Native auth 2c-II: registration, verification, reset, change password/email (issue #147)

[JanMikes]

Slice 2c-II of the Auth0 → native Symfony auth migration (issue #147), following #165 (2a data model), #166 (2b security plumbing) and #167 (2c-I login page + sign-in link).

Everything ships dark. NATIVE_REGISTRATION_ENABLED and NATIVE_LOGIN_ENABLED stay OFF; nothing user-visible changes on merge.

Done

• Registration — RegisterUser handler creates UserAccount (msp|<uuid7>) + Player in one transaction. Rejects an email that already belongs to a Player, not just to a user_account: in window A that collision is the user's own Auth0 account, and letting a second account take the address would make the Stage B import skip their identity and strand their profile and every solving time.
• Stranded-registrant rescue — the /welcome screen and the verification email both carry the sign-in-link URL, because a window-A registrant who logs out meets the Auth0 form, which has no identity for them and which we cannot brand or link from. Both suppress the warning once login is native, so it retires by itself.
• Email verification — SendEmailVerificationLink handler + email, anonymous /verify-email (success / expired / invalid / failed, grants no session), rate-limited resend on profile settings.
• Password reset — /password-reset asks, /password-reset/{token} consumes. Unknown, throttled and known addresses are indistinguishable. The token stays in the URL with Referrer-Policy: no-referrer rather than in a session: a session cookie here would follow the visitor across every later page and break the Make anonymous HTML responses shared-cacheable (fixes #139) #164 anonymous-cacheability property.
• Native change password + change email — both require the current password, so a hijacked session cannot lock the owner out. Imported bcrypt hashes verify through the migrating hasher and land as argon2id. Change-email keeps player.email in step, resets email_verified_at, kills outstanding reset links aimed at the old inbox, and re-sends verification.
• The Add change password feature via Auth0 password reset email #161 card swap needed no flag — edit-profile.html.twig branches on whether the session holds a UserAccount, so window-A registrants get the native cards the day they register and the Auth0 branch dies on its own once Stage B has converted everyone. Removal of the three Add change password feature via Auth0 password reset email #161 classes + AUTH0_DB_CONNECTION stays open for Stage B, as the plan specifies.
• All copy in all 6 locales (en, cs, de, es, fr, ja), UI + transactional emails. check-translations reports 0 missing keys.

Bugs found and fixed while reviewing this slice

Worth calling out, because each would have shipped dark and only bitten once a flag flipped:

1. Security::login() without an authenticator name throws. The main firewall carries three authenticators through window A and refuses to guess between them — so every native registration would have 500'd on Stage A day. RegisterControllerTest fails with Too many authenticators were found without the fix.
2. The "forgot password" CSRF token id was not stateless, so rendering the form for an anonymous visitor started a session and set a cookie — a straight Make anonymous HTML responses shared-cacheable (fixes #139) #164 regression that would have made every later page uncacheable for that visitor.
3. Changing the account email left outstanding reset links alive. Reset tokens bind to the account, not the address, and losing a mailbox is a common reason to change it — so whoever held the old inbox kept an hour-long way back in.
4. The change-email ownership check was non-deterministic. player.email is not unique (7 known duplicate pairs); comparing one arbitrary row's user_id meant the same request could be allowed or refused depending on what Postgres returned.
5. The verification email's "valid for 24 hours" was a separate literal from the token's actual lifetime.
6. A reset link a mail client wrapped or truncated 404'd instead of reaching the "here is a new one" page.

Plus one test-infrastructure regression of my own: making the flags Twig globals meant they get resolved on nearly every rendered page, which turned LoginControllerTest's pre-existing unset($_ENV[...]) teardown into 355 suite-wide EnvNotFoundException errors. Both flag tests now restore the original value through a shared OverridesFeatureFlagEnv trait.

Is it dark? Yes — verified route by route

With both flags OFF, every route this branch adds redirects to /login (checked against the running container): /register, /password-reset, /password-reset/{token}, /welcome, and the two credential-settings pages. The edit-profile Auth0 card renders byte-identical to main for Auth0 sessions, and the new navbar CTA is flag-gated.

Two things were fixed to make that true rather than nearly-true:

• /password-reset was live. Because production's user_account table stays empty until the Stage B import, it could only answer "if an account exists, a link is on its way" and then send nothing — a dead end made silent by the very anti-enumeration uniformity the page needs. Both reset routes are now gated on native auth being reachable (registration OR login, so a rollback of one does not take reset down with it).
• The cutover modal is dropped (D15 amendment, Jan's call): the site-wide notice strip already reaches everyone including anonymous visitors and links to the explainer page, so a modal repeating it on the login page is a second interruption. The reasoning is recorded in the README decision table, the plan and the comms plan.

Deployment note: the two flags are now Twig globals, so they are resolved on nearly every page render instead of only on /login. They are committed in .env (=0) and .dockerignore excludes only .env.*, so the image carries them — but production must keep those vars resolvable or page rendering fails.

Independent review

A separate adversarial review pass over the diff found no authentication/authorization bypass, no window-A collision gap, no #164 regression and no CQRS/project-rule violation. It did find one real gap — the handlers were well covered but the controllers in front of them were not — so this branch now also tests, at the HTTP layer: #[IsGranted] on both credential-settings pages, the current-password gate through the form, the window-A instanceof UserAccount guard (a legacy Auth0 session redirects instead of hitting a TypeError), all four /verify-email outcomes, and the reset round trip end to end including single use.

Known dependency on the next slice

RetrieveLoggedUserProfile still recognises only Auth0\Symfony\Models\User, so a native UserAccount session gets logged_user.profile === null — which means EditProfileController bounces it and the native change-password/change-email cards are unreachable until 2d lands. Nothing user-visible: both flags are OFF and Stage A ships after 2d. Recorded at the top of the 2d checklist so it gets done first.

Gates

phpstan · cs-fix · --testsuite "Project Test Suite" (1386 green) · doctrine:schema:validate · cache:warmup. Panther not run in this slice — it is a 2d/hardening gate.

Stopped exactly at

Slice 2c-II complete; every §2c checkbox in the implementation plan is now [x].

Next

Slice 2d — the code sweep: RetrieveLoggedUserProfile for both user classes (do this first, see above), OAuth2AuthorizationSubscriber, the ~50-file Auth0\Symfony\Models\User → UserAccount #[CurrentUser] sweep, the TestingLogin / TestLoginController / Panther base rewrite, UserAccount fixtures, audit-logging listeners + counters, last_login_at, and the Panther login + OAuth2 authorize round-trip tests.

EditProfileController was already moved off the concrete Auth0 User hint here — it had to be, or a native account visiting profile settings would hit a TypeError. The rest of the sweep is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_017o4pbdfkhHDB4vdJPNY3tc