Skip to content

Auth: document the magic-link feature#49

Open
RandyJDean wants to merge 1 commit into
07-09-auth_frontend_login_verify_session_and_logoutfrom
07-09-auth_document_the_magic-link_feature
Open

Auth: document the magic-link feature#49
RandyJDean wants to merge 1 commit into
07-09-auth_frontend_login_verify_session_and_logoutfrom
07-09-auth_document_the_magic-link_feature

Conversation

@RandyJDean

@RandyJDean RandyJDean commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
  • docs/auth-feature.md mirrors the email-feature doc: shape, login
    walkthrough, dev log-link trick, and configuration table
  • AGENTS.md auth row now reflects magic links + Spring Session JDBC

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

@RandyJDean @claude
Auth: document the magic-link feature
cbf9d36 
- docs/auth-feature.md mirrors the email-feature doc: shape, login
  walkthrough, dev log-link trick, and configuration table
- AGENTS.md auth row now reflects magic links + Spring Session JDBC

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 9, 2026
Open
Open
Open
@RandyJDean Graphite App

RandyJDean commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

This stack of pull requests is managed by Graphite. Learn more about stacking.

This was referenced Jul 9, 2026
Open
Open
Open
@sonarqubecloud

sonarqubecloud Bot commented Jul 9, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@RandyJDean RandyJDean mentioned this pull request Jul 10, 2026
Open
@RandyJDean RandyJDean marked this pull request as ready for review July 10, 2026 18:47
@RandyJDean RandyJDean requested a review from a team as a code owner July 10, 2026 18:47
@graphite-app graphite-app Bot requested review from Arshadul-Monir and arklian and removed request for arklian July 10, 2026 18:47
@graphite-app

graphite-app Bot commented Jul 10, 2026

Copy link
Copy Markdown

Graphite Automations

"Request reviewers once CI passes" took an action on this PR • (07/10/26)

2 reviewers were added to this PR based on Henry Chen's automation.

spiffyy99
spiffyy99 requested changes Jul 13, 2026
View reviewed changes
Comment thread docs/auth-feature.md
email, receives a single-use link, and clicking it establishes a server-side session delivered as an
httpOnly cookie.

**Unified signup/login.** Requesting a link never reveals whether an account exists (the response is

@spiffyy99 spiffyy99 Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the design of this signup flow is pretty focused on avoiding revealing whether or not the email is in the system, which it seems is why we have a silent rate limit?

That's fine to target but seems to lead to bad UX for legitimate users here because users also won't know if they are rate limited. This may actually lead to more attempts.

What if we rate limited (with a 429) for all emails, including non-registered ones? There will still be no distinction between registered and non-registered emails. Does that make sense?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spiffyy99 spiffyy99 spiffyy99 requested changes
@Arshadul-Monir Arshadul-Monir Awaiting requested review from Arshadul-Monir

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@RandyJDean @spiffyy99