test(auth): prove email token lifecycle

Reject verification-link replay and cover real Identity token expiry, replay, email change, and custom username preservation on SQLite.
2026-08-15 20:06:08 +02:00
parent 134aac7bcf
commit dc511296a4
5 changed files with 158 additions and 3 deletions
@@ -12,6 +12,7 @@ Status: `IMPLEMENTED — NOT VERIFIED`. Backend, frontend component, build, migr
 - Local accounts request a new address with their current password. The active address remains unchanged and both current and proposed addresses receive non-secret notifications.
 - `PendingEmail`, `PendingEmailRequestedAtUtc`, and a rotated security stamp make replacement requests invalidate older Identity change-email tokens.
 - Confirmation accepts only the current pending address, uses `UserManager.ChangeEmailAsync`, updates username only when it still tracks the old email, clears pending state, and revokes all sessions/trusted devices.
+- Registration verification links are single-use at the HTTP boundary; an already confirmed account receives the same generic invalid/expired response as an invalid token.
 - Cancellation requires the current password and clears pending state.
 - ASP.NET Identity default token providers are registered; data-protection keys already persist under `Data:Root/keys`.

@@ -29,6 +30,7 @@ Status: `IMPLEMENTED — NOT VERIFIED`. Backend, frontend component, build, migr
  - no `Set-Cookie` header and zero client cookies;
  - immediate login returned 403 `email_not_verified` and still zero cookies.
 - No email was sent and no production service or database was contacted.
+- Real ASP.NET Identity data-protection tokens against SQLite prove valid confirmation, replay rejection, expiry rejection, real change-email confirmation, replay rejection and custom-username preservation. Focused auth/token tests pass 39/39; full backend passes 666/666.

 ## Blocked or partial checks

@@ -56,6 +58,5 @@ dotnet run --no-build --no-launch-profile --project JobTrackerApi/JobTrackerApi.
 ## Remaining acceptance checks

 - Real-browser registration, resend, verification, email request, cancellation and confirmation using a local email sink.
- Expired/replayed real Identity token integration check and custom-username preservation integration check.
 - Disposable MariaDB upgrade/rollback execution.
 - Production SMTP/canonical-origin and rolling-version smoke with synthetic addresses.