Implement email magic link authentication system #9

New Issue

2026-02-25T16:05:11+01:00

libretech commented

2026-02-25 16:05:11 +01:00

Summary

Implement passwordless authentication via email magic links for the multi-tenant backend.

Design

Generate cryptographically secure one-time tokens
Send magic link emails via configurable SMTP provider
Token expiration (e.g., 15 minutes)
Rate limiting on magic link requests
Token invalidation after use

Implementation Tasks

Add magic link token generation and storage
Implement /auth/login endpoint (accepts email, sends magic link)
Implement /auth/verify endpoint (validates token, issues JWT)
Configure SMTP email sending
Add rate limiting per email address
Add token expiration and cleanup

Security Considerations

Tokens must be cryptographically random (min 32 bytes)
Links must be single-use
Rate limit to prevent email bombing
HTTPS-only for magic link URLs
Constant-time token comparison

Acceptance Criteria

User can request a magic link by email
Clicking the link authenticates the user and returns a JWT
Expired/used tokens are rejected
Rate limiting prevents abuse
Works with common email providers

## Summary Implement passwordless authentication via email magic links for the multi-tenant backend. ## Design - Generate cryptographically secure one-time tokens - Send magic link emails via configurable SMTP provider - Token expiration (e.g., 15 minutes) - Rate limiting on magic link requests - Token invalidation after use ## Implementation Tasks - [x] Add magic link token generation and storage - [x] Implement /auth/login endpoint (accepts email, sends magic link) - [x] Implement /auth/verify endpoint (validates token, issues JWT) - [x] Configure SMTP email sending - [x] Add rate limiting per email address - [x] Add token expiration and cleanup ## Security Considerations - Tokens must be cryptographically random (min 32 bytes) - Links must be single-use - Rate limit to prevent email bombing - HTTPS-only for magic link URLs - Constant-time token comparison ## Acceptance Criteria - [x] User can request a magic link by email - [x] Clicking the link authenticates the user and returns a JWT - [x] Expired/used tokens are rejected - [x] Rate limiting prevents abuse - [ ] Works with common email providers

libretech added the phase-1 label 2026-02-25 16:05:11 +01:00

libretech added the task label 2026-02-28 20:25:52 +01:00

libretech changed title from ~~Implement authentication system~~ to Implement email magic link authentication system

2026-02-28 20:25:53 +01:00

libretech referenced this issue

2026-02-28 21:41:31 +01:00

Epic: Phase 1 — Multi-tenant Backend #7

libretech added the backend security labels 2026-02-28 22:00:42 +01:00

~~libretech referenced this issue 2026-03-02 15:45:53 +01:00~~

Register librenot.es domain and configure DNS #4

libretech closed this issue

2026-04-28 22:29:03 +02:00