Email verification flow unused (email_verified column exists, nothing checks it) #42

New issue

Open

opened 2026-08-23 05:42:07 +00:00 by nasandre · 1 comment

nasandre commented

2026-08-23 05:42:07 +00:00

Owner

The `users.email_verified` column exists (default false) and every registered account currently works immediately with no verification. There is no send-verification / confirm-email flow.

Options:

If verification is wanted: generate tokens, email link, gate sensitive actions until verified
If not wanted: drop the column usage from serializers/UI or set it true on registration to avoid confusion

Related: no password-reset flow exists either (only admin-side reset in the new Admin panel). A self-service "forgot password" flow would need the same email infrastructure.

The \`users.email_verified\` column exists (default false) and every registered account currently works immediately with no verification. There is no send-verification / confirm-email flow. Options: 1. If verification is wanted: generate tokens, email link, gate sensitive actions until verified 2. If not wanted: drop the column usage from serializers/UI or set it true on registration to avoid confusion Related: no password-reset flow exists either (only admin-side reset in the new Admin panel). A self-service \"forgot password\" flow would need the same email infrastructure.

nasandre added the

Feature

label

2026-08-23 05:42:07 +00:00

openclaw commented

2026-08-23 18:48:01 +00:00

Owner

Automated triage (openclaw monitor):

Diagnosis

The users.email_verified column exists in backend/src/database/schema.sql (default false) but is never validated in backend/src/middleware/auth.ts
backend/src/controllers/authController.ts allows immediate login without verification
No email service infrastructure exists to send verification links
No verification tokens are generated or validated
Related: No password-reset flow exists (only admin-side reset)

Possible fix

Option A: Implement verification flow (recommended for security)

Add email service: backend/src/services/emailService.ts (nodemailer)
Create verification tokens: backend/src/models/emailVerification.ts
Modify authController.register() to:
- Generate token
- Send verification email
- Set email_verified = false
Add GET /auth/verify?token=*** endpoint
Update auth.ts middleware to gate sensitive actions (character/ship management) behind email_verified = true
Add POST /auth/resend-verification endpoint
Implement password-reset flow with same token system

Option B: Remove verification requirement (simpler)

Drop email_verified column from schema.sql
Set email_verified = true in userService.createUser()
Remove verification checks from serializers

Notes / Questions

Is email infrastructure (SMTP/SendGrid) available?
What are security requirements for sensitive actions?
Should password-reset flow be implemented simultaneously?
What's the user base size for migration impact?
Which approach does the team prefer?

Automated triage (openclaw monitor): ## Diagnosis - The `users.email_verified` column exists in `backend/src/database/schema.sql` (default false) but is **never validated** in `backend/src/middleware/auth.ts` - `backend/src/controllers/authController.ts` allows immediate login without verification - No email service infrastructure exists to send verification links - No verification tokens are generated or validated - Related: No password-reset flow exists (only admin-side reset) ## Possible fix **Option A: Implement verification flow (recommended for security)** 1. Add email service: `backend/src/services/emailService.ts` (nodemailer) 2. Create verification tokens: `backend/src/models/emailVerification.ts` 3. Modify `authController.register()` to: - Generate token - Send verification email - Set `email_verified = false` 4. Add `GET /auth/verify?token=***` endpoint 5. Update `auth.ts` middleware to gate sensitive actions (character/ship management) behind `email_verified = true` 6. Add `POST /auth/resend-verification` endpoint 7. Implement password-reset flow with same token system **Option B: Remove verification requirement (simpler)** 1. Drop `email_verified` column from `schema.sql` 2. Set `email_verified = true` in `userService.createUser()` 3. Remove verification checks from serializers ## Notes / Questions - Is email infrastructure (SMTP/SendGrid) available? - What are security requirements for sensitive actions? - Should password-reset flow be implemented simultaneously? - What's the user base size for migration impact? - Which approach does the team prefer?