Last product decisions before the account specs #362

New issue

Closed

opened 2026-10-11 15:50:05 +00:00 by root · 4 comments

root commented

2026-10-11 15:50:05 +00:00

(Migrated from gitlab.core-project.space)

Imported from GitHub amaurycoudr/chess-project#362, opened by @amaurycoudr on 2026-10-11 15:50 UTC.
Closed on GitHub on 2026-10-11 15:50 UTC as completed.
Assigned on GitHub to @amaurycoudr.

Parent

#346

Question

Before the specs are written: does Email sending stay its own feature; is email verified at sign-up; how are sign-in, sign-up and reset rate-limited; is the display name a unique username and when is it chosen; how are names moderated; what is a Guest called and where do names show; what does the public profile show?

> _Imported from GitHub [amaurycoudr/chess-project#362](https://github.com/amaurycoudr/chess-project/issues/362), opened by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 15:50 UTC._ > _Closed on GitHub on 2026-10-11 15:50 UTC as completed._ > _Assigned on GitHub to [@amaurycoudr](https://github.com/amaurycoudr)._  --- ## Parent #346 ## Question Before the specs are written: does Email sending stay its own feature; is email verified at sign-up; how are sign-in, sign-up and reset rate-limited; is the display name a unique username and when is it chosen; how are names moderated; what is a Guest called and where do names show; what does the public profile show?

root commented

2026-10-11 15:50:05 +00:00

(Migrated from gitlab.core-project.space)

GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links).

Parent (sub-issue of): #346

> _GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links)._  - Parent (sub-issue of): #346

root commented

2026-10-11 15:50:20 +00:00

(Migrated from gitlab.core-project.space)

Imported from a GitHub comment by @amaurycoudr on 2026-10-11 15:50 UTC.

Resolution

Email sending folds into Accounts v1. Its only use is the password-reset email, so on its own a Player can't see it. Resend, domain verification, DNS and Mailpit (per "Which email provider sends password resets?") become a checklist step in the Accounts v1 spec. The map drops to five features.
No email verification at sign-up in v1. Sign-up may reveal that an email address is taken; accepted. Password reset is the only flow that depends on email, and it proves the inbox.
Rate limiting lives in the API, as in-memory counters (one API instance per stack), on sign-in, sign-up and password-reset requests, keyed by IP and by email. Going over returns 429 with a retry-after. The exact limits belong to the spec; the starting point is 5 sign-in failures per email per 15 minutes, 3 reset requests per email per hour, and 10 sign-ups per IP per hour. The reset request always answers "if an account exists, we sent an email".
A unique username, chosen at sign-up in Accounts v1. It's case-insensitive (core-project's index helper), can't be changed in v1, and appears in the profile URL. An Account never exists without one. Feature 6 becomes "Public profile".
Moderation: 3–20 characters, letters, digits, _ and -; a reserved list (guest, admin, anonymous, route words); a short blocklist of offensive words. No reporting flow. The owner renames by hand in Drizzle Gateway.
Names: a Guest shows as "Guest", an Account as its username. Names appear in "my games", on the Game page, and in the Room next to each Seat. This answers the opponent-name question the guest-history spec left open.
The public profile shows the username, the join date, and the Account's decided Games, listed publicly. A Guest's Games stay unlisted. This partly overturns ADR 0034's "listed only to its owners", so the Public profile spec must call for an ADR superseding 0034 on that point.

> _Imported from a [GitHub comment](https://github.com/amaurycoudr/chess-project/issues/362#issuecomment-6110796973) by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 15:50 UTC._  ## Resolution 1. **Email sending folds into Accounts v1.** Its only use is the password-reset email, so on its own a Player can't see it. Resend, domain verification, DNS and Mailpit (per "Which email provider sends password resets?") become a checklist step in the Accounts v1 spec. The map drops to five features. 2. **No email verification at sign-up in v1.** Sign-up may reveal that an email address is taken; accepted. Password reset is the only flow that depends on email, and it proves the inbox. 3. **Rate limiting lives in the API**, as in-memory counters (one API instance per stack), on sign-in, sign-up and password-reset requests, keyed by IP and by email. Going over returns `429` with a retry-after. The exact limits belong to the spec; the starting point is 5 sign-in failures per email per 15 minutes, 3 reset requests per email per hour, and 10 sign-ups per IP per hour. The reset request always answers "if an account exists, we sent an email". 4. **A unique username, chosen at sign-up in Accounts v1.** It's case-insensitive (core-project's index helper), can't be changed in v1, and appears in the profile URL. An Account never exists without one. Feature 6 becomes "Public profile". 5. **Moderation:** 3–20 characters, letters, digits, `_` and `-`; a reserved list (`guest`, `admin`, `anonymous`, route words); a short blocklist of offensive words. No reporting flow. The owner renames by hand in Drizzle Gateway. 6. **Names:** a Guest shows as "Guest", an Account as its username. Names appear in "my games", on the Game page, and in the Room next to each Seat. This answers the opponent-name question the guest-history spec left open. 7. **The public profile** shows the username, the join date, and the Account's decided Games, listed publicly. A Guest's Games stay unlisted. This partly overturns ADR 0034's "listed only to its owners", so the Public profile spec must call for an ADR superseding 0034 on that point.

root (Migrated from gitlab.core-project.space) closed this issue

2026-10-11 15:50:22 +00:00

root commented

2026-10-13 08:41:16 +00:00

(Migrated from gitlab.core-project.space)

mentioned in issue #346