Sub-Task #166
Updated by Bricklou 16 days ago
When an administrator invites someone, an a new account registers, a verification email is sent to them containing a single-use link to accept the invitation. token is sent automatically. - The link token expires after 7 days. 24 hours. - A "resend verification email" action is available, rate-limited to prevent abuse. - Registration is not blocked by verification: a new account can log in right away, with a reminder shown until the email is verified, and some features restricted until then (see related sub-task). - If the instance has no mail server configured, the invitation still needs to accounts are verified automatically at registration, since no verification email can be delivered to the invited person some other way (exact fallback to be defined during implementation). sent. - Emails are sent through SMTP, configured entirely via environment variables (host, port, credentials, sender address, encryption). - Email content uses fixed templates, not editable from the admin interface. - For local development, a self-hosted mail-catching tool is provided so anyone can inspect sent emails without a real mailbox.