feat/email-registration #212

islandbitcoin · 2025-09-16T20:00:42Z

Summary

Implements email-only authentication flow for new user registration, allowing users to sign up with just an email address (no phone required).

Key Changes:

New GraphQL mutations: newUserEmailRegistrationInitiate and newUserEmailRegistrationValidate
Kratos identity schema for email-only accounts (email_no_password_v0)
Account upgrade path: device accounts can upgrade to email accounts
Registration payload validation for email-based flows

How It Works

Client calls newUserEmailRegistrationInitiate with email
Backend creates Kratos identity, sends OTP via recovery flow
Client calls newUserEmailRegistrationValidate with flowId + code
Backend validates code, creates account if new, returns auth token

Files Changed (43 files, +855/-216)

Core Implementation:

src/graphql/public/root/mutation/new-user-email-registration-*.ts - GraphQL mutations
src/app/authentication/email.ts - Email authentication logic
src/services/kratos/auth-email-no-password.ts - Kratos integration
src/app/accounts/create-account.ts - Account creation updates
src/app/accounts/upgrade-device-account.ts - Device → Email upgrade
src/domain/authentication/registration-payload-validator.ts - Validation logic
dev/ory/kratos.yml - Kratos configuration

Test Infrastructure:

Fixed TypeScript errors from main rebase (branded types, mock updates, API changes)

Known Issues / Follow-up Tickets

🔴 HIGH PRIORITY (security review needed)

Account Enumeration Vulnerability
- Location: src/services/kratos/auth-email-no-password.ts lines 73-78
- Issue: createIdentityForEmailRegistration() reveals whether email is already registered
- Mitigation: Should return consistent response regardless of email existence
Missing TOTP Flow Completion
- Location: newUserEmailRegistrationValidate returns totpRequired but no follow-up verification
- Issue: If TOTP is required, there's no mutation to complete the flow
- Needs: Document expected client behavior or implement TOTP verification step
Race Condition in Account Creation
- Location: new-user-email-registration-validate.ts lines 63-78
- Issue: Concurrent code validations could create duplicate accounts
- Mitigation: Add distributed lock or database constraint

🟡 MEDIUM PRIORITY (tech debt)

Inconsistent Error Handling - "dead branch" error message (line 162-163)
Hardcoded Schema ID - Should use SchemaIdType.EmailNoPasswordV0 enum
Known Account Enumeration TODO - FIXME at lines 415-419 not addressed
Missing Transaction Handling - Multi-step operations in upgrade-device-account.ts

🟢 LOW PRIORITY

Unused import pattern in validate mutation
Undocumented GraphQL complexity value (120)
Direct Kratos DB access (documented workaround for issue #3163)

Testing

TypeScript compiles (yarn tsc --noEmit - 0 errors)
Integration tests (pre-existing failures unrelated to this PR)

Checklist

Code follows project conventions
TypeScript errors resolved
Security issues documented for follow-up
Ready for review

brh28

There's already the following definition in the graphql schema, which appears to the same or similar to what's being done in this PR:

  userEmailRegistrationInitiate(input: UserEmailRegistrationInitiateInput!): UserEmailRegistrationInitiatePayload!
  userEmailRegistrationValidate(input: UserEmailRegistrationValidateInput!): UserEmailRegistrationValidatePayload!

dev/ory/email-template.html

src/graphql/admin/schema.graphql

islandbitcoin · 2025-10-16T17:07:12Z

There's already the following definition in the graphql schema, which appears to the same or similar to what's being done in this PR:
  userEmailRegistrationInitiate(input: UserEmailRegistrationInitiateInput!): UserEmailRegistrationInitiatePayload!
  userEmailRegistrationValidate(input: UserEmailRegistrationValidateInput!): UserEmailRegistrationValidatePayload!

These definitions do not allow for a email registration without an existing account. The choice was to modify these, to handle both cases (with account and without account) or create a new schema definition for new accounts.

islandbitcoin · 2025-10-27T15:14:24Z

@brh28 please review

brh28 · 2025-10-27T16:00:13Z

src/app/accounts/upgrade-device-account.ts

+  // so that if one fails, the other is rolled back
+
+  // 1. Update user record with email (deviceId is preserved via spread)
+  const userUpdated = await UsersRepository().findById(userId)


Lines 60-65 can be consolidated to a single database update. The function would be something like:

addEmail: (userId, email) => db.updateOne( { userId }, { $set: { email })

brh28 · 2025-10-27T16:00:58Z

src/app/accounts/upgrade-device-account.ts

+  userId: UserId
+  email: EmailAddress
+}): Promise<Account | RepositoryError> => {
+  // TODO: ideally both 1. and 2. should be done in a transaction,


I don't believe there's a way to make this atomic unless we completely rewrite our data model

brh28 · 2025-10-27T16:22:47Z

src/app/authentication/create-account-from-email-registration.ts

+
+import { createAccountWithEmailIdentifier } from "@app/accounts"
+
+export const createAccountFromEmailRegistrationPayload = async ({


where is this function being called?

nowhere! apparently its leftover from a previous attempt at getting this to work. Removed the file and the export reference

brh28

Can we do a code walk through on this one? I'm having a hard time following

brh28 · 2025-10-30T18:49:21Z

Related to: #237

islandbitcoin · 2025-11-17T21:41:39Z

@brh28 I think this is ready for a code review again, since we patched the orphaned accounts issue.

brh28 · 2025-12-30T20:00:47Z

src/graphql/public/root/mutation/new-user-email-registration-validate.ts

+    const accountsRepo = AccountsRepository()
+    let account = await accountsRepo.findByUserId(kratosUserId)
+
+    if (account instanceof Error) {


probably should be checking for a specific response, such as AccountNotFoundError

brh28 · 2025-12-30T20:11:25Z

src/services/kratos/auth-email-no-password.ts

+      } else {
+        // Create new identity with email
+        const createIdentityBody = {
+          credentials: { password: { config: { password } } },


does password have a value?

brh28 · 2025-12-30T20:26:27Z

src/services/kratos/auth-email-no-password.ts

+      }
+
+      // Send OTP code via recovery flow
+      const { data: recoveryFlow } = await kratosPublic.createNativeRecoveryFlow()


verify we want createNativeRecoveryFlow rather than createNativeRegistrationFlow

brh28 · 2025-12-30T20:52:29Z

src/services/mongoose/schema.ts

      type: [String],
    },
-    deviceId: {
+    email: {


emails are already stored in Kratos. Is there any reason not to use the postrgres database here?

- New GraphQL mutations: newUserEmailRegistrationInitiate and newUserEmailRegistrationValidate for email-only account creation - Kratos integration: Successfully using email recovery flow for OTP delivery - Account creation: Fixed critical bug where accounts weren't being created after validation - Code cleanup: Removed all debug console.log statements ✅ Key Changes Made 1. Fixed validation logic - Changed from checking User existence to Account existence 2. Proper account creation - Creates account with wallets when none exists 3. Clean production code - Removed debug statements for production readiness

This commit consolidates all TypeScript fixes required after rebasing the email-registration feature branch on main: - Update core Account and Wallet mocks with mandatory properties (npub, lnurlp) - Adapt to upstream API changes (@ory/client IdentityState → IdentityStateEnum) - Fix test infrastructure mock type conversions and exports - Replace deleted BTC wallet functions with USD equivalents - Use factory functions for branded types (OnChainAddress, FractionalCentAmount) - Fix OffersManager constructability and CSV export method names - Add type casts for transaction and wallet type incompatibilities Result: yarn tsc --noEmit returns 0 errors

…lidation deferral - Add ValidationError import to redeem-invite.ts to fix TypeScript errors - Document that email validation is deferred until email-only registration feature is available (see PR #212)

islandbitcoin · 2026-01-27T17:12:24Z

Closed as deferred

islandbitcoin requested a review from brh28 September 16, 2025 20:00

islandbitcoin self-assigned this Sep 16, 2025

islandbitcoin added the enhancement New feature or request label Sep 16, 2025

islandbitcoin force-pushed the feat/email-registration branch from 81894da to 66e733f Compare September 17, 2025 15:54

brh28 reviewed Oct 7, 2025

View reviewed changes

dev/ory/email-template.html Show resolved Hide resolved

src/graphql/admin/schema.graphql Outdated Show resolved Hide resolved

islandbitcoin force-pushed the feat/email-registration branch from 66e733f to 90f293e Compare October 17, 2025 22:08

islandbitcoin requested a review from brh28 October 17, 2025 22:33

brh28 reviewed Oct 27, 2025

View reviewed changes

islandbitcoin changed the title ~~[feat] account creation using only email (no phone)~~ feat/email-registration Dec 29, 2025

brh28 reviewed Dec 30, 2025

View reviewed changes

islandbitcoin mentioned this pull request Jan 21, 2026

[feat/email-registration] #256

Closed

islandbitcoin added 5 commits January 26, 2026 17:31

update email pathways

50a8fff

update comments

db02cb7

updated based on PR Feedback

3bfe8b1

islandbitcoin force-pushed the feat/email-registration branch from fdea49c to 204ac45 Compare January 27, 2026 12:28

brh28 self-requested a review January 27, 2026 15:25

This was referenced Jan 27, 2026

feat(invite): Referral system with Email/SMS/WhatsApp invites #259

Closed

feat: Email-Only User Registration #260

Open

feat: Referral System with Email/SMS/WhatsApp Invites #261

Open

islandbitcoin closed this Jan 27, 2026


		import { createAccountWithEmailIdentifier } from "@app/accounts"

		export const createAccountFromEmailRegistrationPayload = async ({

feat/email-registration #212

feat/email-registration #212

Uh oh!

Conversation

islandbitcoin commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How It Works

Files Changed (43 files, +855/-216)

Known Issues / Follow-up Tickets

🔴 HIGH PRIORITY (security review needed)

🟡 MEDIUM PRIORITY (tech debt)

🟢 LOW PRIORITY

Testing

Checklist

Uh oh!

brh28 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

islandbitcoin commented Oct 16, 2025

Uh oh!

islandbitcoin commented Oct 27, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brh28 left a comment

Choose a reason for hiding this comment

Uh oh!

brh28 commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

islandbitcoin commented Nov 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

islandbitcoin commented Jan 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

islandbitcoin commented Sep 16, 2025 •

edited

Loading

brh28 commented Oct 30, 2025 •

edited

Loading