From 09efce28915e84667efcac213773e8d0f6bb2452 Mon Sep 17 00:00:00 2001 From: Hermes Date: Fri, 17 Jul 2026 09:16:55 -0700 Subject: [PATCH] DC-047: claim for Hermes --- BACKLOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/BACKLOG.md b/BACKLOG.md index 6c61dae..ed50038 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -262,8 +262,8 @@ Tickets DC-033 through DC-041 were added after the DNS2 v1.14.4 / v1.14.8 / 0.0. - **impact:** Unlocks every other auth provider (DC-047 email magic link, DC-048+ OIDC, SAML, etc.) without further refactors of the auth path. ### DC-047: EmailMagicLinkProvider — email-only login via nodemailer -- **status:** todo -- **owner:** unclaimed +- **status:** in-progress +- **owner:** hermes - **details:** Second AuthProvider implementation, sitting alongside TOTP. **Email IS the identity — no separate username field at any point.** Flow: user enters email at `/login`, server generates a single-use token (32 random bytes, base64url), stores it in `data/email-tokens.json` with 15-min TTL, sends an email via the existing nodemailer connection in `src/managers/notification-manager.js:290` (reuse the same SMTP config — `providers.email.host/port/username/password/from`). Email body contains a link like `https://dashcaddy.example.com/auth/verify?token=abc123`. Click → server validates token (exists, not expired, not already used) → marks used → creates session cookie → redirect to dashboard. On subsequent visits, session cookie is the credential. Rate-limit the request-link endpoint to 5 per email per hour to prevent email-bombing. Tokens stored as SHA-256 hashes in the JSON store so a read-only compromise can't be used to forge links. Effort: ~3 hrs. Risk: medium (depends on SMTP creds being configured; if not, fall back to console-logging the link in dev mode). - **impact:** Public product readiness. Zero-password login. No username/email split — one field, one identifier. Reuses existing nodemailer config — no new dependency, no new credential surface. Works with any SMTP server Sami already uses (he mentioned using the SMTP server his website runs). - **prerequisite:** DC-046 (the interface to implement against).