When a username like 'christianlouis.de' (containing a dot) was submitted
on the signup page, FastAPI returned a 422 with detail as an array of
Pydantic validation error objects. The JS code assigned that array directly
to `this.error`, causing Alpine.js x-text to render '[object Object]'.
Two fixes applied in signup.html:
1. Client-side validation: check username length and pattern in submit()
before the API call, with clear human-readable error messages.
2. Server error handling: detect when data.detail is an Array and extract
each entry's .msg field, joining them into a readable string.
Also adds a regression test to confirm the 422 response format for an
invalid username (with dot) includes a list detail with msg fields.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- tests/test_database.py: add user_imap_accounts table to the regression
test's initial DB setup (migration 022 creates it before rev 026, so it
must exist for migration 032's ALTER TABLE to succeed)
- tests/test_local_auth.py: configure mock_request.headers.get to return
None and client=None so get_client_ip() returns "unknown" instead of an
un-serialisable MagicMock that broke the audit_logs INSERT in
test_local_login_success and test_local_login_by_email
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- reset_password sets is_active=True so users with unverified accounts
can log in after using the forgot-password flow
- admin set_password also sets is_active=True for the same reason
- auth() now checks is_active before verifying the password, ensuring
inactive users always see the email-verification prompt regardless of
password correctness (avoids leaking password validity)"
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Remove SMTP hard-requirement from /api/auth/signup: when SMTP is not
configured accounts are activated immediately (no email verification).
When SMTP is configured the existing email-verification flow is kept.
- Inject allow_signup into global template context via app/views/base.py
- Add data-allow-signup attribute to base.html body tag
- Update common.js _renderLoggedOutAuth to show Sign Up (→ /signup) when
signup is enabled, otherwise Get Started (→ /pricing)
- Add admin API endpoints before the /{user_id:path} catch-all:
GET /api/admin/users/local – list all local accounts
POST /api/admin/users/local – admin-create local account (active immediately)
DELETE /api/admin/users/local/{id} – delete local account + profile
- Add LocalUserCreate / LocalUserResponse Pydantic schemas
- Update admin_users.html with Local User Accounts section and modals
- Update .env.demo to document ALLOW_LOCAL_SIGNUP
- Update docs/BillingSetup.md: SMTP is optional, document both flows
- Update tests: test_signup_smtp_not_configured now asserts 201 + immediate
activation; add 7 new integration tests for admin local user endpoints
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- auth() only queries LocalUser table when multi_user_enabled=True
- login() only shows signup link when multi_user_enabled AND allow_local_signup
- signup page and POST endpoint both check multi_user_enabled first
- Move local-auth imports to module level in auth.py (no re-import overhead)
- Fix signup rollback: flush before email send, commit only on success
- Update allow_local_signup config description to document prerequisite
- Add test: single-user mode skips LocalUser table entirely
- Patch multi_user_enabled=True on all local-login integration tests
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Use astimezone() instead of replace() for timezone conversion in is_token_expired
- Log cleanup exceptions with logger.exception() in signup
- Add security warning when STRIPE_WEBHOOK_SECRET is not configured
- Increase Stripe price ID column length from 64 to 128 characters
- Replace alert() with aria-live assertive region in pricing.html
- Convert auth() login tests to use pytest.mark.asyncio and await
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
copilot-swe-agent[bot]