Sub-Task #166
Updated by Bricklou 19 days ago
When a new account registers, a verification email containing a single-use token is sent automatically.
- The token expires after 24 hours.
- A "resend verification email" action is available, rate-limited to prevent abuse.
- Registration is not blocked by verification: a new account can log in right away, with a reminder shown until the email is verified, and some features restricted until then (see related sub-task).
- If the instance has no mail server configured, accounts are verified automatically at registration, since no verification email can be sent.
- Emails are sent through SMTP, configured entirely via environment variables (host, port, credentials, sender address, encryption).
- Email content uses fixed templates, not editable from the admin interface.
- For local development, a self-hosted mail-catching tool is provided so anyone can inspect sent emails without a real mailbox.