperator does not exist: uuid = text). Worked around with raw SQL in the rollover command.🤖 Generated with Claude Code