Why
PR-V1 adds the gate and token fields but nothing sends the email or lets a user complete verification. This wires it end-to-end using the IEmailService from PR-E1 (#18).
This chunk
POST /api/auth/verify-email { token } — look up by token, check expiry, set EmailConfirmed = true, clear token fields, then issue access+refresh tokens (auto-login after verifying, matching how AcceptInvitationAsync already behaves).POST /api/auth/resend-verification { email } — regenerate token + expiry for an unconfirmed user; respond identically regardless of whether the email exists/is already confirmed (no enumeration).RegisterOrganizationAsync now calls IEmailService.SendVerificationEmailAsync(...) after commit, not failing the request if sending fails — RegisterResponse gains an EmailSent flag, mirroring CreateInvitationAsync's response from PR-E1.- Inline HTML template (same style as the PR-E1 invitation template), linking to
{Frontend:BaseUrl}/verify-email?token={token}.
- Unit tests: success, expired token, unknown token, already-confirmed.
Builds on the data model from PR-V1 and the email-sending infrastructure from PR-E1 (#18).
Why
PR-V1 adds the gate and token fields but nothing sends the email or lets a user complete verification. This wires it end-to-end using the
IEmailServicefrom PR-E1 (#18).This chunk
POST /api/auth/verify-email { token }— look up by token, check expiry, setEmailConfirmed = true, clear token fields, then issue access+refresh tokens (auto-login after verifying, matching howAcceptInvitationAsyncalready behaves).POST /api/auth/resend-verification { email }— regenerate token + expiry for an unconfirmed user; respond identically regardless of whether the email exists/is already confirmed (no enumeration).RegisterOrganizationAsyncnow callsIEmailService.SendVerificationEmailAsync(...)after commit, not failing the request if sending fails —RegisterResponsegains anEmailSentflag, mirroringCreateInvitationAsync's response from PR-E1.{Frontend:BaseUrl}/verify-email?token={token}.Builds on the data model from PR-V1 and the email-sending infrastructure from PR-E1 (#18).