Email confirmation gate: a code and a link, nothing else until confirmed · 6db9fe3 · flagon-io/g1t

44	44		ReportQueueArgs, ReportReviewArgs,
45	45		};
46	46		use g1t_contracts::identity::AgentScope;
47		−	use g1t_contracts::{Failure, FailureCode, Outcome, PrincipalKind, Viewer};
	47	+	use g1t_contracts::{Failure, FailureCode, Outcome, PrincipalKind, User, Viewer};
48	48		use g1t_kit::wire;
49	49		use serde_json::{Value, json};
50	50		use worker::{Context, Env, Method, Request, Response, Result, event};
⋯
93	93		}
94	94		}
95	95
	96	+	/// What a person whose account has not confirmed its email address may
	97	+	/// call: who they are, their addresses, and confirming one with the code
	98	+	/// from the email. Nothing over MCP.
	99	+	fn pending_may(method: &str, path: &str, on_mcp: bool) -> bool {
	100	+	!on_mcp
	101	+	&& matches!(
	102	+	(method, path.trim_end_matches('/')),
	103	+	("GET", "/user") \| ("GET", "/user/emails") \| ("POST", "/user/emails/confirm")
	104	+	)
	105	+	}
	106	+
96	107		/// An error in the shape every endpoint uses.
97	108		fn failure(failure: &Failure) -> Result<Response> {
98	109		Ok(reply(&json!({ "error": failure }))?.with_status(failure.code.http_status()))
⋯
613	624		Ok(viewer) => viewer,
614	625		Err(refused) => return Ok(refused),
615	626		};
	627	+	// A person who has not confirmed their email address: who they are,
	628	+	// their addresses, and confirming one, nothing else (REST or MCP).
	629	+	if viewer.as_ref().is_some_and(User::awaits_confirmation) && !pending_may(method, &path, on_mcp) {
	630	+	return fail(
	631	+	FailureCode::Forbidden,
	632	+	&g1t_contracts::accounts::confirm_email_first(&services.addresses.site),
	633	+	);
	634	+	}
616	635		services.audit = audit::AuditContext::of(&request, on_mcp);
617	636		// An agent's token: what it may do comes with it, on the composite
618	637		// identity identity resolved it to.
⋯
854	873		use serde_json::json;
855	874
856	875		#[test]
	876	+	fn an_unconfirmed_account_may_only_see_itself_and_confirm_its_address() {
	877	+	assert!(super::pending_may("GET", "/user", false));
	878	+	assert!(super::pending_may("GET", "/user/emails/", false));
	879	+	assert!(super::pending_may("POST", "/user/emails/confirm", false));
	880	+	assert!(!super::pending_may("POST", "/user/emails", false));
	881	+	assert!(!super::pending_may("POST", "/workspaces", false));
	882	+	assert!(!super::pending_may("GET", "/repos/acme/rocket", false));
	883	+	assert!(!super::pending_may("POST", "/user/emails/confirm", true));
	884	+	assert!(!super::pending_may("POST", "/", true));
	885	+	}
	886	+
	887	+	#[test]
857	888		fn a_job_spec_gets_the_toolkits_variables() {
858	889		// As the actions service sends it, converted as the API does.
859	890		let sent = json!({ "variables": { "GITHUB_SHA": "abc" }, "runtime": { "token": "h.p.s", "idToken": true } });

26	26		(
27	27		"Accounts",
28	28		"Signing in from a tool, who a token acts as, and your email addresses.",
29		−	&[Op::Whoami, Op::ListEmails, Op::AddEmail, Op::RemoveEmail, Op::UpdateEmailSettings],
	29	+	&[Op::Whoami, Op::ListEmails, Op::AddEmail, Op::ConfirmEmail, Op::RemoveEmail, Op::UpdateEmailSettings],
30	30		),
31	31		(
32	32		"Notifications",
⋯
535	535		Op::LeaveWorkspace => "Leave a workspace",
536	536		Op::ListEmails => "List your email addresses",
537	537		Op::AddEmail => "Add an email address",
	538	+	Op::ConfirmEmail => "Confirm an email address",
538	539		Op::RemoveEmail => "Remove an email address",
539	540		Op::UpdateEmailSettings => "Change your email settings",
540	541		Op::ListInvites => "List your invites",

114	114		LeaveWorkspace,
115	115		ListEmails,
116	116		AddEmail,
	117	+	ConfirmEmail,
117	118		RemoveEmail,
118	119		UpdateEmailSettings,
119	120		ListInvites,
⋯
671	672		}
672	673
673	674		impl Op {
674		−	pub const ALL: [Op; 308] = [
	675	+	pub const ALL: [Op; 309] = [
675	676		Op::Whoami,
676	677		Op::GetWorkspace,
677	678		Op::CreateWorkspace,
⋯
684	685		Op::LeaveWorkspace,
685	686		Op::ListEmails,
686	687		Op::AddEmail,
	688	+	Op::ConfirmEmail,
687	689		Op::RemoveEmail,
688	690		Op::UpdateEmailSettings,
689	691		Op::ListInvites,
⋯
1001	1003		Op::LeaveWorkspace => "leave_workspace",
1002	1004		Op::ListEmails => "list_emails",
1003	1005		Op::AddEmail => "add_email",
	1006	+	Op::ConfirmEmail => "confirm_email",
1004	1007		Op::RemoveEmail => "remove_email",
1005	1008		Op::UpdateEmailSettings => "update_email_settings",
1006	1009		Op::ListInvites => "list_invites",
⋯
1200	1203		Op::AddEmail => {
1201	1204		"Add an email address to your account. g1t emails it a link to confirm it; until then it cannot be primary and does not sign you in. Adding an address you added before and have not confirmed sends the link again. An address another account has confirmed cannot be added. An account has at most 10. Needs your account `password`; your confirmed addresses are told. People only."
1202	1205		}
	1206	+	Op::ConfirmEmail => {
	1207	+	"Confirm an email address with the six-digit `code` from the confirmation email g1t sent it. The same email has a link that does the same; either one works, once, for 60 minutes, and asking for a new email ends both. A new account must confirm its address before it can do anything else: until then this, `GET /user` and `GET /user/emails` are the only calls its token can make, and everything else, MCP included, is refused with `403`. Confirming a new account's address also joins the workspace its invite named, when the invite still applies: the answer's `joined` names it, or `invite_lapsed` says why not. Ten wrong codes in an hour pause checking for the account. People only."
	1208	+	}
1203	1209		Op::RemoveEmail => {
1204	1210		"Remove an email address from your account. Never your primary address (make another primary first) and never your last confirmed one. Needs your account `password`; every confirmed address, the removed one included, is told. People only."
1205	1211		}
⋯
1744	1750		&[],
1745	1751		),
1746	1752		Op::ListEmails => object(json!({}), &[]),
	1753	+	Op::ConfirmEmail => object(
	1754	+	json!({
	1755	+	"code": {
	1756	+	"type": "string",
	1757	+	"description": "The six-digit code from the confirmation email. Spaces and hyphens are ignored.",
	1758	+	},
	1759	+	}),
	1760	+	&["code"],
	1761	+	),
1747	1762		Op::AddEmail => object(
1748	1763		json!({
1749	1764		"email": { "type": "string", "description": "The address to add." },
⋯
3239	3254		\| Op::LeaveWorkspace
3240	3255		\| Op::ListEmails
3241	3256		\| Op::AddEmail
	3257	+	\| Op::ConfirmEmail
3242	3258		\| Op::RemoveEmail
3243	3259		\| Op::UpdateEmailSettings
3244	3260		\| Op::ListInvites
⋯
3514	3530		// A person's addresses: identity refuses anyone but a person, and
3515	3531		// the password is the proof a sensitive change needs.
3516	3532		Op::ListEmails => pass(identity, "list_emails", &json!({ "user": actor() })).await,
	3533	+	Op::ConfirmEmail => {
	3534	+	pass(
	3535	+	identity,
	3536	+	"confirm_email_code",
	3537	+	&g1t_contracts::accounts::ConfirmEmailCodeArgs { user: actor(), code: text(input, "code"), client: None },
	3538	+	)
	3539	+	.await
	3540	+	}
3517	3541		Op::AddEmail \| Op::RemoveEmail => {
3518	3542		let method = if self == Op::AddEmail { "add_email" } else { "remove_email" };
3519	3543		pass(

282	282		"commit_email": "6c1d0efg+ada@users.noreply.g1t.sh",
283	283		"limit": 10
284	284		},
285		−	"notes": "Answers `403` with code `reauth_required` when `password` is missing or wrong, and `409` when another account has confirmed the address. The new address stays unconfirmed until its link is followed."
	285	+	"notes": "Answers `403` with code `reauth_required` when `password` is missing or wrong, and `409` when another account has confirmed the address. g1t emails the address a six-digit code and a link; it stays unconfirmed until the code is sent to [`confirm_email`](/reference/api/accounts/confirm-email/) or the link is followed."
	286	+	},
	287	+	"confirm_email": {
	288	+	"request": {
	289	+	"code": "482913"
	290	+	},
	291	+	"response": {
	292	+	"username": "ada",
	293	+	"email": "ada@example.com",
	294	+	"verified": true,
	295	+	"joined": "acme",
	296	+	"invite_lapsed": null
	297	+	},
	298	+	"notes": "The code confirms the address it was sent to, and ends the link sent with it. A wrong, used or expired code answers `422` with one message for all three; after ten wrong codes in an hour the account answers `409` for a while, and the link in the email still works. `verified` says whether the account is confirmed: whether its primary address is. `joined` is set when confirming a new account's address joined the workspace its invite named; when the invite was revoked or expired, or the workspace deleted, while the account waited, the address is confirmed all the same and `invite_lapsed` says so. See [Confirming your email address](/guides/authentication/#confirming-your-email-address)."
286	299		},
287	300		"remove_email": {
288	301		"request": {

202	202		Op::ListEmails \| Op::AddEmail \| Op::RemoveEmail \| Op::UpdateEmailSettings => {
203	203		through::<g1t_contracts::accounts::AccountEmails>(op, sent)
204	204		}
	205	+	Op::ConfirmEmail => through::<g1t_contracts::accounts::EmailConfirmed>(op, sent),
205	206		Op::ListInvites => through::<g1t_contracts::identity::InvitesOverview>(op, sent),
206	207		Op::CreateInvite \| Op::RevokeInvite \| Op::InviteMember \| Op::RevokeWorkspaceInvite => {
207	208		through::<g1t_contracts::identity::Invite>(op, sent)

44	44		route("DELETE", "/workspaces/:workspace", Op::DeleteWorkspace, &[]),
45	45		route("GET", "/user/emails", Op::ListEmails, &[]),
46	46		route("POST", "/user/emails", Op::AddEmail, &[]),
	47	+	route("POST", "/user/emails/confirm", Op::ConfirmEmail, &[]),
47	48		route("DELETE", "/user/emails/:email", Op::RemoveEmail, &[]),
48	49		route("PATCH", "/user/email-settings", Op::UpdateEmailSettings, &[]),
49	50		route("GET", "/user/invites", Op::ListInvites, &[]),

494	494		a("whoami", Op::Whoami, "Who the token acts as, and its workspaces"),
495	495		a("list_emails", Op::ListEmails, "Your addresses"),
496	496		a("add_email", Op::AddEmail, "Add an address"),
	497	+	a("confirm_email", Op::ConfirmEmail, "Confirm an address with the code from its email"),
497	498		a("remove_email", Op::RemoveEmail, "Remove an address"),
498	499		a("update_email_settings", Op::UpdateEmailSettings, "Primary, backup and privacy"),
499	500		a("list_invites", Op::ListInvites, "Your invites to g1t"),

11	11		on the same page. Usernames are lowercase letters, digits and single
12	12		hyphens, up to 39 characters.
13	13
	14	+	Before you can do anything else, you [confirm your email
	15	+	address](#confirming-your-email-address) with the code g1t emails you.
	16	+
14	17		Accounts can only be created in a browser. There is no API for it, by
15	18		design: it keeps passwords out of scripts and agents, and lets g1t protect
16	19		the one place accounts are made.
⋯
115	118		- works once, for one new account;
116	119		- works for 30 days;
117	120		- when it was made for an email address, works only with that address;
118		−	- can be revoked by whoever made it until it is used.
	121	+	- can be revoked by whoever made it until it is used, and after that until
	122	+	the new account [confirms its email address](#confirming-your-email-address).
119	123
120	124		### Using an invite
121	125
⋯
124	128		repository, or just making an account), and finishes the job there:
125	129
126	130		1. No account yet: sign up on the page. When the invite was sent to
127		−	your address, the email field is filled in and locked, and the address
128		−	is confirmed already, so no confirmation email follows. Choose a
129		−	username (one is suggested from your address) and a password, or select
	131	+	your address, the email field is filled in and locked. Choose a
	132	+	username (one is suggested from your address) and a password, then
	133	+	[confirm the address](#confirming-your-email-address) with the code g1t
	134	+	emails it, even though the invite came there: an invite link can be
	135	+	forwarded, so it does not prove the inbox is yours. Or select
130	136		Continue with GitHub: the invite rides along, and the account uses
131		−	the invited address when GitHub has verified it too.
	137	+	the invited address when GitHub has verified it too, in which case no
	138	+	confirmation is needed.
132	139		2. The address already has an account: select Sign in to accept.
133	140		After you sign in, the invite is accepted for you.
134	141		3. Signed in as someone else: an invite sent to one address works only
135	142		for an account that has confirmed that address. The page says so and
136	143		offers Sign out and continue.
137	144
138		−	Once the account exists or you have signed in, you land in the workspace
139		−	(or the repository) the invite was for, already a member, with a one-time
140		−	"You're in" banner, and it becomes the workspace your sidebar shows. A
	145	+	Once you have signed in, or your new account has confirmed its address,
	146	+	you land in the workspace (or the repository) the invite was for, already
	147	+	a member, with a one-time "You're in" banner, and it becomes the workspace
	148	+	your sidebar shows.
	149	+
	150	+	Signing up spends the invite at once, so nobody else can use it while you
	151	+	confirm your address, but you join its workspace only when you confirm, in
	152	+	the same step. Until then the invite shows as confirming their email to
	153	+	whoever made it, and they can still revoke it. If the invite is revoked or
	154	+	expires, or its workspace is deleted, before you confirm, your address is
	155	+	confirmed all the same and g1t tells you the invite no longer applies: ask
	156	+	whoever invited you to add you again. A
141	157		code typed at [g1t.sh/register](https://g1t.sh/register) goes to the
142	158		same page.
143	159
⋯
155	171		Each person can have 5 invites out at a time. Pending and used invites
156	172		count; an invite you revoke, or one that expires before anyone uses it,
157	173		comes back to you. The list under the form shows each invite's state:
158		−	pending, joined (with the username of who joined), expired or revoked. You
	174	+	pending, confirming their email (used to sign up by someone who has not
	175	+	confirmed their address yet), joined (with the username of who joined),
	176	+	expired or revoked. You
159	177		must confirm your email before you can make invites. An agent's token and
160	178		a workspace's token cannot make them.
161	179
⋯
163	181
164	182		An owner can invite an email address straight into a workspace from its
165	183		People page; see [members and roles](/guides/workspaces/#members-and-roles).
166		−	When the address has no g1t account, accepting makes the account and joins
167		−	the workspace in one step, and it uses one invite. Inviting someone who is
	184	+	When the address has no g1t account, the invite makes the account, which
	185	+	joins the workspace once it confirms its email address, and it uses one
	186	+	invite. Inviting someone who is
168	187		already on g1t costs nothing.
169	188
170	189		### Need more invites?
⋯
193	212		\| --- \| --- \| --- \|
194	213		\| [`GET /user/invites`](/reference/api/invites/list-invites/) \| `account` `list_invites` \| Your invites and how many you have left \|
195	214		\| [`POST /user/invites`](/reference/api/invites/create-invite/) \| `account` `create_invite` \| Make an invite, optionally for one `email` \|
196		−	\| [`DELETE /user/invites/{id}`](/reference/api/invites/revoke-invite/) \| `account` `revoke_invite` \| Revoke a pending invite \|
	215	+	\| [`DELETE /user/invites/{id}`](/reference/api/invites/revoke-invite/) \| `account` `revoke_invite` \| Revoke a pending invite, or one whose new account has not confirmed its address \|
197	216		\| [`POST /workspaces/{workspace}/invitations`](/reference/api/invites/invite-member/) \| `workspace` `invite_member` \| Invite an address into a workspace. Owners only. \|
198	217
199		−	## Confirming your email
	218	+	## Confirming your email address
	219	+
	220	+	A new account confirms its email address before it can do anything else on
	221	+	g1t. Right after you sign up, g1t emails the address from `noreply@g1t.sh`
	222	+	with two ways to confirm it, either one enough:
	223	+
	224	+	- a six-digit code, shown large in the email (and in its subject, so a
	225	+	phone's notification shows it). Type it on the Confirm your email
	226	+	page g1t takes you to. On a phone, the keyboard offers it from the
	227	+	message.
	228	+	- a link, for when you would rather click than type. It works whether
	229	+	or not you are signed in, in any browser.
	230	+
	231	+	The code and the link work for 60 minutes, once. Using either ends the
	232	+	other. Send a new code on the confirmation page sends a fresh code and
	233	+	link, at most once a minute and 10 times an hour, and the ones before stop
	234	+	working.
	235	+
	236	+	\| On the confirmation page \| What it does \|
	237	+	\| --- \| --- \|
	238	+	\| Confirm email \| Checks the code. A wrong, used or expired code gets the same answer. After 10 wrong codes in an hour, codes for the account are not checked for a while (a minute, then longer); the link in the email still works. Wrong codes from one network are limited the same way. \|
	239	+	\| Send a new code \| A new code and link; the ones before stop working. \|
	240	+	\| Wrong address? Change it \| Replaces the address you signed up with and sends the new one a code. Only while the account has no confirmed address. \|
	241	+	\| Sign out \| Signs out. Sign in again to come back to the page. \|
	242	+
	243	+	### Until you confirm
	244	+
	245	+	An account that has not confirmed its address can only confirm it:
	246	+
	247	+	- The site sends every page to the confirmation page, and back to where
	248	+	you were going once you confirm. Signing in and out, password resets,
	249	+	the confirmation link, and g1t's [policies](https://g1t.sh/policies),
	250	+	security, support, status and pricing pages stay open.
	251	+	- The API answers `403` with a message saying to confirm your address,
	252	+	except for [`GET /user`](/reference/api/accounts/whoami/),
	253	+	[`GET /user/emails`](/reference/api/accounts/list-emails/) and
	254	+	[`POST /user/emails/confirm`](/reference/api/accounts/confirm-email/).
	255	+	- The MCP server answers `403` with the same message.
	256	+	- Git over HTTPS refuses pushes and fetches with your credentials, with
	257	+	the same message. Package registries treat them as wrong credentials.
	258	+	- You cannot create a workspace, join the one your invite named, make
	259	+	invites or tokens, or approve a tool's sign-in.
200	260
201		−	g1t sends a confirmation link from `noreply@g1t.sh`. It works for 24 hours.
	261	+	You cannot make a token before you confirm, so the API and MCP refusals
	262	+	matter only for an account that made one before this rule existed.
202	263
203		−	Until you follow it you can sign in and look around, but you cannot create
204		−	repositories, push, or open issues and pull requests. Those requests fail with `403` and a
205		−	message telling you to confirm your address. To get a new link, sign in and
206		−	use the banner at the top of the site.
	264	+	### Addresses GitHub has confirmed
207	265
	266	+	An account made with Continue with GitHub starts confirmed: its address
	267	+	is one GitHub has verified, so GitHub has already proved the inbox is
	268	+	yours, and no code is sent.
	269	+
	270	+	### Accounts that never confirmed
	271	+
	272	+	Accounts are confirmed once and stay confirmed. An account made before this
	273	+	rule that never confirmed its address, or whose address another account
	274	+	confirmed first, is held at the confirmation page the same way the next
	275	+	time it signs in; Send a new code gets it a code, and Change it
	276	+	gives it a new address.
	277	+
	278	+	### Confirming through the API
	279	+
	280	+	\| Route \| MCP tool and action \| What it does \|
	281	+	\| --- \| --- \| --- \|
	282	+	\| [`POST /user/emails/confirm`](/reference/api/accounts/confirm-email/) \| `account` `confirm_email` \| Confirm an address with the `code` from its email \|
	283	+
	284	+	The answer says whether the account is now confirmed (`verified`), the
	285	+	workspace confirming joined it to (`joined`), or why its invite no longer
	286	+	applies (`invite_lapsed`).
	287	+
208	288		## Email addresses
209	289
210	290		An account can have up to 10 email addresses. Manage them in
⋯
215	295		\| Primary \| Get account mail and password reset links. Exactly one, always confirmed once any address is. \|
216	296		\| Confirmed \| Sign you in (type it instead of your username), ask for a password reset, and mark commits that carry it as yours. \|
217	297		\| Backup \| Get security notices as well as the primary. Optional, and a confirmed address other than the primary. \|
218		−	\| Unconfirmed \| Nothing yet. It is not yours until you follow the link g1t sent it. \|
	298	+	\| Unconfirmed \| Nothing yet. It is not yours until you enter the code or follow the link g1t sent it. \|
219	299
220	300		A confirmed address belongs to one account. Anyone can add an address they
221		−	have not confirmed; the first account to follow its link keeps it, and the
	301	+	have not confirmed; the first account to confirm it keeps it, and the
222	302		address leaves every other account that added it. An address another
223	303		account has confirmed cannot be added.
224	304
⋯
226	306
227	307		1. Open [Settings → Emails](https://g1t.sh/settings/emails).
228	308		2. Enter the address under Add an email address and select Add.
229		−	3. Follow the link g1t sends it. The link works for 24 hours; **Resend
230		−	link** sends a new one, at most once a minute and 10 times an hour.
	309	+	3. Enter the code g1t emails it, or follow the link in the same email.
	310	+	Both work for 60 minutes; Resend link sends a new code and link, at
	311	+	most once a minute and 10 times an hour, and ends the ones before.
231	312
232	313		If your account had no confirmed address yet, the first one you confirm
233	314		becomes your primary.
⋯
312	393		\| --- \| --- \| --- \|
313	394		\| [`GET /user/emails`](/reference/api/accounts/list-emails/) \| `account` `list_emails` \| Your addresses and email settings \|
314	395		\| [`POST /user/emails`](/reference/api/accounts/add-email/) \| `account` `add_email` \| Add an address; takes `email` and `password` \|
	396	+	\| [`POST /user/emails/confirm`](/reference/api/accounts/confirm-email/) \| `account` `confirm_email` \| Confirm an address with the `code` from its email \|
315	397		\| [`DELETE /user/emails/{email}`](/reference/api/accounts/remove-email/) \| `account` `remove_email` \| Remove an address; takes `password` \|
316	398		\| [`PATCH /user/email-settings`](/reference/api/accounts/update-email-settings/) \| `account` `update_email_settings` \| Change `primary`, `backup`, `private_email` or `block_private_pushes` \|
317	399

62	62		3. Open [http://localhost:8787](http://localhost:8787) and create an
63	63		account.
64	64		4. Open the Mailpit inbox at [http://localhost:8025](http://localhost:8025)
65		−	and follow the link in the confirmation email.
	65	+	and enter the code from the confirmation email on the page the site
	66	+	shows you, or follow the link in the same email. Set `IDENTITY_KEY`
	67	+	(the setup does) so codes are kept as keyed hashes.
66	68		5. Create a workspace, then a repository.
67	69
68	70		## Push and clone

332	332		never says which it was.
333	333
334	334		The email names you and the workspace and links to the invite's page.
335		−	Someone new signs up right there, with the invited address filled in and
336		−	already confirmed; someone with an account signs in. Either way they land
337		−	in the workspace as a member, with a one-time welcome. See
	335	+	Someone new signs up right there, with the invited address filled in, and
	336	+	joins once they confirm it with the code g1t emails them; someone with an
	337	+	account signs in. Either way they land in the workspace as a member, with
	338	+	a one-time welcome. Until a new account confirms its address, its invite
	339	+	shows as confirming their email under the members, and you can still
	340	+	revoke it. See
338	341		[using an invite](/guides/authentication/#using-an-invite).
339	342
340	343		Pending invites are listed under the members, with a link to copy and

23	23
24	24		[Sign up](https://g1t.sh/register) with your invite (g1t is invite-only
25	25		for now; see [invites](/guides/authentication/#invites)) and confirm your
26		−	email. Then create a
	26	+	email with the code g1t sends it (or the link in the same email). Then create a
27	27		workspace: it owns repositories and is the first part of their
28	28		address, `g1t.sh/<workspace>/<repo>`. See [workspaces](/guides/workspaces/).
29	29

729	729		invites while g1t is [invite-only](/guides/authentication/#invites), and
730	730		invitations to repositories waiting for you. `whoami` is the default
731	731		action, and needs no scope. An agent's token and a workspace's token cannot
732		−	use the email and invite actions.
	732	+	use the email and invite actions. An account that has not confirmed its
	733	+	email address gets `403` from every tool until it does; see
	734	+	[until you confirm](/guides/authentication/#until-you-confirm).
733	735
734	736		\| Action \| What it does \| Required \| Scope \|
735	737		\| --- \| --- \| --- \| --- \|
736	738		\| [`whoami`](/reference/api/accounts/whoami/) \| Who the access token acts as, and the workspaces it can work in. `kind` is `user`, `workspace` or `agent`. \| None \| None \|
737	739		\| [`list_emails`](/reference/api/accounts/list-emails/) \| Your email addresses and email settings. People only. \| None \| `account:read` \|
738		−	\| [`add_email`](/reference/api/accounts/add-email/) \| Add an address; g1t emails it a link to confirm it. \| `email`, `password` \| `account:write` \|
	740	+	\| [`add_email`](/reference/api/accounts/add-email/) \| Add an address; g1t emails it a code and a link to confirm it. \| `email`, `password` \| `account:write` \|
	741	+	\| [`confirm_email`](/reference/api/accounts/confirm-email/) \| Confirm an address with the six-digit code from its email. See [confirming your email address](/guides/authentication/#confirming-your-email-address). \| `code` \| `account:write` \|
739	742		\| [`remove_email`](/reference/api/accounts/remove-email/) \| Remove an address; never the primary or the last confirmed one. \| `email`, `password` \| `account:write` \|
740	743		\| [`update_email_settings`](/reference/api/accounts/update-email-settings/) \| Change `primary` or `backup` (with `password`), `private_email` or `block_private_pushes`. See [email addresses](/guides/authentication/#email-addresses). \| None \| `account:write` \|
741	744		\| [`list_invites`](/reference/api/invites/list-invites/) \| Your invites, newest first, and how many you have left. \| None \| `account:read` \|

Binary or large file; its contents are not shown.

137	137		switch (invite.status) {
138	138		case "pending":
139	139		return <Badge tone="lavender">Pending</Badge>;
	140	+	case "awaiting_confirmation":
	141	+	return <Badge tone="lavender">Used{invite.redeemedBy ? ` by ${invite.redeemedBy}` : ""}, email not confirmed</Badge>;
140	142		case "redeemed":
141	143		return <Badge tone="mint">Used{invite.redeemedBy ? ` by ${invite.redeemedBy}` : ""}</Badge>;
142	144		case "expired":

19	19		<div className="flex flex-wrap items-center gap-x-3 gap-y-1">
20	20		<span className={`inline-flex items-center rounded-full border px-2 py-0.5 text-xs ${TONE[state.tone]}`}>{state.label}</span>
21	21		<span className="min-w-0 truncate text-sm">{inviteFor(invite)}</span>
22		−	{invite.status === "pending" && (
	22	+	{(invite.status === "pending" \|\| invite.status === "awaiting_confirmation") && (
23	23		<Form method="post" className="ml-auto">
24	24		<input type="hidden" name="intent" value="revoke-invite" />
25	25		<input type="hidden" name="id" value={invite.id} />

1	+	import assert from "node:assert/strict";
2	+	import { readFileSync } from "node:fs";
3	+	import { test } from "node:test";
4	+
5	+	import { CONFIRM_PATH, afterConfirming, confirmGate, confirmedLine, openWhilePending, pageOf } from "./confirm-gate.ts";
6	+
7	+	const pending = { verified: false };
8	+	const confirmed = { verified: true };
9	+
10	+	test("a pending account is sent to confirm its address from every app page", () => {
11	+	assert.equal(confirmGate("/", "", pending), CONFIRM_PATH);
12	+	assert.equal(confirmGate("/acme", "", pending), `${CONFIRM_PATH}?next=%2Facme`);
13	+	assert.equal(confirmGate("/workspaces/new", "?next=/x", pending), `${CONFIRM_PATH}?next=%2Fworkspaces%2Fnew%3Fnext%3D%252Fx`);
14	+	assert.equal(confirmGate("/settings/tokens", "", pending), `${CONFIRM_PATH}?next=%2Fsettings%2Ftokens`);
15	+	assert.equal(confirmGate("/invite/g1t-abcd", "", pending), `${CONFIRM_PATH}?next=%2Finvite%2Fg1t-abcd`);
16	+	assert.equal(confirmGate("/acme/rocket/pulls", "?state=open", pending), `${CONFIRM_PATH}?next=%2Facme%2Frocket%2Fpulls%3Fstate%3Dopen`);
17	+	});
18	+
19	+	test("client navigations are gated as the page they load", () => {
20	+	assert.equal(pageOf("/acme.data"), "/acme");
21	+	assert.equal(pageOf("/_root.data"), "/");
22	+	assert.equal(confirmGate("/acme/rocket.data", "?_routes=routes%2Frepo%2Flayout", pending), `${CONFIRM_PATH}?next=%2Facme%2Frocket`);
23	+	assert.equal(confirmGate("/_root.data", "", pending), CONFIRM_PATH);
24	+	assert.equal(confirmGate("/confirm-email.data", "", pending), null);
25	+	});
26	+
27	+	test("the pages confirming needs, and the public pages about g1t, stay open", () => {
28	+	for (const path of [
29	+	"/confirm-email",
30	+	"/verify",
31	+	"/logout",
32	+	"/login",
33	+	"/login/two-factor",
34	+	"/register",
35	+	"/forgot",
36	+	"/reset",
37	+	"/policies",
38	+	"/policies/terms",
39	+	"/security",
40	+	"/support",
41	+	"/status",
42	+	"/pricing",
43	+	"/auth/github/callback",
44	+	"/.well-known/security.txt",
45	+	]) {
46	+	assert.equal(openWhilePending(path), true, path);
47	+	assert.equal(confirmGate(path, "", pending), null, path);
48	+	}
49	+	for (const path of ["/", "/explore", "/search", "/settings", "/settings/emails", "/device", "/oauth/authorize", "/new", "/inbox"]) {
50	+	assert.equal(openWhilePending(path), false, path);
51	+	}
52	+	});
53	+
54	+	test("confirmed accounts, visitors and non-people are never gated", () => {
55	+	assert.equal(confirmGate("/acme", "", confirmed), null);
56	+	assert.equal(confirmGate("/acme", "", null), null);
57	+	assert.equal(confirmGate("/acme", "", { kind: "workspace", verified: false }), null);
58	+	assert.equal(confirmGate("/acme", "", { kind: "user" }), `${CONFIRM_PATH}?next=%2Facme`);
59	+	});
60	+
61	+	test("what the page says once confirmed, and where it goes", () => {
62	+	assert.equal(confirmedLine({}), "Your email address is confirmed.");
63	+	assert.equal(confirmedLine({ joined: "acme" }), "Your email address is confirmed, and you have joined acme.");
64	+	assert.match(confirmedLine({ inviteLapsed: "Your email address is confirmed. The invite … was revoked" }), /revoked/);
65	+	assert.equal(afterConfirming("/", "acme"), "/acme");
66	+	assert.equal(afterConfirming("/acme/rocket", "acme"), "/acme/rocket");
67	+	assert.equal(afterConfirming("", null), "/");
68	+	});
69	+
70	+	test("the code field is a one-time code typed with a number pad", () => {
71	+	const page = readFileSync(new URL("../routes/confirm-email.tsx", import.meta.url), "utf8");
72	+	const input = /<Input[\s\S]?name="code"[\s\S]?\/>/.exec(page)?.[0] ?? "";
73	+	assert.match(input, /autoComplete="one-time-code"/);
74	+	assert.match(input, /inputMode="numeric"/);
75	+	assert.match(input, /pattern="\[0-9 -\]\*"/);
76	+	// Either route: the page says the link in the email works too.
77	+	assert.match(page, /link in the email/);
78	+	});

Binary or large file; its contents are not shown.