From cf7cf8ded4497026645531bcabd1420e8a29b513 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:06:52 +0500 Subject: [PATCH 01/17] docs: scope combined Resend authentication email setup --- docs/WORK_LOG.md | 39 +++++++++++++++++++++++++++++++-------- 1 file changed, 31 insertions(+), 8 deletions(-) diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index f0fbf33..e4303b8 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -7,14 +7,16 @@ claims as completed work. ## Current status -- Implemented and validated [#150](https://github.com/Coding-Moves/one-concept/issues/150), - the next open issue in ascending order, on `codex/150-bounded-startup-state` - from refreshed `origin/develop` (`a9aab63`). Published as - [PR #185](https://github.com/Coding-Moves/one-concept/pull/185) into `develop`. -- Compact startup includes 50 learned/saved detail records, exact totals, and - cursor access to older records. Saved search/filter and offline reading remain - available; full History UI (#159) is separate. Existing clients retain their - legacy response until updated. No new APK, migration, or production release. +- Preparing one PR for [#152](https://github.com/Coding-Moves/one-concept/issues/152) + and [#171](https://github.com/Coding-Moves/one-concept/issues/171): Resend delivery + setup and branded authentication emails. Branch `codex/152-171-resend-auth-email` + starts from refreshed `origin/develop` (`65eb21d`). +- Owner chose Resend and has no domain. Prepare all repository files and exact + manual setup steps now; domain registration, account configuration, and live + delivery verification remain pending. Both issues belong to this same PR. +- PR #185 (#150) is merged. [PR #186](https://github.com/Coding-Moves/one-concept/pull/186) + remains open; its independent review found no actionable issue and reran all + 63 generation tests with no skips. Its generation-budget changes are separate. - The owner reinforced the preference for more focused commits in **all future PRs** for this project. Saved in `AGENTS.md`; retain individual commits and related tests without artificial splits or empty commits. @@ -22,6 +24,27 @@ claims as completed work. card follow-up #180, and branch sync #181 are also merged. Their handoffs below record the status at the time; this task does not authorize a production release. +## Resend authentication email (#152 and #171) — 2026-09-12 + +- Verified the mobile app uses Supabase `signUp` and `resetPasswordForEmail`; + FastAPI supplies the existing `/confirmed` and `/reset-password` landing pages. + There is no committed email template/setup runbook. Live SMTP configuration + and actual delivery are unverified; source inspection cannot establish them. +- Owner selected Resend and requested one PR covering both overlapping issues. + Prepare signup and recovery templates using the existing confirmation URLs, + with a Resend/Supabase/DNS guide and a concrete activation checklist. Magic-link + sign-in is not currently offered in the app and is outside this chunk. +- Read the official Resend SMTP/domain and Supabase SMTP/template documentation. + A verified owned domain is required for real-user Resend delivery; the free + sending plan does not include purchasing a domain. Owner will perform the + purchase and account steps. No credentials belong in source or the PR. +- Planned commits: scope/verification; signup email; password recovery email; + installation and operational guide; validation and PR handoff. Preserve small + meaningful commits, owner authorship, and the existing authentication flow. +- The PR will track both issues, with live activation explicitly pending. + Keep it in draft until both delivery flows have passed real-inbox checks; + repository changes alone do not establish that either issue is resolved. + ## Bounded startup state (#150) — 2026-09-12 - Read the exact Expo SDK 57 documentation before mobile edits. From a17ede94da132ff12bfb993e462f42da41d77db6 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:07:35 +0500 Subject: [PATCH 02/17] feat: add branded signup confirmation email --- backend/email-templates/confirm-signup.html | 57 +++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 backend/email-templates/confirm-signup.html diff --git a/backend/email-templates/confirm-signup.html b/backend/email-templates/confirm-signup.html new file mode 100644 index 0000000..b744ce3 --- /dev/null +++ b/backend/email-templates/confirm-signup.html @@ -0,0 +1,57 @@ + + + + + + + Confirm your email — One Concept + + + + +
+ One small step before your first concept. Confirm your email to get started. +
+ + + + +
+ + + + + + + + + + + +
+

One Concept.

+

by Coding Moves

+
+

WELCOME ABOARD

+

A little curiosity.
Every day.

+

Confirm your email to finish creating your One Concept account. Your next small discovery is waiting.

+ + + + +
+ Confirm my email +
+

After confirming, open the app on your phone and sign in.

+

Button not opening? Copy this link into your browser:

+

+ {{ .ConfirmationURL }} +

+
+

Didn't create this account? You can ignore this email.

+

One day. One concept. One small step forward.

+
+ +
+ + From ed28df79b4ca882f49facd4f92ec91e1b4901e85 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:07:53 +0500 Subject: [PATCH 03/17] feat: add branded password recovery email --- backend/email-templates/reset-password.html | 57 +++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 backend/email-templates/reset-password.html diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html new file mode 100644 index 0000000..d0a975e --- /dev/null +++ b/backend/email-templates/reset-password.html @@ -0,0 +1,57 @@ + + + + + + + Reset your password — One Concept + + + + +
+ Choose a new password for your One Concept account. +
+ + + + +
+ + + + + + + + + + + +
+

One Concept.

+

by Coding Moves

+
+

ACCOUNT RECOVERY

+

A fresh password.
A new start.

+

We received a request to reset your One Concept password. Use the button below to choose a new one.

+ + + + +
+ Reset my password +
+

After saving your new password, return to the app and sign in. If this link has expired, request a new one with Forgot password in the app.

+

Button not opening? Copy this link into your browser:

+

+ {{ .ConfirmationURL }} +

+
+

Didn't request a reset? You can ignore this email. Your password will stay the same.

+

One day. One concept. One small step forward.

+
+ +
+ + From a44d6248d856783687481237564e339290f84e62 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:08:39 +0500 Subject: [PATCH 04/17] refine: keep authentication email copy focused on account actions --- backend/email-templates/confirm-signup.html | 8 ++++---- backend/email-templates/reset-password.html | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/backend/email-templates/confirm-signup.html b/backend/email-templates/confirm-signup.html index b744ce3..7056453 100644 --- a/backend/email-templates/confirm-signup.html +++ b/backend/email-templates/confirm-signup.html @@ -10,7 +10,7 @@
- One small step before your first concept. Confirm your email to get started. + Confirm your email to finish creating your One Concept account.
@@ -26,8 +26,8 @@

WELCOME ABOARD

-

A little curiosity.
Every day.

-

Confirm your email to finish creating your One Concept account. Your next small discovery is waiting.

+

Confirm your email

+

Use the button below to confirm your email and finish creating your One Concept account.

@@ -45,7 +45,7 @@

Didn't create this account? You can ignore this email.

-

One day. One concept. One small step forward.

+

This is an account email from One Concept by Coding Moves.
diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html index d0a975e..4d4a335 100644 --- a/backend/email-templates/reset-password.html +++ b/backend/email-templates/reset-password.html @@ -26,7 +26,7 @@

ACCOUNT RECOVERY

-

A fresh password.
A new start.

+

Reset your password

We received a request to reset your One Concept password. Use the button below to choose a new one.

@@ -45,7 +45,7 @@

Didn't request a reset? You can ignore this email. Your password will stay the same.

-

One day. One concept. One small step forward.

+

This is an account email from One Concept by Coding Moves.

From 2dd12c76192cf4fc2e578f4f061277befab3fa9a Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:13:35 +0500 Subject: [PATCH 05/17] docs: add zero-cost Resend installation and activation runbook --- README.md | 1 + backend/README.md | 8 ++ docs/CODEBASE_MAP.md | 1 + docs/EMAIL_SETUP.md | 219 +++++++++++++++++++++++++++++++++++++++++++ docs/WORK_LOG.md | 12 ++- 5 files changed, 238 insertions(+), 3 deletions(-) create mode 100644 docs/EMAIL_SETUP.md diff --git a/README.md b/README.md index 4a5a9db..e3741a7 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,7 @@ link's build current automatically. - [Architecture](docs/ARCHITECTURE.md) — how the pieces fit, selection, reminders, security - [Roadmap](docs/ROADMAP.md) — shipped phases and what's next - [Backend](backend/README.md) — API endpoints, auth, running locally +- [Authentication email](docs/EMAIL_SETUP.md) — Resend setup, branded templates, and delivery checks - [Deployment](mobile/DEPLOYMENT.md) — EAS builds, OTA updates, release runbook ## Contributing diff --git a/backend/README.md b/backend/README.md index 2b97c4c..e228200 100644 --- a/backend/README.md +++ b/backend/README.md @@ -29,6 +29,7 @@ backend/ │ │ └── users.py profile bootstrap (safety net for the DB trigger) │ └── api/v1/ health, topics, daily ├── migrations/ # plain SQL, applied in filename order +├── email-templates/ # signup/recovery HTML installed manually in Supabase Auth ├── tests/ # 25 tests: token verification, selection, HTTP ├── Dockerfile # what Railway builds └── .env.example # copy to .env — never commit the filled copy @@ -106,6 +107,13 @@ confusion attacks, both of which are covered by tests. `user_id` is taken from the verified token's `sub` claim and from nowhere else. No endpoint accepts a user id as a parameter. +Supabase Auth sends account confirmation and password-recovery emails through +its configured email provider. Install the branded HTML in `email-templates/` +and configure Resend custom SMTP using [Authentication email setup](../docs/EMAIL_SETUP.md). +The guide includes domain/DNS steps, free-plan limits, the existing redirect +contract, and real-inbox acceptance checks. Merging the files does not configure +SMTP or publish templates; production activation must be verified separately. + ## Content generation Gemini writes lessons. It does **not** choose subjects. diff --git a/docs/CODEBASE_MAP.md b/docs/CODEBASE_MAP.md index 7eab610..3591bfc 100644 --- a/docs/CODEBASE_MAP.md +++ b/docs/CODEBASE_MAP.md @@ -17,6 +17,7 @@ learned history, streaks, likes, saved concepts, and push reminders. | Content engine | `backend/app/services/generation.py`, `pool.py`, `prefetch.py`; Gemini lessons from a curated backlog. | | Operations | `.github/workflows/`, `backend/railway.json`, `backend/Dockerfile`, `mobile/eas.json`, `mobile/app.config.js`. | | Documentation | Root `README.md`, `RELEASING.md`, `CONTRIBUTING.md`, `docs/ARCHITECTURE.md`, `docs/ROADMAP.md`, and the backend/mobile guides. | +| Authentication email | `backend/email-templates/` contains signup and recovery HTML for Supabase Auth; `docs/EMAIL_SETUP.md` covers Resend SMTP/DNS installation and real-inbox acceptance. These files are installed manually, not deployed by the app. | | Agent guidance | Root `AGENTS.md`; `mobile/AGENTS.md` adds Expo documentation requirements and `mobile/CLAUDE.md` references it. | ## Mobile navigation and presentation diff --git a/docs/EMAIL_SETUP.md b/docs/EMAIL_SETUP.md new file mode 100644 index 0000000..c5a0af2 --- /dev/null +++ b/docs/EMAIL_SETUP.md @@ -0,0 +1,219 @@ +# Authentication email with Resend + +This is the shared delivery and branding setup for [#152](https://github.com/Coding-Moves/one-concept/issues/152) +and [#171](https://github.com/Coding-Moves/one-concept/issues/171). +**Status: prepared for installation; production SMTP and inbox delivery are not verified.** +Keep the implementation PR in draft until the acceptance checks below pass. + +The app already asks Supabase Auth to send signup and password-recovery emails. +Supabase owns verification tokens; Resend transports the messages through custom +SMTP. FastAPI serves the existing confirmation and password-reset pages. The +HTML files in this repository must be installed in Supabase; deploying or merging +them does not install them. Daily reminders remain push notifications. + +## What the owner needs to do + +The owner has set a **$0 budget, with no domain purchase**. Complete the numbered +steps below only using free services. If registration, identity verification, +or DNS requires payment, stop; no charge is authorized. Production activation +remains pending until the owner controls a suitable domain. +You do not need website hosting, a paid mailbox, or a Supabase custom API domain +to send these emails. A mailbox is needed separately only if you want to receive +replies at the sending address. + +[Resend's free sending plan](https://resend.com/pricing) currently allows 3,000 +emails per month, at most 100 per day (checked 2026-09-12). These are emails, not +users: signups, resets, and repeat requests all share the allowance. Stay on Free +and recheck its limits before a public launch. Domain ownership is a prerequisite +for [real-user delivery](https://resend.com/docs/dashboard/domains/introduction); +the testing sender is not a replacement for your own domain. + +### 1. Obtain a free domain with DNS control and create the Resend account + +One candidate is [.pp.ua through NIC.UA](https://nic.ua/en/domains/.pp.ua), which +currently lists free registration and renewal. Its +[DNS hosting is free for domains registered there](https://nic.ua/en/domains/nameservers). +This is a candidate, not a verified deployment: name availability, account +eligibility, activation, Resend acceptance, and inbox delivery still need checks. + +Before choosing it, read these conditions: NIC.UA requires a linked payment card +for identification and phone/SMS or Telegram activation; .pp.ua registrant contact +data is public. The owner must decide whether those terms are acceptable and +complete registration directly. Do not register or publish contact information +on the owner's behalf. See [activation requirements](https://nic.ua/en/knowledge-base/how-to-activate-pp-ua-domain) +and [public registration data](https://nic.ua/en/knowledge-base/pp-ua-domains-restrictions). + +If acceptable, search for an available project name such as `oneconcept.pp.ua` +(availability is not established), verify a zero order total, complete the +registrar's activation steps, and enable its free DNS service. Complete activation +within the registrar's stated window. Free domains still need timely renewal +and reactivation; record the expiry privately. An expired domain may require a +paid restoration, which is outside this budget. + +Then create your account at [Resend](https://resend.com/signup) and select Free. +If the free domain cannot be activated or accepted by Resend, keep this setup +pending instead of buying an alternative or treating `onboarding@resend.dev` as +production. That [test sender only reaches your own Resend account address](https://resend.com/docs/knowledge-base/403-error-resend-dev-domain). + +The examples below use `example.com`. Replace it with your activated domain. +We will use **`auth.example.com`** as the sending domain and +**`noreply@auth.example.com`** as the sender. The `auth` subdomain does not require +a separate registration. It can coexist with a future website/API domain. + +### 2. Verify the sending domain + +In **Resend → Domains → Add domain**, enter `auth.example.com`. +In your registrar's DNS panel, copy the exact record type, name, value, and +priority that Resend provides for sending verification (DKIM and SPF/return-path +records). Values depend on the domain and region; do not copy somebody else's +DNS values. Some DNS panels append your root domain automatically, so check the +resulting full record name before saving. + +Enable sending; receiving is not required. An MX record requested for the sending +return-path belongs at the exact name Resend specifies, not automatically at the +root of your domain. Wait until Resend marks sending **Verified**. Follow +[Resend's DMARC guide](https://resend.com/docs/dashboard/domains/dmarc) for the +sending domain as well; if a record already exists, edit it instead of adding +a second DMARC policy. An initial monitoring policy can be tightened after +verifying legitimate mail; use a report address only if you actually monitor it. + +In that Resend domain's settings, leave **click tracking and open tracking off**. +Supabase verification links must reach Supabase unchanged. See +[Supabase's email tracking guidance](https://supabase.com/docs/guides/auth/auth-email-templates#email-tracking). + +### 3. Create a dedicated sending key + +In **Resend → API Keys**, create a key named `one-concept-supabase-auth` with +**Sending access**, limited to the verified sending domain. Copy it to your +password manager and use it only as the SMTP password in the next step. Resend +documents [sending-only, domain-scoped keys](https://resend.com/docs/dashboard/api-keys/introduction). + +Do not put this key in a template, Git, a PR, the mobile app, or a chat message. +No new Railway or `EXPO_PUBLIC_*` environment variable is needed. + +### 4. Configure Supabase custom SMTP + +First open the **existing One Concept Supabase project**. Inspect whether custom +SMTP or a Send Email Auth Hook is already configured; record the non-secret +settings and save the current templates privately before changing anything. +An existing Send Email hook can handle delivery instead of SMTP; resolve which +delivery path is active before switching it. + +Go to **Authentication → Email → SMTP Settings** (some dashboard versions group +this under Notifications). Enable custom SMTP and enter: + +| Field | Value | +| --- | --- | +| Sender name | `One Concept — by Coding Moves` | +| Sender email | `noreply@auth.example.com` with your actual verified domain | +| SMTP host | `smtp.resend.com` | +| SMTP port | `465` (TLS) | +| SMTP username | `resend` | +| SMTP password | The dedicated Resend API key from step 3 | + +Save. These values follow [Resend's Supabase SMTP guide](https://resend.com/docs/send-with-supabase-smtp). +Settings take effect in Supabase immediately; no APK or backend deployment is +required. Keep email confirmation enabled. + +Under **Authentication → Rate Limits**, inspect the email-sending limit. +Supabase documents an initial custom-SMTP limit of **30 emails/hour**, which is +configurable. Keep that conservative starting value for initial testing; raising +it does not raise Resend's 100/day and 3,000/month limits. Custom SMTP removes +the built-in sender's restrictions, not all limits. +[Supabase SMTP limits](https://supabase.com/docs/guides/auth/auth-smtp). + +### 5. Preserve the app's existing redirect URLs + +Find the app's current `EXPO_PUBLIC_API_BASE_URL` in the EAS environment settings +or the existing deployment configuration. Call that HTTPS origin `API_BASE` +below, with no trailing slash. This is the current backend address, **not** the +new email-sending domain; setting up email does not move the backend. + +In **Supabase → Authentication → URL Configuration**, verify: + +| Setting | Expected value | +| --- | --- | +| Site URL | `API_BASE/confirmed` | +| Redirect URL allow list | Contains `API_BASE/confirmed` and `API_BASE/reset-password` | + +Preserve other legitimate existing redirects. The signup call currently relies +on Site URL; `resetPasswordForEmail` explicitly requests `/reset-password`. +Keep the project's existing Supabase URL and anon/publishable key unchanged. +Do not replace the email action link with either landing-page URL: the user must +first pass through Supabase's token verification endpoint. + +### 6. Install the two templates + +In **Supabase → Authentication → Email → Templates**, open each matching template. +Set its subject below, then paste the **entire raw HTML file**, including its +`{{ .ConfirmationURL }}` placeholders, into the body and save. + +| Supabase template | Subject | File | +| --- | --- | --- | +| Confirm sign up | `Confirm your email — One Concept` | [confirm-signup.html](../backend/email-templates/confirm-signup.html) | +| Reset password | `Reset your password — One Concept` | [reset-password.html](../backend/email-templates/reset-password.html) | + +On GitHub, open the file and choose **Raw** to copy its source. Do not copy a +rendered browser preview or replace the placeholders manually. Both templates +use the same supported variable, but Supabase supplies the appropriate signup +or recovery verification URL for the selected template. Subjects are separate +dashboard fields; the HTML comments do not configure them. + +The templates use inline styles, table layouts, system fonts, visible fallback +links, and a text wordmark. They require no external images or JavaScript. +They do not claim an expiry duration, which is controlled by Supabase settings. +The app has no magic-link sign-in button, so the optional magic-link template +from #171 is deferred; no new authentication method is enabled by this PR. +[Supabase template variables](https://supabase.com/docs/guides/auth/auth-email-templates#terminology). + +### 7. Verify real delivery before completing either issue + +Use addresses you control, including one outside your Supabase organization's +team. Never publish passwords, full verification URLs, tokens, SMTP keys, or +private recipient details as evidence. Record the time, provider, redacted +delivery status, and outcome in the PR's activation checklist. + +- [ ] **Signup:** create a fresh test account in the installed app. Receive the + branded confirmation email, inspect the sender and layout, use its button, and + successfully sign in to the app. A `/confirmed` page alone is not proof that + the account can sign in. +- [ ] **Password recovery:** for that account, use Forgot password in the app, + receive the branded email, open `/reset-password` via its button, set a new + password, then successfully sign in with the new password. +- [ ] **Used/expired recovery link:** confirm it does not permit another reset; + request a fresh link and check that recovery still works. +- [ ] **Second inbox provider:** repeat delivery checks using another inbox + provider you control (for example Gmail and Outlook). Check Spam/Junk too. +- [ ] **Authentication headers:** inspect a delivered email's headers for SPF, + DKIM, and DMARC results; resolve failures before calling the setup complete. +- [ ] **Fallback link:** use a fresh email and copy its fallback URL into the + browser; verify that it completes the same action as the button. +- [ ] **Provider evidence:** Resend logs show successful delivery for signup and + recovery, and Supabase Auth logs show no SMTP failure. Provider acceptance + alone does not prove inbox delivery or working links. + +When these pass, record the actual results, mark the PR ready, and merge the +single PR that closes both #152 and #171. Do not close either as completed while +domain verification or real delivery is still pending. + +## Operating and troubleshooting + +Use **Resend → Emails/Logs** for delivery, bounce, suppression, and quota details; +use **Supabase → Logs → Auth** for request and SMTP errors. FastAPI does not send +these messages and cannot establish delivery from its own logs. Check remaining +Resend allowance before a signup campaign, and review failures after activation. + +| Symptom | Check | +| --- | --- | +| Only team members receive mail | Correct Supabase project, custom SMTP saved, domain verified, Send Email hook status. | +| SMTP authentication/sender error | Dedicated key, sending-domain scope, exact From address, host and port. | +| Rate-limit error or missing messages | Both Supabase's hourly limit and Resend's daily/monthly allowance; use a new request after limits permit. | +| Email arrives, link fails | Tracking disabled, correct template slot, intact placeholder, existing backend redirects; request a fresh link. Some inbox scanners consume one-time links. | +| Reset page says it is unavailable | Existing backend `SUPABASE_ANON_KEY` and deployment configuration; see [RELEASING.md](../RELEASING.md). | +| Password reset gives no account-specific detail | Expected: the app deliberately avoids disclosing whether an account exists. | + +If an installation breaks delivery, restore the saved template/settings for any +previously working custom provider. Reverting a Git commit does not restore +Supabase configuration. The built-in sender is restricted and is not a production +fallback. For a compromised/rotated Resend key, create a replacement scoped key, +update the SMTP password, test delivery, then revoke the old key. diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index e4303b8..0bb1a0d 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -13,7 +13,8 @@ claims as completed work. starts from refreshed `origin/develop` (`65eb21d`). - Owner chose Resend and has no domain. Prepare all repository files and exact manual setup steps now; domain registration, account configuration, and live - delivery verification remain pending. Both issues belong to this same PR. + delivery verification remain pending. Owner subsequently specified a $0 + budget: no domain purchase. Both issues belong to this same PR. - PR #185 (#150) is merged. [PR #186](https://github.com/Coding-Moves/one-concept/pull/186) remains open; its independent review found no actionable issue and reran all 63 generation tests with no skips. Its generation-budget changes are separate. @@ -36,8 +37,13 @@ claims as completed work. sign-in is not currently offered in the app and is outside this chunk. - Read the official Resend SMTP/domain and Supabase SMTP/template documentation. A verified owned domain is required for real-user Resend delivery; the free - sending plan does not include purchasing a domain. Owner will perform the - purchase and account steps. No credentials belong in source or the PR. + sending plan does not provide one. Owner will perform account/registration + steps. No credentials belong in source or the PR. +- Scope clarification: owner requires a $0 setup and will not purchase a domain. + NIC.UA documents free .pp.ua registration/renewal and DNS, but card verification, + phone activation, and public registrant data apply. Presented these conditions + to the owner; no registration, payment, or disclosure of contact data performed. + Resend acceptance of a future free domain and inbox delivery remain unverified. - Planned commits: scope/verification; signup email; password recovery email; installation and operational guide; validation and PR handoff. Preserve small meaningful commits, owner authorship, and the existing authentication flow. From de1d290d6790c233230ef9c68ed0393d9d5cd28b Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:16:17 +0500 Subject: [PATCH 06/17] fix: scale authentication email spacing with enlarged text --- backend/email-templates/confirm-signup.html | 24 ++++++++++----------- backend/email-templates/reset-password.html | 24 ++++++++++----------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/backend/email-templates/confirm-signup.html b/backend/email-templates/confirm-signup.html index 7056453..f693277 100644 --- a/backend/email-templates/confirm-signup.html +++ b/backend/email-templates/confirm-signup.html @@ -9,7 +9,7 @@ -
+
Confirm your email to finish creating your One Concept account.
@@ -19,33 +19,33 @@
-

One Concept.

-

by Coding Moves

+

One Concept.

+

by Coding Moves
-

WELCOME ABOARD

-

Confirm your email

-

Use the button below to confirm your email and finish creating your One Concept account.

+

WELCOME ABOARD

+

Confirm your email

+

Use the button below to confirm your email and finish creating your One Concept account.

- Confirm my email + Confirm my email
-

After confirming, open the app on your phone and sign in.

-

Button not opening? Copy this link into your browser:

-

+

After confirming, open the app on your phone and sign in.

+

Button not opening? Copy this link into your browser:

+

{{ .ConfirmationURL }}

-

Didn't create this account? You can ignore this email.

-

This is an account email from One Concept by Coding Moves.

+

Didn't create this account? You can ignore this email.

+

This is an account email from One Concept by Coding Moves.
diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html index 4d4a335..af88376 100644 --- a/backend/email-templates/reset-password.html +++ b/backend/email-templates/reset-password.html @@ -9,7 +9,7 @@ -
+
Choose a new password for your One Concept account.
@@ -19,33 +19,33 @@
-

One Concept.

-

by Coding Moves

+

One Concept.

+

by Coding Moves
-

ACCOUNT RECOVERY

-

Reset your password

-

We received a request to reset your One Concept password. Use the button below to choose a new one.

+

ACCOUNT RECOVERY

+

Reset your password

+

We received a request to reset your One Concept password. Use the button below to choose a new one.

- Reset my password + Reset my password
-

After saving your new password, return to the app and sign in. If this link has expired, request a new one with Forgot password in the app.

-

Button not opening? Copy this link into your browser:

-

+

After saving your new password, return to the app and sign in. If this link has expired, request a new one with Forgot password in the app.

+

Button not opening? Copy this link into your browser:

+

{{ .ConfirmationURL }}

-

Didn't request a reset? You can ignore this email. Your password will stay the same.

-

This is an account email from One Concept by Coding Moves.

+

Didn't request a reset? You can ignore this email. Your password will stay the same.

+

This is an account email from One Concept by Coding Moves.
From fd448f951f670993fc33ebdce904d67fced19efd Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:16:38 +0500 Subject: [PATCH 07/17] docs: record authentication email validation and activation limits --- docs/WORK_LOG.md | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index 0bb1a0d..94bc5ee 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -7,7 +7,7 @@ claims as completed work. ## Current status -- Preparing one PR for [#152](https://github.com/Coding-Moves/one-concept/issues/152) +- Prepared one PR chunk for [#152](https://github.com/Coding-Moves/one-concept/issues/152) and [#171](https://github.com/Coding-Moves/one-concept/issues/171): Resend delivery setup and branded authentication emails. Branch `codex/152-171-resend-auth-email` starts from refreshed `origin/develop` (`65eb21d`). @@ -50,6 +50,29 @@ claims as completed work. - The PR will track both issues, with live activation explicitly pending. Keep it in draft until both delivery flows have passed real-inbox checks; repository changes alone do not establish that either issue is resolved. +- Delivered standalone signup and recovery HTML with One Concept / Coding Moves + branding, the existing Supabase confirmation variable in both action and + fallback links, system fonts, inline styles, and no remote assets. Refined the + copy to focus on account actions, following Supabase's transactional guidance. +- Added `docs/EMAIL_SETUP.md`: the $0 constraint, a conditional free-domain route, + DNS and scoped-key steps, exact SMTP fields, existing redirect URLs, template + installation, separate Supabase/Resend limits, and a live acceptance checklist. +- **Validation:** 24 local Chromium scenarios passed across both templates at + 320/390/600/960 pixels, with normal, doubled, and stripped styling. Verified + complete dummy verification URLs, copyable fallback links, no remote resources, + and no horizontal overflow with normal/enlarged text. Visual review caught + overlapping enlarged text; switched to relative line spacing and rechecked. + Inspected mobile, desktop, and enlarged-text screenshots. Text/button contrast + exceeds 4.5:1; relative Markdown links and whitespace checks passed. +- **Limits:** no messages sent, accounts created, domain registered, payment made, + DNS edited, SMTP activated, or production template installed. Resend acceptance, + real inbox delivery, and native email-client rendering remain unverified. The + first preview launch lacked Playwright's bundled browser; the installed Chrome + completed validation. Backend pytest/mobile builds were not run because this + chunk changes only standalone templates and documentation, not application code. +- Commits so far: `cf7cf8d` scope; `a17ede9` signup; `ed28df7` recovery; + `a44d624` account-focused copy; `2dd12c7` setup guide; `de1d290` scalable text. + Validation handoff: `docs: record authentication email validation and activation limits`. ## Bounded startup state (#150) — 2026-09-12 From ad1941b52288d1212a4e1cc5b3d852627978a2f3 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 22:18:03 +0500 Subject: [PATCH 08/17] docs: link combined authentication email pull request --- docs/WORK_LOG.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index 94bc5ee..6172667 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -10,7 +10,8 @@ claims as completed work. - Prepared one PR chunk for [#152](https://github.com/Coding-Moves/one-concept/issues/152) and [#171](https://github.com/Coding-Moves/one-concept/issues/171): Resend delivery setup and branded authentication emails. Branch `codex/152-171-resend-auth-email` - starts from refreshed `origin/develop` (`65eb21d`). + starts from refreshed `origin/develop` (`65eb21d`). Published as + [draft PR #187](https://github.com/Coding-Moves/one-concept/pull/187) into `develop`. - Owner chose Resend and has no domain. Prepare all repository files and exact manual setup steps now; domain registration, account configuration, and live delivery verification remain pending. Owner subsequently specified a $0 @@ -72,7 +73,16 @@ claims as completed work. chunk changes only standalone templates and documentation, not application code. - Commits so far: `cf7cf8d` scope; `a17ede9` signup; `ed28df7` recovery; `a44d624` account-focused copy; `2dd12c7` setup guide; `de1d290` scalable text. - Validation handoff: `docs: record authentication email validation and activation limits`. + `fd448f9` records validation and activation limits. +- **PR:** [#187](https://github.com/Coding-Moves/one-concept/pull/187), draft into + `develop`, with closing references for both #152 and #171. Both issues remain + open until the live activation checklist passes and the PR merges. Publication + bookkeeping: `docs: link combined authentication email pull request`. +- **Owner handoff:** create the free Resend account and decide whether NIC.UA's + card-verification/public-contact terms are acceptable before registering any + free domain. The question remains pending; no consent was inferred. Complete + the exact DNS/SMTP/template steps in `docs/EMAIL_SETUP.md` once a suitable domain + is active. No purchase or provider switch is authorized by the $0 scope. ## Bounded startup state (#150) — 2026-09-12 From 4c75b72fc54d3063dadf2b3dbdcfc5e9a33b73e3 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:03:08 +0500 Subject: [PATCH 09/17] docs: record authentication email redesign scope --- docs/WORK_LOG.md | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index 6172667..1afcf6b 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -12,10 +12,13 @@ claims as completed work. setup and branded authentication emails. Branch `codex/152-171-resend-auth-email` starts from refreshed `origin/develop` (`65eb21d`). Published as [draft PR #187](https://github.com/Coding-Moves/one-concept/pull/187) into `develop`. -- Owner chose Resend and has no domain. Prepare all repository files and exact - manual setup steps now; domain registration, account configuration, and live - delivery verification remain pending. Owner subsequently specified a $0 - budget: no domain purchase. Both issues belong to this same PR. +- Owner requires a $0 setup and has chosen their existing Gmail account for + Supabase SMTP. The owner is performing dashboard setup; saving the settings + and actual inbox delivery remain unverified. Resend preparation stays in draft. +- Current follow-up: redesign the two HTML emails with shorter copy and polished + One Concept text branding. The configured mobile images are Expo starter assets; + the owner explicitly selected text branding instead. Preserve verification URLs + and deliver replacement HTML in the same draft PR, with no dashboard changes. - PR #185 (#150) is merged. [PR #186](https://github.com/Coding-Moves/one-concept/pull/186) remains open; its independent review found no actionable issue and reran all 63 generation tests with no skips. Its generation-budget changes are separate. @@ -28,6 +31,25 @@ claims as completed work. ## Resend authentication email (#152 and #171) — 2026-09-12 +### Template redesign follow-up + +- Owner requested professional replacement HTML for signup and password recovery, + with less generic copy and the official logo if available. Inspected app config, + theme, authentication flow, and all six image assets' filenames; viewed the + configured icon and Android foreground. No separate One Concept logo was found. + Owner selected polished text branding after the starter-icon finding. +- Planned focused commits: record revised scope; redesign signup and verify its + layout; apply the same design to recovery and verify its copy/links; update the + installation notes and record final visual checks. Preserve prior commits. +- Rechecked Supabase template variables and Gmail CSS guidance. Keep account + actions as HTML text/links, inline styles, table layout, scalable typography, + and a full copyable verification URL. No image generation or remote logo needed. +- Delivery remains manual: the owner will paste the replacement HTML into the + matching Supabase templates. Do not enable providers, send emails, or mark the + draft ready without verified delivery. Browser checks are not inbox tests. + +### Original preparation + - Verified the mobile app uses Supabase `signUp` and `resetPasswordForEmail`; FastAPI supplies the existing `/confirmed` and `/reset-password` landing pages. There is no committed email template/setup runbook. Live SMTP configuration @@ -78,7 +100,7 @@ claims as completed work. `develop`, with closing references for both #152 and #171. Both issues remain open until the live activation checklist passes and the PR merges. Publication bookkeeping: `docs: link combined authentication email pull request`. -- **Owner handoff:** create the free Resend account and decide whether NIC.UA's +- **Original owner handoff (superseded by Gmail choice above):** create the free Resend account and decide whether NIC.UA's card-verification/public-contact terms are acceptable before registering any free domain. The question remains pending; no consent was inferred. Complete the exact DNS/SMTP/template steps in `docs/EMAIL_SETUP.md` once a suitable domain From ac02745563c025789fa1957539432754b5d2c285 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:06:59 +0500 Subject: [PATCH 10/17] design: simplify signup email with One Concept masthead --- backend/email-templates/confirm-signup.html | 76 ++++++++------------- 1 file changed, 30 insertions(+), 46 deletions(-) diff --git a/backend/email-templates/confirm-signup.html b/backend/email-templates/confirm-signup.html index f693277..6ceac40 100644 --- a/backend/email-templates/confirm-signup.html +++ b/backend/email-templates/confirm-signup.html @@ -3,55 +3,39 @@ - Confirm your email — One Concept - + - -
- Confirm your email to finish creating your One Concept account. -
- - - - +
One last step to finish setting up your account.
+
- - - - - - - - - - - -
-

One Concept.

-

by Coding Moves

-
-

WELCOME ABOARD

-

Confirm your email

-

Use the button below to confirm your email and finish creating your One Concept account.

- - - - -
- Confirm my email -
-

After confirming, open the app on your phone and sign in.

-

Button not opening? Copy this link into your browser:

-

- {{ .ConfirmationURL }} -

-
-

Didn't create this account? You can ignore this email.

-

This is an account email from One Concept by Coding Moves.

-
- -
+
+ + + + + +
+

One Concept.

+

by Coding Moves

+
+

Confirm your email.

+

Confirm this address to finish setting up your account.

+ + +
+ Confirm email +
+

Then return to the app and sign in.

+
+

If you didn’t sign up, you can ignore this email.

+

Button not working? Copy this link into your browser:

+

+ {{ .ConfirmationURL }} +

+
+ +
From fded7b183b2b7d52889f26c7f98b52e5b56ae832 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:07:34 +0500 Subject: [PATCH 11/17] design: align password recovery email with concise account layout --- backend/email-templates/reset-password.html | 76 ++++++++------------- 1 file changed, 30 insertions(+), 46 deletions(-) diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html index af88376..df0ce86 100644 --- a/backend/email-templates/reset-password.html +++ b/backend/email-templates/reset-password.html @@ -3,55 +3,39 @@ - Reset your password — One Concept - + - -
- Choose a new password for your One Concept account. -
- - - - +
Choose a new password for your One Concept account.
+
- - - - - - - - - - - -
-

One Concept.

-

by Coding Moves

-
-

ACCOUNT RECOVERY

-

Reset your password

-

We received a request to reset your One Concept password. Use the button below to choose a new one.

- - - - -
- Reset my password -
-

After saving your new password, return to the app and sign in. If this link has expired, request a new one with Forgot password in the app.

-

Button not opening? Copy this link into your browser:

-

- {{ .ConfirmationURL }} -

-
-

Didn't request a reset? You can ignore this email. Your password will stay the same.

-

This is an account email from One Concept by Coding Moves.

-
- -
+
+ + + + + +
+

One Concept.

+

by Coding Moves

+
+

Reset your pass­word.

+

A password reset was requested for your account. Choose a new password below.

+ + +
+ Reset password +
+

Once it’s saved, return to the app and sign in.

+
+

If you didn’t request this, ignore this email. Your password won’t change.

+

Button not working? Copy this link into your browser:

+

+ {{ .ConfirmationURL }} +

+
+ +
From e09ad7ac7de4c90e8ba3107f3cc582683415ec9f Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:09:56 +0500 Subject: [PATCH 12/17] fix: keep recovery heading words together at normal text sizes --- backend/email-templates/reset-password.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html index df0ce86..d607e54 100644 --- a/backend/email-templates/reset-password.html +++ b/backend/email-templates/reset-password.html @@ -17,7 +17,7 @@

by Coding Moves

-

Reset your pass­word.

+

Reset your pass­word.

A password reset was requested for your account. Choose a new password below.

From fabcf84dfa794087de90a9f72470dbc79c9b383a Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:11:15 +0500 Subject: [PATCH 13/17] feat: link email branding to Coding Moves GitHub organization --- backend/email-templates/confirm-signup.html | 2 +- backend/email-templates/reset-password.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/email-templates/confirm-signup.html b/backend/email-templates/confirm-signup.html index 6ceac40..784094f 100644 --- a/backend/email-templates/confirm-signup.html +++ b/backend/email-templates/confirm-signup.html @@ -14,7 +14,7 @@

One Concept.

-

by Coding Moves

+

by Coding Moves

Confirm your email.

diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html index d607e54..3367efd 100644 --- a/backend/email-templates/reset-password.html +++ b/backend/email-templates/reset-password.html @@ -14,7 +14,7 @@

One Concept.

-

by Coding Moves

+

by Coding Moves

Reset your pass­word.

From 535b135a82c2c226e1f0358e7549b9c0873764aa Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:11:18 +0500 Subject: [PATCH 14/17] docs: update replacement email instructions and visual validation --- docs/CODEBASE_MAP.md | 2 +- docs/EMAIL_SETUP.md | 66 ++++++++++++++++++++++++++++++++------------ docs/WORK_LOG.md | 30 +++++++++++++++++++- 3 files changed, 79 insertions(+), 19 deletions(-) diff --git a/docs/CODEBASE_MAP.md b/docs/CODEBASE_MAP.md index 3591bfc..dea35bc 100644 --- a/docs/CODEBASE_MAP.md +++ b/docs/CODEBASE_MAP.md @@ -17,7 +17,7 @@ learned history, streaks, likes, saved concepts, and push reminders. | Content engine | `backend/app/services/generation.py`, `pool.py`, `prefetch.py`; Gemini lessons from a curated backlog. | | Operations | `.github/workflows/`, `backend/railway.json`, `backend/Dockerfile`, `mobile/eas.json`, `mobile/app.config.js`. | | Documentation | Root `README.md`, `RELEASING.md`, `CONTRIBUTING.md`, `docs/ARCHITECTURE.md`, `docs/ROADMAP.md`, and the backend/mobile guides. | -| Authentication email | `backend/email-templates/` contains signup and recovery HTML for Supabase Auth; `docs/EMAIL_SETUP.md` covers Resend SMTP/DNS installation and real-inbox acceptance. These files are installed manually, not deployed by the app. | +| Authentication email | `backend/email-templates/` contains signup and recovery HTML with One Concept text branding; `docs/EMAIL_SETUP.md` covers manual replacement, the current Gmail SMTP choice, optional Resend setup, and real-inbox acceptance. These files are installed manually, not deployed by the app. | | Agent guidance | Root `AGENTS.md`; `mobile/AGENTS.md` adds Expo documentation requirements and `mobile/CLAUDE.md` references it. | ## Mobile navigation and presentation diff --git a/docs/EMAIL_SETUP.md b/docs/EMAIL_SETUP.md index c5a0af2..a3980a9 100644 --- a/docs/EMAIL_SETUP.md +++ b/docs/EMAIL_SETUP.md @@ -1,4 +1,4 @@ -# Authentication email with Resend +# Authentication email setup This is the shared delivery and branding setup for [#152](https://github.com/Coding-Moves/one-concept/issues/152) and [#171](https://github.com/Coding-Moves/one-concept/issues/171). @@ -6,12 +6,37 @@ and [#171](https://github.com/Coding-Moves/one-concept/issues/171). Keep the implementation PR in draft until the acceptance checks below pass. The app already asks Supabase Auth to send signup and password-recovery emails. -Supabase owns verification tokens; Resend transports the messages through custom -SMTP. FastAPI serves the existing confirmation and password-reset pages. The +Supabase owns verification tokens; the configured provider transports messages +through custom SMTP. FastAPI serves the existing confirmation and password-reset pages. The HTML files in this repository must be installed in Supabase; deploying or merging them does not install them. Daily reminders remain push notifications. -## What the owner needs to do +## Replace the existing templates + +The owner has chosen their existing Gmail account for SMTP, with a $0 budget and +no domain purchase. The HTML works with either Gmail or Resend: follow +[template installation](#6-install-the-two-templates) to replace the two bodies, +then [verify delivery](#7-verify-real-delivery-before-completing-either-issue). +SMTP credentials belong only in Supabase's SMTP settings, never in the HTML. +Saving the templates changes future emails immediately; no app update is needed. + +Use the complete raw source, not a rendered preview. The redesign keeps the same +subjects and confirmation placeholders, so existing redirect settings still apply. +The owner chose One Concept text branding because the app currently contains +Expo starter icons rather than a separate official logo. No logo URL is needed. +The masthead's "Coding Moves" text links once per email to the verified +[GitHub organization](https://github.com/Coding-Moves). Authentication buttons +and fallback links still use Supabase's own confirmation URL. + +Gmail is a limited personal sender; successful tests do not establish capacity +for a large rollout. Live SMTP authentication and inbox delivery remain unverified. +The existing draft PR stays open while those checks are pending. + +## Optional Resend setup + +Steps 1–4 below preserve the original Resend preparation. They are not required +for the owner's current Gmail setup. The later redirect, template, and acceptance +steps apply to either provider. The owner has set a **$0 budget, with no domain purchase**. Complete the numbered steps below only using free services. If registration, identity verification, @@ -159,8 +184,11 @@ use the same supported variable, but Supabase supplies the appropriate signup or recovery verification URL for the selected template. Subjects are separate dashboard fields; the HTML comments do not configure them. -The templates use inline styles, table layouts, system fonts, visible fallback -links, and a text wordmark. They require no external images or JavaScript. +The templates use a dark masthead with a text wordmark, short account-specific +copy, one full-width action button, and a separate fallback-link area. Inline +styles, tables, and system fonts keep the design usable without remote images, +fonts, or JavaScript. Recovery's heading includes an optional soft hyphen so +enlarged text can break the word "password" cleanly on narrow screens. They do not claim an expiry duration, which is controlled by Supabase settings. The app has no magic-link sign-in button, so the optional magic-link template from #171 is deferred; no new authentication method is enabled by this PR. @@ -188,26 +216,30 @@ delivery status, and outcome in the PR's activation checklist. DKIM, and DMARC results; resolve failures before calling the setup complete. - [ ] **Fallback link:** use a fresh email and copy its fallback URL into the browser; verify that it completes the same action as the button. -- [ ] **Provider evidence:** Resend logs show successful delivery for signup and - recovery, and Supabase Auth logs show no SMTP failure. Provider acceptance - alone does not prove inbox delivery or working links. +- [ ] **Provider evidence:** Supabase Auth logs show no SMTP failure and both + messages arrive in the recipient inboxes. If using Resend, check its delivery + logs too. Provider acceptance alone does not prove inbox delivery or working links. When these pass, record the actual results, mark the PR ready, and merge the single PR that closes both #152 and #171. Do not close either as completed while -domain verification or real delivery is still pending. +required provider verification or real delivery is still pending. Record Gmail's +limited-volume tradeoff explicitly; do not describe it as a verified production +transactional service merely because the HTML has been installed. ## Operating and troubleshooting -Use **Resend → Emails/Logs** for delivery, bounce, suppression, and quota details; -use **Supabase → Logs → Auth** for request and SMTP errors. FastAPI does not send -these messages and cannot establish delivery from its own logs. Check remaining -Resend allowance before a signup campaign, and review failures after activation. +Use **Supabase → Logs → Auth** for request and SMTP errors. With Gmail, check +the recipient inbox/spam folder and any delivery failures in the sender mailbox. +For Resend, use **Resend → Emails/Logs** for delivery, bounce, suppression, and +quota details. FastAPI does not send these messages and cannot establish delivery +from its own logs. Check the selected provider's allowance before a signup +campaign, and review failures after activation. | Symptom | Check | | --- | --- | -| Only team members receive mail | Correct Supabase project, custom SMTP saved, domain verified, Send Email hook status. | -| SMTP authentication/sender error | Dedicated key, sending-domain scope, exact From address, host and port. | -| Rate-limit error or missing messages | Both Supabase's hourly limit and Resend's daily/monthly allowance; use a new request after limits permit. | +| Only team members receive mail | Correct Supabase project, custom SMTP saved, Send Email hook status; domain verification if using Resend. | +| SMTP authentication/sender error | Gmail: matching sender/username and a valid app password. Resend: dedicated key and domain scope. Check host and port for the chosen provider. | +| Rate-limit error or missing messages | Both Supabase's hourly limit and the selected provider's allowance; use a new request after limits permit. | | Email arrives, link fails | Tracking disabled, correct template slot, intact placeholder, existing backend redirects; request a fresh link. Some inbox scanners consume one-time links. | | Reset page says it is unavailable | Existing backend `SUPABASE_ANON_KEY` and deployment configuration; see [RELEASING.md](../RELEASING.md). | | Password reset gives no account-specific detail | Expected: the app deliberately avoids disclosing whether an account exists. | diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index 1afcf6b..78f4598 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -47,6 +47,33 @@ claims as completed work. - Delivery remains manual: the owner will paste the replacement HTML into the matching Supabase templates. Do not enable providers, send emails, or mark the draft ready without verified delivery. Browser checks are not inbox tests. +- Delivered a dark One Concept masthead, shorter account-specific messages, + full-width buttons, and a quieter fallback area. Signup HTML is 3,176 bytes + (18.2% smaller); recovery is 3,309 bytes (17.3% smaller). Each is 41 lines. + Both retain all three `{{ .ConfirmationURL }}` occurrences and need no images. +- Owner also requested a clickable Coding Moves attribution. Verified + `https://github.com/Coding-Moves` through GitHub's organization API and linked + the masthead text once in each email. The authentication destinations are unchanged. +- **Validation:** 48 final Chromium scenarios passed: two templates, four widths + (320/390/600/960), normal/doubled/stripped text styles, and normal/long dummy + verification URLs. Checked exact link destinations, copyable full URLs, no + network resources, styled overflow, readable line heights, and 44px+ actions. + Inspected mobile, desktop, and doubled-text renders. Recovery's heading keeps + "password" together normally and permits a soft hyphen at enlarged sizes. All authored + text/button color pairs exceed 6:1 contrast. Local Markdown file links and + whitespace checks passed. Actual Gmail/Outlook rendering and delivery remain + unverified; backend/mobile tests were not run for standalone HTML/doc changes. +- Preview artifacts and the local browser harness are under + `/tmp/one-concept-email-redesign/`, outside Git. They use dummy links only; + the owner must copy the repository HTML, not a preview with example URLs. +- Commits: `4c75b72` records scope; `ac02745` redesigns signup; `fded7b1` redesigns + recovery; `e09ad7a` improves heading wrapping. The organization link is recorded + by `feat: link email branding to Coding Moves GitHub organization`. + Installation/map changes and this handoff are recorded by + `docs: update replacement email instructions and visual validation`. +- **Handoff:** update the same draft PR #187; replace the two HTML bodies using + the unchanged subjects in `docs/EMAIL_SETUP.md`. Gmail setup and both inbox + acceptance flows still require verification. No Supabase settings were changed. ### Original preparation @@ -100,7 +127,8 @@ claims as completed work. `develop`, with closing references for both #152 and #171. Both issues remain open until the live activation checklist passes and the PR merges. Publication bookkeeping: `docs: link combined authentication email pull request`. -- **Original owner handoff (superseded by Gmail choice above):** create the free Resend account and decide whether NIC.UA's +- **Original owner handoff (superseded by Gmail choice above):** create the free + Resend account and decide whether NIC.UA's card-verification/public-contact terms are acceptable before registering any free domain. The question remains pending; no consent was inferred. Complete the exact DNS/SMTP/template steps in `docs/EMAIL_SETUP.md` once a suitable domain From 95b9db6183e8162cbb745790ddb69f0f2c09370f Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:27:21 +0500 Subject: [PATCH 15/17] feat: add branded password changed notification email --- backend/email-templates/password-changed.html | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 backend/email-templates/password-changed.html diff --git a/backend/email-templates/password-changed.html b/backend/email-templates/password-changed.html new file mode 100644 index 0000000..46897df --- /dev/null +++ b/backend/email-templates/password-changed.html @@ -0,0 +1,34 @@ + + + + + + Your password was changed — One Concept + + + +
A security update for your One Concept account.
+ + +
+ + + + + +
+

One Concept.

+

by Coding Moves

+
+

Pass­word changed.

+

Your One Concept password was changed.

+

If you made this change, no further action is needed.

+
+

Didn’t make this change?

+

Open One Concept and use Forgot password on the sign-in screen to reset your password.

+

Contact support immediately.

+
+ +
+ + From b0695cadf2bb5895d687819f1d2f9c8fb56592a5 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:28:06 +0500 Subject: [PATCH 16/17] docs: explain password changed email installation and validation --- docs/CODEBASE_MAP.md | 2 +- docs/EMAIL_SETUP.md | 26 ++++++++++++++++++++------ docs/WORK_LOG.md | 36 ++++++++++++++++++++++++++++++++---- 3 files changed, 53 insertions(+), 11 deletions(-) diff --git a/docs/CODEBASE_MAP.md b/docs/CODEBASE_MAP.md index dea35bc..12f5d3b 100644 --- a/docs/CODEBASE_MAP.md +++ b/docs/CODEBASE_MAP.md @@ -17,7 +17,7 @@ learned history, streaks, likes, saved concepts, and push reminders. | Content engine | `backend/app/services/generation.py`, `pool.py`, `prefetch.py`; Gemini lessons from a curated backlog. | | Operations | `.github/workflows/`, `backend/railway.json`, `backend/Dockerfile`, `mobile/eas.json`, `mobile/app.config.js`. | | Documentation | Root `README.md`, `RELEASING.md`, `CONTRIBUTING.md`, `docs/ARCHITECTURE.md`, `docs/ROADMAP.md`, and the backend/mobile guides. | -| Authentication email | `backend/email-templates/` contains signup and recovery HTML with One Concept text branding; `docs/EMAIL_SETUP.md` covers manual replacement, the current Gmail SMTP choice, optional Resend setup, and real-inbox acceptance. These files are installed manually, not deployed by the app. | +| Authentication email | `backend/email-templates/` contains signup, recovery, and password-changed notification HTML with One Concept text branding; `docs/EMAIL_SETUP.md` covers manual installation, the security notification toggle, the current Gmail SMTP choice, optional Resend setup, and real-inbox acceptance. These files are installed manually, not deployed by the app. | | Agent guidance | Root `AGENTS.md`; `mobile/AGENTS.md` adds Expo documentation requirements and `mobile/CLAUDE.md` references it. | ## Mobile navigation and presentation diff --git a/docs/EMAIL_SETUP.md b/docs/EMAIL_SETUP.md index a3980a9..c72bc2d 100644 --- a/docs/EMAIL_SETUP.md +++ b/docs/EMAIL_SETUP.md @@ -15,7 +15,7 @@ them does not install them. Daily reminders remain push notifications. The owner has chosen their existing Gmail account for SMTP, with a $0 budget and no domain purchase. The HTML works with either Gmail or Resend: follow -[template installation](#6-install-the-two-templates) to replace the two bodies, +[template installation](#6-install-the-templates) to install the email bodies, then [verify delivery](#7-verify-real-delivery-before-completing-either-issue). SMTP credentials belong only in Supabase's SMTP settings, never in the HTML. Saving the templates changes future emails immediately; no app update is needed. @@ -167,24 +167,32 @@ Keep the project's existing Supabase URL and anon/publishable key unchanged. Do not replace the email action link with either landing-page URL: the user must first pass through Supabase's token verification endpoint. -### 6. Install the two templates +### 6. Install the templates In **Supabase → Authentication → Email → Templates**, open each matching template. -Set its subject below, then paste the **entire raw HTML file**, including its -`{{ .ConfirmationURL }}` placeholders, into the body and save. +Set its subject below, then paste the **entire raw HTML file** into the body and +save. Preserve `{{ .ConfirmationURL }}` in signup and reset; the password-changed +notification has no verification token or reset-link placeholder. | Supabase template | Subject | File | | --- | --- | --- | | Confirm sign up | `Confirm your email — One Concept` | [confirm-signup.html](../backend/email-templates/confirm-signup.html) | | Reset password | `Reset your password — One Concept` | [reset-password.html](../backend/email-templates/reset-password.html) | +| Password changed (Security) | `Your password was changed — One Concept` | [password-changed.html](../backend/email-templates/password-changed.html) | + +For **Security → Password changed**, also enable the notification switch and save. +This email reports a completed password change; it does not initiate a reset. +It directs the user to Forgot password in the app and links to the existing +support address from the app's About screen. Do not copy the recovery template +or add `{{ .ConfirmationURL }}` to this notification. On GitHub, open the file and choose **Raw** to copy its source. Do not copy a -rendered browser preview or replace the placeholders manually. Both templates +rendered browser preview or replace the placeholders manually. The two action templates use the same supported variable, but Supabase supplies the appropriate signup or recovery verification URL for the selected template. Subjects are separate dashboard fields; the HTML comments do not configure them. -The templates use a dark masthead with a text wordmark, short account-specific +The action templates use a dark masthead with a text wordmark, short account-specific copy, one full-width action button, and a separate fallback-link area. Inline styles, tables, and system fonts keep the design usable without remote images, fonts, or JavaScript. Recovery's heading includes an optional soft hyphen so @@ -193,6 +201,9 @@ They do not claim an expiry duration, which is controlled by Supabase settings. The app has no magic-link sign-in button, so the optional magic-link template from #171 is deferred; no new authentication method is enabled by this PR. [Supabase template variables](https://supabase.com/docs/guides/auth/auth-email-templates#terminology). +The password-changed notification uses the same masthead and typography with a +separate security-advice section. Notification emails must be enabled separately; +see [Supabase's security notification documentation](https://supabase.com/docs/guides/auth/auth-email-templates). ### 7. Verify real delivery before completing either issue @@ -208,6 +219,9 @@ delivery status, and outcome in the PR's activation checklist. - [ ] **Password recovery:** for that account, use Forgot password in the app, receive the branded email, open `/reset-password` via its button, set a new password, then successfully sign in with the new password. +- [ ] **Password changed:** after enabling the security notification, complete a + reset on a test account you control and verify the separate notification + arrives. Check its organization/support destinations without sending a message. - [ ] **Used/expired recovery link:** confirm it does not permit another reset; request a fresh link and check that recovery still works. - [ ] **Second inbox provider:** repeat delivery checks using another inbox diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index 78f4598..4286836 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -15,10 +15,11 @@ claims as completed work. - Owner requires a $0 setup and has chosen their existing Gmail account for Supabase SMTP. The owner is performing dashboard setup; saving the settings and actual inbox delivery remain unverified. Resend preparation stays in draft. -- Current follow-up: redesign the two HTML emails with shorter copy and polished - One Concept text branding. The configured mobile images are Expo starter assets; - the owner explicitly selected text branding instead. Preserve verification URLs - and deliver replacement HTML in the same draft PR, with no dashboard changes. +- Redesigned signup/recovery emails and added a matching password-changed + notification with One Concept text branding and a linked Coding Moves masthead. + The configured mobile images are Expo starter assets; the owner explicitly + selected text branding. All three HTML files are ready for manual installation + in the same draft PR. No dashboard settings were changed. - PR #185 (#150) is merged. [PR #186](https://github.com/Coding-Moves/one-concept/pull/186) remains open; its independent review found no actionable issue and reran all 63 generation tests with no skips. Its generation-budget changes are separate. @@ -31,6 +32,33 @@ claims as completed work. ## Resend authentication email (#152 and #171) — 2026-09-12 +### Password-changed notification follow-up + +- Owner requested a matching replacement for Supabase's Password changed email. + Add one standalone security notification in the same draft PR, followed by + installation notes and validation. Preserve the two existing action templates. +- Rechecked Supabase's password-changed notification semantics and the support + email in `mobile/src/screens/AboutScreen.tsx`. Use the existing text masthead + and GitHub organization link; point support to the app's published email. + Do not include a fabricated reset token/link or change any Supabase setting. +- Delivered `backend/email-templates/password-changed.html`: dark masthead, + completed-change confirmation, and a separate section directing unrecognized + changes to Forgot password and the app's support email. Added installation, + notification-enablement, and real-inbox acceptance instructions to the runbook. +- **Validation:** all 12 local Chromium scenarios passed at 320/390/600/960px + with normal, doubled, and stripped styles. Checked exact organization/support + links, support-address agreement with the app, no token variables or external + resources, no styled horizontal overflow, and readable line heights. Inspected + mobile, desktop, and doubled-text previews. Backend/mobile tests were not run + for this standalone HTML/documentation change; live notification delivery and + actual email-client rendering still require verification. +- Commit `95b9db6` adds the notification; `docs: explain password changed email + installation and validation` records its runbook, map, and handoff. Local + Markdown file/anchor checks and `git diff --check` passed. +- **Handoff:** same draft PR #187. Copy the new raw HTML and its subject into + Supabase's Security → Password changed template and enable that notification. + No messages sent or production settings changed. Preserve existing commits. + ### Template redesign follow-up - Owner requested professional replacement HTML for signup and password recovery, From 13416c0f23c6cb887920fb14018182ceadd14822 Mon Sep 17 00:00:00 2001 From: Muawiya Amir Date: Sat, 12 Sep 2026 23:34:40 +0500 Subject: [PATCH 17/17] docs: keep deferred email delivery separate from templates --- README.md | 2 +- backend/README.md | 12 +-- backend/email-templates/confirm-signup.html | 41 -------- backend/email-templates/password-changed.html | 34 ------- backend/email-templates/reset-password.html | 41 -------- docs/CODEBASE_MAP.md | 2 +- docs/EMAIL_SETUP.md | 97 ++++++------------- docs/WORK_LOG.md | 41 +++++--- 8 files changed, 61 insertions(+), 209 deletions(-) delete mode 100644 backend/email-templates/confirm-signup.html delete mode 100644 backend/email-templates/password-changed.html delete mode 100644 backend/email-templates/reset-password.html diff --git a/README.md b/README.md index e3741a7..17a857c 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ link's build current automatically. - [Architecture](docs/ARCHITECTURE.md) — how the pieces fit, selection, reminders, security - [Roadmap](docs/ROADMAP.md) — shipped phases and what's next - [Backend](backend/README.md) — API endpoints, auth, running locally -- [Authentication email](docs/EMAIL_SETUP.md) — Resend setup, branded templates, and delivery checks +- [SMTP delivery setup](docs/EMAIL_SETUP.md) — deferred provider setup and delivery checks - [Deployment](mobile/DEPLOYMENT.md) — EAS builds, OTA updates, release runbook ## Contributing diff --git a/backend/README.md b/backend/README.md index e228200..9634c52 100644 --- a/backend/README.md +++ b/backend/README.md @@ -29,7 +29,6 @@ backend/ │ │ └── users.py profile bootstrap (safety net for the DB trigger) │ └── api/v1/ health, topics, daily ├── migrations/ # plain SQL, applied in filename order -├── email-templates/ # signup/recovery HTML installed manually in Supabase Auth ├── tests/ # 25 tests: token verification, selection, HTTP ├── Dockerfile # what Railway builds └── .env.example # copy to .env — never commit the filled copy @@ -107,12 +106,11 @@ confusion attacks, both of which are covered by tests. `user_id` is taken from the verified token's `sub` claim and from nowhere else. No endpoint accepts a user id as a parameter. -Supabase Auth sends account confirmation and password-recovery emails through -its configured email provider. Install the branded HTML in `email-templates/` -and configure Resend custom SMTP using [Authentication email setup](../docs/EMAIL_SETUP.md). -The guide includes domain/DNS steps, free-plan limits, the existing redirect -contract, and real-inbox acceptance checks. Merging the files does not configure -SMTP or publish templates; production activation must be verified separately. +Supabase Auth sends account emails through its configured provider. See +[SMTP delivery setup](../docs/EMAIL_SETUP.md) for the deferred provider preparation +and real-inbox checks. Branded templates are delivered independently in +[PR #188](https://github.com/Coding-Moves/one-concept/pull/188). Repository changes +do not configure SMTP or publish templates in Supabase. ## Content generation diff --git a/backend/email-templates/confirm-signup.html b/backend/email-templates/confirm-signup.html deleted file mode 100644 index 784094f..0000000 --- a/backend/email-templates/confirm-signup.html +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - Confirm your email — One Concept - - - -
One last step to finish setting up your account.
- - -
- - - - - -
-

One Concept.

-

by Coding Moves

-
-

Confirm your email.

-

Confirm this address to finish setting up your account.

- - -
- Confirm email -
-

Then return to the app and sign in.

-
-

If you didn’t sign up, you can ignore this email.

-

Button not working? Copy this link into your browser:

-

- {{ .ConfirmationURL }} -

-
- -
- - diff --git a/backend/email-templates/password-changed.html b/backend/email-templates/password-changed.html deleted file mode 100644 index 46897df..0000000 --- a/backend/email-templates/password-changed.html +++ /dev/null @@ -1,34 +0,0 @@ - - - - - - Your password was changed — One Concept - - - -
A security update for your One Concept account.
- - -
- - - - - -
-

One Concept.

-

by Coding Moves

-
-

Pass­word changed.

-

Your One Concept password was changed.

-

If you made this change, no further action is needed.

-
-

Didn’t make this change?

-

Open One Concept and use Forgot password on the sign-in screen to reset your password.

-

Contact support immediately.

-
- -
- - diff --git a/backend/email-templates/reset-password.html b/backend/email-templates/reset-password.html deleted file mode 100644 index 3367efd..0000000 --- a/backend/email-templates/reset-password.html +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - Reset your password — One Concept - - - -
Choose a new password for your One Concept account.
- - -
- - - - - -
-

One Concept.

-

by Coding Moves

-
-

Reset your pass­word.

-

A password reset was requested for your account. Choose a new password below.

- - -
- Reset password -
-

Once it’s saved, return to the app and sign in.

-
-

If you didn’t request this, ignore this email. Your password won’t change.

-

Button not working? Copy this link into your browser:

-

- {{ .ConfirmationURL }} -

-
- -
- - diff --git a/docs/CODEBASE_MAP.md b/docs/CODEBASE_MAP.md index 12f5d3b..789eebd 100644 --- a/docs/CODEBASE_MAP.md +++ b/docs/CODEBASE_MAP.md @@ -17,7 +17,7 @@ learned history, streaks, likes, saved concepts, and push reminders. | Content engine | `backend/app/services/generation.py`, `pool.py`, `prefetch.py`; Gemini lessons from a curated backlog. | | Operations | `.github/workflows/`, `backend/railway.json`, `backend/Dockerfile`, `mobile/eas.json`, `mobile/app.config.js`. | | Documentation | Root `README.md`, `RELEASING.md`, `CONTRIBUTING.md`, `docs/ARCHITECTURE.md`, `docs/ROADMAP.md`, and the backend/mobile guides. | -| Authentication email | `backend/email-templates/` contains signup, recovery, and password-changed notification HTML with One Concept text branding; `docs/EMAIL_SETUP.md` covers manual installation, the security notification toggle, the current Gmail SMTP choice, optional Resend setup, and real-inbox acceptance. These files are installed manually, not deployed by the app. | +| SMTP delivery setup | `docs/EMAIL_SETUP.md` retains deferred provider configuration and real-inbox acceptance. The branded HTML and its installation guide are separate in [PR #188](https://github.com/Coding-Moves/one-concept/pull/188). | | Agent guidance | Root `AGENTS.md`; `mobile/AGENTS.md` adds Expo documentation requirements and `mobile/CLAUDE.md` references it. | ## Mobile navigation and presentation diff --git a/docs/EMAIL_SETUP.md b/docs/EMAIL_SETUP.md index c72bc2d..d181b8d 100644 --- a/docs/EMAIL_SETUP.md +++ b/docs/EMAIL_SETUP.md @@ -1,36 +1,26 @@ -# Authentication email setup +# SMTP delivery setup (deferred) -This is the shared delivery and branding setup for [#152](https://github.com/Coding-Moves/one-concept/issues/152) +This draft prepares the delivery configuration for [#152](https://github.com/Coding-Moves/one-concept/issues/152) and [#171](https://github.com/Coding-Moves/one-concept/issues/171). -**Status: prepared for installation; production SMTP and inbox delivery are not verified.** -Keep the implementation PR in draft until the acceptance checks below pass. +**Status: SMTP activation and real inbox delivery remain unverified.** +Keep [PR #187](https://github.com/Coding-Moves/one-concept/pull/187) in draft. +The owner has a $0 budget and is not purchasing a domain now. + +The branded HTML and installation guide are a separate, non-draft change in +[PR #188](https://github.com/Coding-Moves/one-concept/pull/188). Those templates +work with the project's configured sender and do not depend on this draft or +on buying a domain. This branch retains the provider preparation only. + +The owner previously chose an existing Gmail account for initial Supabase SMTP; +actual authentication and inbox delivery still need verification. Supabase's +built-in sender remains limited to project-team addresses and currently two +emails per hour; customizing the HTML does not remove those restrictions. +[Supabase SMTP documentation](https://supabase.com/docs/guides/auth/auth-smtp). The app already asks Supabase Auth to send signup and password-recovery emails. -Supabase owns verification tokens; the configured provider transports messages -through custom SMTP. FastAPI serves the existing confirmation and password-reset pages. The -HTML files in this repository must be installed in Supabase; deploying or merging -them does not install them. Daily reminders remain push notifications. - -## Replace the existing templates - -The owner has chosen their existing Gmail account for SMTP, with a $0 budget and -no domain purchase. The HTML works with either Gmail or Resend: follow -[template installation](#6-install-the-templates) to install the email bodies, -then [verify delivery](#7-verify-real-delivery-before-completing-either-issue). -SMTP credentials belong only in Supabase's SMTP settings, never in the HTML. -Saving the templates changes future emails immediately; no app update is needed. - -Use the complete raw source, not a rendered preview. The redesign keeps the same -subjects and confirmation placeholders, so existing redirect settings still apply. -The owner chose One Concept text branding because the app currently contains -Expo starter icons rather than a separate official logo. No logo URL is needed. -The masthead's "Coding Moves" text links once per email to the verified -[GitHub organization](https://github.com/Coding-Moves). Authentication buttons -and fallback links still use Supabase's own confirmation URL. - -Gmail is a limited personal sender; successful tests do not establish capacity -for a large rollout. Live SMTP authentication and inbox delivery remain unverified. -The existing draft PR stays open while those checks are pending. +Supabase owns verification tokens and sends through its configured SMTP provider; +FastAPI serves the existing confirmation/reset pages. No app release installs +SMTP settings or email templates. Daily reminders remain push notifications. ## Optional Resend setup @@ -167,43 +157,14 @@ Keep the project's existing Supabase URL and anon/publishable key unchanged. Do not replace the email action link with either landing-page URL: the user must first pass through Supabase's token verification endpoint. -### 6. Install the templates - -In **Supabase → Authentication → Email → Templates**, open each matching template. -Set its subject below, then paste the **entire raw HTML file** into the body and -save. Preserve `{{ .ConfirmationURL }}` in signup and reset; the password-changed -notification has no verification token or reset-link placeholder. - -| Supabase template | Subject | File | -| --- | --- | --- | -| Confirm sign up | `Confirm your email — One Concept` | [confirm-signup.html](../backend/email-templates/confirm-signup.html) | -| Reset password | `Reset your password — One Concept` | [reset-password.html](../backend/email-templates/reset-password.html) | -| Password changed (Security) | `Your password was changed — One Concept` | [password-changed.html](../backend/email-templates/password-changed.html) | - -For **Security → Password changed**, also enable the notification switch and save. -This email reports a completed password change; it does not initiate a reset. -It directs the user to Forgot password in the app and links to the existing -support address from the app's About screen. Do not copy the recovery template -or add `{{ .ConfirmationURL }}` to this notification. - -On GitHub, open the file and choose **Raw** to copy its source. Do not copy a -rendered browser preview or replace the placeholders manually. The two action templates -use the same supported variable, but Supabase supplies the appropriate signup -or recovery verification URL for the selected template. Subjects are separate -dashboard fields; the HTML comments do not configure them. - -The action templates use a dark masthead with a text wordmark, short account-specific -copy, one full-width action button, and a separate fallback-link area. Inline -styles, tables, and system fonts keep the design usable without remote images, -fonts, or JavaScript. Recovery's heading includes an optional soft hyphen so -enlarged text can break the word "password" cleanly on narrow screens. -They do not claim an expiry duration, which is controlled by Supabase settings. -The app has no magic-link sign-in button, so the optional magic-link template -from #171 is deferred; no new authentication method is enabled by this PR. -[Supabase template variables](https://supabase.com/docs/guides/auth/auth-email-templates#terminology). -The password-changed notification uses the same masthead and typography with a -separate security-advice section. Notification emails must be enabled separately; -see [Supabase's security notification documentation](https://supabase.com/docs/guides/auth/auth-email-templates). +### 6. Install the separately reviewed templates + +The three branded HTML files and their provider-independent installation guide +are delivered in [PR #188](https://github.com/Coding-Moves/one-concept/pull/188). +Use that PR's `docs/EMAIL_TEMPLATES.md` for subjects, raw source, confirmation +placeholders, and the password-changed notification toggle. This delivery draft +contains no template files. The template PR can merge before provider setup; +merging either PR does not install templates in Supabase. ### 7. Verify real delivery before completing either issue @@ -234,8 +195,8 @@ delivery status, and outcome in the PR's activation checklist. messages arrive in the recipient inboxes. If using Resend, check its delivery logs too. Provider acceptance alone does not prove inbox delivery or working links. -When these pass, record the actual results, mark the PR ready, and merge the -single PR that closes both #152 and #171. Do not close either as completed while +When these pass, record the actual results, mark this delivery PR ready, and merge it +to complete the delivery work for #152 and #171. Do not close either as completed while required provider verification or real delivery is still pending. Record Gmail's limited-volume tradeoff explicitly; do not describe it as a verified production transactional service merely because the HTML has been installed. diff --git a/docs/WORK_LOG.md b/docs/WORK_LOG.md index 4286836..9761d4c 100644 --- a/docs/WORK_LOG.md +++ b/docs/WORK_LOG.md @@ -7,22 +7,17 @@ claims as completed work. ## Current status -- Prepared one PR chunk for [#152](https://github.com/Coding-Moves/one-concept/issues/152) - and [#171](https://github.com/Coding-Moves/one-concept/issues/171): Resend delivery - setup and branded authentication emails. Branch `codex/152-171-resend-auth-email` - starts from refreshed `origin/develop` (`65eb21d`). Published as - [draft PR #187](https://github.com/Coding-Moves/one-concept/pull/187) into `develop`. -- Owner requires a $0 setup and has chosen their existing Gmail account for - Supabase SMTP. The owner is performing dashboard setup; saving the settings - and actual inbox delivery remain unverified. Resend preparation stays in draft. -- Redesigned signup/recovery emails and added a matching password-changed - notification with One Concept text branding and a linked Coding Moves masthead. - The configured mobile images are Expo starter assets; the owner explicitly - selected text branding. All three HTML files are ready for manual installation - in the same draft PR. No dashboard settings were changed. -- PR #185 (#150) is merged. [PR #186](https://github.com/Coding-Moves/one-concept/pull/186) - remains open; its independent review found no actionable issue and reran all - 63 generation tests with no skips. Its generation-budget changes are separate. +- The owner split email branding from deferred provider setup. The three HTML + files and their independent installation guide are in ready-for-review + [PR #188](https://github.com/Coding-Moves/one-concept/pull/188), targeting `develop`. +- [PR #187](https://github.com/Coding-Moves/one-concept/pull/187) stays in draft for + SMTP delivery preparation. The owner is not purchasing a domain. Gmail setup + and real delivery remain unverified; no production configuration was changed. +- Removed duplicate template files from this draft with a follow-up commit and + redirected its installation references to #188. Original commits remain intact; + no history was rewritten. The new PR preserves nine focused template commits. +- PRs #185 (#150) and [#186](https://github.com/Coding-Moves/one-concept/pull/186) + are merged into `develop`; their implementation is separate from this draft. - The owner reinforced the preference for more focused commits in **all future PRs** for this project. Saved in `AGENTS.md`; retain individual commits and related tests without artificial splits or empty commits. @@ -32,6 +27,20 @@ claims as completed work. ## Resend authentication email (#152 and #171) — 2026-09-12 +### Separate template PR — scope supersedes the earlier combined handoffs + +- Owner requested a non-draft PR for reusable templates independent of Resend + or domain purchase. Published #188 from fresh `develop` (`a6e81f1`) and narrowed + this draft to provider documentation. Template installation remains manual in + Supabase and is independent of app release. Delivery issues remain open. +- The final HTML in #188 matches the previously validated source byte for byte + (60 Chromium scenarios). This cleanup changes documentation and removes the + duplicated sources; local Markdown paths and whitespace checks passed. No + backend/mobile or live-email tests were run for the split. +- Follow-up commit: `docs: keep deferred email delivery separate from templates`. + Before this draft is ready, complete provider configuration and real-inbox + acceptance. No payments, SMTP changes, messages, or release were performed. + ### Password-changed notification follow-up - Owner requested a matching replacement for Supabase's Password changed email.