diff --git a/backend/internal/account/account.go b/backend/internal/account/account.go
index 9da3bc5..2b10fc8 100644
--- a/backend/internal/account/account.go
+++ b/backend/internal/account/account.go
@@ -122,21 +122,35 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
// ProvisionEmail returns the account owning the email identity externalID, creating
// it on first contact with browserTZ — the client's detected "±HH:MM" UTC offset —
-// seeded into its time zone and language seeded from the client's UI language. Like
+// seeded into its time zone, language seeded from the client's UI language, and its
+// display name seeded from the email's local part (so it is not left nameless). Like
// ProvisionByIdentity it is race-safe and leaves an existing account untouched, so a
-// returning user's saved zone and language are never overwritten. The email account is
+// returning user's saved zone, language and name are never overwritten. The email account is
// created here (the code-request step), not at the later login, so this is where its
// zone and language are seeded. It is created flagged is_guest with an unconfirmed
// email identity: an abandoned, never-confirmed login is then reaped like any guest,
// freeing the reserved address, and confirming the code clears the guest flag.
func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ, language string) (Account, error) {
return s.provision(ctx, KindEmail, externalID, provisionSeed{
+ displayName: emailDisplayName(externalID),
timeZone: seedZone(browserTZ),
preferredLanguage: supportedLanguage(language),
isGuest: true,
})
}
+// emailDisplayName derives a display name from an email address — the local part
+// before '@', trimmed and capped to the column width — so a new email account is not
+// left nameless. It is only the first-contact seed; the user can rename it later.
+func emailDisplayName(email string) string {
+ local, _, _ := strings.Cut(email, "@")
+ local = strings.TrimSpace(local)
+ if r := []rune(local); len(r) > maxDisplayName {
+ local = strings.TrimRight(string(r[:maxDisplayName]), " ")
+ }
+ return local
+}
+
// supportedLanguage returns code normalised to a supported UI language ("en" or
// "ru"), or "" when it maps to neither, so a new account keeps the 'en' default. It
// accepts region-tagged codes ("ru-RU").
diff --git a/backend/internal/account/email.go b/backend/internal/account/email.go
index e4df71f..64f7d53 100644
--- a/backend/internal/account/email.go
+++ b/backend/internal/account/email.go
@@ -5,6 +5,7 @@ import (
crand "crypto/rand"
"crypto/sha256"
"database/sql"
+ "encoding/base64"
"encoding/hex"
"errors"
"fmt"
@@ -26,6 +27,11 @@ const (
emailCodeTTL = 15 * time.Minute
// emailCodeMaxAttempts caps wrong-code submissions before a code is dead.
emailCodeMaxAttempts = 5
+ // linkTokenBytes is the entropy of a confirm deeplink token: 256 bits.
+ linkTokenBytes = 32
+ // emailConfirmPath is the SPA route the one-tap confirm deeplink opens (the token
+ // is appended). The SPA is served under /app/ behind a hash router.
+ emailConfirmPath = "/app/#/confirm/"
)
// Confirmation purposes recorded on a pending confirm-code row. They select what
@@ -92,18 +98,23 @@ func (s *EmailService) allowSend(email string) bool {
return s.limiter == nil || s.limiter.Allow(email)
}
-// issueCode generates a fresh confirm-code for (accountID, email), replaces any prior
-// pending confirmation, and mails the branded code in locale; purpose selects the
-// email wording. Only the SHA-256 hash of the code is stored.
+// issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
+// email), replaces any prior pending confirmation, and mails the branded code in
+// locale; purpose selects the email wording and what verifying does. Only the SHA-256
+// hashes of the code and token are stored.
func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string) error {
code, codeHash, err := generateCode()
if err != nil {
return err
}
- if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, s.now().Add(emailCodeTTL)); err != nil {
+ token, tokenHash, err := generateLinkToken()
+ if err != nil {
return err
}
- msg, err := renderConfirmationEmail(purpose, code, "", s.baseURL, locale)
+ if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
+ return err
+ }
+ msg, err := renderConfirmationEmail(purpose, code, s.confirmURL(token, locale), s.baseURL, locale)
if err != nil {
return err
}
@@ -111,6 +122,16 @@ func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email
return s.mailer.Send(ctx, msg)
}
+// confirmURL builds the absolute one-tap confirm deeplink for token in locale, or ""
+// when no public base URL is configured. The locale rides the fragment as ?lang so the
+// confirm screen (opened in a browser with no session) renders in the email's language.
+func (s *EmailService) confirmURL(token, locale string) string {
+ if s.baseURL == "" {
+ return ""
+ }
+ return strings.TrimRight(s.baseURL, "/") + emailConfirmPath + token + "?lang=" + normalizeLocale(locale)
+}
+
// accountLocale returns the account's preferred UI language for localising email,
// defaulting to "en" when the account cannot be loaded.
func (s *EmailService) accountLocale(ctx context.Context, accountID uuid.UUID) string {
@@ -241,6 +262,75 @@ func (s *EmailService) LoginWithCode(ctx context.Context, email, code string) (A
return s.store.GetByID(ctx, acc.ID)
}
+// LinkConfirmation is the outcome of confirming a one-tap deeplink token: what the
+// transport layer must finish. Purpose is the pending row's purpose. For a login,
+// Account is the account to sign in. For a link, Account is the account the email was
+// (or would be) attached to; NeedsMerge is set when another account (MergeOwner)
+// already owns the address, so the caller drives the interactive merge instead of a
+// plain link — the token is left unconsumed for that merge step.
+type LinkConfirmation struct {
+ Purpose string
+ Account uuid.UUID
+ NeedsMerge bool
+ MergeOwner uuid.UUID
+}
+
+// IsLogin reports whether the confirmation is a login (the caller mints a session)
+// rather than a link (attach the identity, or drive a merge).
+func (r LinkConfirmation) IsLogin() bool { return r.Purpose == purposeLogin }
+
+// ConfirmByToken verifies a one-tap deeplink token and performs its purpose. A login
+// confirms the email identity, clears the guest flag and returns the account to sign
+// in. A link attaches the confirmed email to the pending account when the address is
+// free, or reports NeedsMerge when another account already owns it (leaving the token
+// live so the caller's merge step can re-verify). It returns ErrNoPendingCode when the
+// token matches no live confirmation and ErrCodeExpired when it has lapsed. The token
+// is high-entropy, so there is no wrong-attempt counter.
+func (s *EmailService) ConfirmByToken(ctx context.Context, token string) (LinkConfirmation, error) {
+ pend, err := s.store.pendingByTokenHash(ctx, hashCode(token))
+ if err != nil {
+ return LinkConfirmation{}, err
+ }
+ if s.now().After(pend.expiresAt) {
+ return LinkConfirmation{}, ErrCodeExpired
+ }
+ switch pend.purpose {
+ case purposeLogin:
+ if err := s.store.confirmEmailLogin(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
+ return LinkConfirmation{}, err
+ }
+ if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
+ return LinkConfirmation{}, err
+ }
+ return LinkConfirmation{Purpose: purposeLogin, Account: pend.accountID}, nil
+ case purposeLink:
+ owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
+ if err != nil {
+ return LinkConfirmation{}, err
+ }
+ if ok {
+ if owner == pend.accountID {
+ if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
+ return LinkConfirmation{}, err
+ }
+ return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
+ }
+ return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID, NeedsMerge: true, MergeOwner: owner}, nil
+ }
+ if err := s.store.confirmEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
+ return LinkConfirmation{}, err
+ }
+ // Binding the first email promotes a guest to a durable account, matching the
+ // code-based link flow (which clears the guest flag in the link service).
+ if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
+ return LinkConfirmation{}, err
+ }
+ return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
+ default:
+ return LinkConfirmation{}, fmt.Errorf("account: unsupported confirmation purpose %q", pend.purpose)
+ }
+}
+
// emailConfirmation is a pending confirm-code row in domain form.
type emailConfirmation struct {
id uuid.UUID
@@ -271,7 +361,7 @@ func (s *Store) confirmedEmailAccount(ctx context.Context, email string) (uuid.U
// replacePendingConfirmation clears any pending code for (accountID, email) and
// inserts a fresh one, inside one transaction.
-func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash string, expiresAt time.Time) error {
+func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash, linkTokenHash, purpose string, expiresAt time.Time) error {
id, err := uuid.NewV7()
if err != nil {
return fmt.Errorf("account: new confirmation id: %w", err)
@@ -288,7 +378,8 @@ func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.U
ins := table.EmailConfirmations.INSERT(
table.EmailConfirmations.ConfirmationID, table.EmailConfirmations.AccountID,
table.EmailConfirmations.Email, table.EmailConfirmations.CodeHash, table.EmailConfirmations.ExpiresAt,
- ).VALUES(id, accountID, email, codeHash, expiresAt)
+ table.EmailConfirmations.LinkTokenHash, table.EmailConfirmations.Purpose,
+ ).VALUES(id, accountID, email, codeHash, expiresAt, linkTokenHash, purpose)
if _, err := ins.ExecContext(ctx, tx); err != nil {
return fmt.Errorf("insert confirmation: %w", err)
}
@@ -321,6 +412,54 @@ func (s *Store) latestPendingConfirmation(ctx context.Context, accountID uuid.UU
}, nil
}
+// pendingConfirmation is a pending confirm-code row loaded by its deeplink token, in
+// domain form.
+type pendingConfirmation struct {
+ id uuid.UUID
+ accountID uuid.UUID
+ email string
+ purpose string
+ expiresAt time.Time
+}
+
+// pendingByTokenHash loads the unconsumed confirmation whose deeplink token hashes to
+// tokenHash, or ErrNoPendingCode. The high-entropy token needs no attempt counter, so
+// a partial-unique index guarantees at most one match.
+func (s *Store) pendingByTokenHash(ctx context.Context, tokenHash string) (pendingConfirmation, error) {
+ stmt := postgres.SELECT(table.EmailConfirmations.AllColumns).
+ FROM(table.EmailConfirmations).
+ WHERE(
+ table.EmailConfirmations.LinkTokenHash.EQ(postgres.String(tokenHash)).
+ AND(table.EmailConfirmations.ConsumedAt.IS_NULL()),
+ ).LIMIT(1)
+ var row model.EmailConfirmations
+ if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
+ if errors.Is(err, qrm.ErrNoRows) {
+ return pendingConfirmation{}, ErrNoPendingCode
+ }
+ return pendingConfirmation{}, fmt.Errorf("account: load confirmation by token: %w", err)
+ }
+ return pendingConfirmation{
+ id: row.ConfirmationID,
+ accountID: row.AccountID,
+ email: row.Email,
+ purpose: row.Purpose,
+ expiresAt: row.ExpiresAt,
+ }, nil
+}
+
+// consumeConfirmation marks a confirmation consumed without writing an identity, used
+// for the idempotent already-linked deeplink path.
+func (s *Store) consumeConfirmation(ctx context.Context, id uuid.UUID, now time.Time) error {
+ upd := table.EmailConfirmations.UPDATE(table.EmailConfirmations.ConsumedAt).
+ SET(postgres.TimestampzT(now)).
+ WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(id)))
+ if _, err := upd.ExecContext(ctx, s.db); err != nil {
+ return fmt.Errorf("account: consume confirmation: %w", err)
+ }
+ return nil
+}
+
// bumpConfirmationAttempts increments a code's wrong-attempt counter by one.
func (s *Store) bumpConfirmationAttempts(ctx context.Context, id uuid.UUID) error {
stmt := table.EmailConfirmations.
@@ -414,6 +553,18 @@ func generateCode() (code, hash string, err error) {
return code, hashCode(code), nil
}
+// generateLinkToken returns a fresh opaque one-tap confirm deeplink token (URL-safe
+// base64, 256-bit) and its hex SHA-256 hash. Only the hash is stored; the token
+// travels only in the emailed link, mirroring the session-token model.
+func generateLinkToken() (token, hash string, err error) {
+ buf := make([]byte, linkTokenBytes)
+ if _, err := crand.Read(buf); err != nil {
+ return "", "", fmt.Errorf("account: generate link token: %w", err)
+ }
+ token = base64.RawURLEncoding.EncodeToString(buf)
+ return token, hashCode(token), nil
+}
+
// hashCode returns the hex-encoded SHA-256 of a confirm-code.
func hashCode(code string) string {
sum := sha256.Sum256([]byte(code))
diff --git a/backend/internal/account/link.go b/backend/internal/account/link.go
index 1a597ed..08f3b32 100644
--- a/backend/internal/account/link.go
+++ b/backend/internal/account/link.go
@@ -2,6 +2,7 @@ package account
import (
"context"
+ "database/sql"
"errors"
"fmt"
"time"
@@ -16,6 +17,52 @@ import (
// belongs to another account; the caller turns it into a merge.
var ErrIdentityTaken = errors.New("account: identity already linked to another account")
+// ErrLastIdentity is returned when removing an identity would leave the account with
+// none, making it unreachable after logout. The admin email-erase refuses it.
+var ErrLastIdentity = errors.New("account: cannot remove the last identity")
+
+// RemoveEmailIdentity deletes the account's email identity and any pending confirmations
+// for it, freeing the address for reuse. It refuses when the email is the account's only
+// identity (ErrLastIdentity) — that would leave the account unreachable — and returns
+// ErrNotFound when the account has no email identity. It backs the admin console's
+// "erase email" action.
+func (s *Store) RemoveEmailIdentity(ctx context.Context, accountID uuid.UUID) error {
+ ids, err := s.Identities(ctx, accountID)
+ if err != nil {
+ return err
+ }
+ hasEmail, others := false, 0
+ for _, id := range ids {
+ if id.Kind == KindEmail {
+ hasEmail = true
+ } else {
+ others++
+ }
+ }
+ if !hasEmail {
+ return ErrNotFound
+ }
+ if others == 0 {
+ return ErrLastIdentity
+ }
+ return withTx(ctx, s.db, func(tx *sql.Tx) error {
+ delID := table.Identities.DELETE().WHERE(
+ table.Identities.AccountID.EQ(postgres.UUID(accountID)).
+ AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
+ )
+ if _, err := delID.ExecContext(ctx, tx); err != nil {
+ return fmt.Errorf("account: delete email identity %s: %w", accountID, err)
+ }
+ delConf := table.EmailConfirmations.DELETE().WHERE(
+ table.EmailConfirmations.AccountID.EQ(postgres.UUID(accountID)),
+ )
+ if _, err := delConf.ExecContext(ctx, tx); err != nil {
+ return fmt.Errorf("account: delete email confirmations %s: %w", accountID, err)
+ }
+ return nil
+ })
+}
+
// RequestLinkCode issues and mails a confirm-code for email to accountID,
// replacing any prior pending code. Unlike RequestCode it never refuses up front
// (taken or already-confirmed): possession of the address is the authorization for
diff --git a/backend/internal/account/userlist.go b/backend/internal/account/userlist.go
index f2c39a3..9103c9f 100644
--- a/backend/internal/account/userlist.go
+++ b/backend/internal/account/userlist.go
@@ -28,11 +28,13 @@ type UserListItem struct {
// UserFilter narrows the admin user list: Robots selects robot accounts (otherwise the
// non-robot "people"); NameMask and ExternalIDMask are glob masks ('*' = any run, '?' =
// one char) matched case-insensitively against the display name / any identity's external
-// id. An empty mask means no filter on that field.
+// id; EmailExact is a strict (exact) match against an account's email identity. An empty
+// value means no filter on that field.
type UserFilter struct {
Robots bool
NameMask string
ExternalIDMask string
+ EmailExact string
}
// robotExists is the correlated subquery testing whether account a is a robot.
@@ -63,6 +65,10 @@ func userListWhere(f UserFilter) (string, []any) {
args = append(args, ext)
where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\')`, len(args))
}
+ if email := strings.ToLower(strings.TrimSpace(f.EmailExact)); email != "" {
+ args = append(args, email)
+ where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.kind = 'email' AND i.external_id = $%d)`, len(args))
+ }
return where, args
}
diff --git a/backend/internal/adminconsole/templates/pages/user_detail.gohtml b/backend/internal/adminconsole/templates/pages/user_detail.gohtml
index 9be7009..58194f6 100644
--- a/backend/internal/adminconsole/templates/pages/user_detail.gohtml
+++ b/backend/internal/adminconsole/templates/pages/user_detail.gohtml
@@ -101,6 +101,11 @@
{{else}}