#114 - feat: email verification before payment — prevent invalid email registrations - forgejo_admin/basketball-api

forgejo_admin commented

2026-03-19 02:09:07 +00:00

Owner

Type

Feature

Lineage

plan-wkq → Phase 11 → Discovered Scope

Repo

forgejo_admin/basketball-api

User Story

As a program administrator
I want parents to verify their email before paying
So that we don't send confirmation emails to invalid addresses and flood our Gmail with bounces

Context

Production problem: parents enter typo'd or invalid emails → register and pay → system sends confirmation email → Gmail bounces → Marcus's inbox fills with bounce notifications → parent never gets credentials and is locked out. No way to recover without manual intervention.

Current flow: form → pay → send email (no verification)
Required flow: form → verification email with link → parent clicks link → THEN pay → send credentials

File Targets

Files to modify:

src/basketball_api/routes/register.py — add email verification step before payment
src/basketball_api/models.py — may need email_verified field on Parent
src/basketball_api/services/email.py — new verification email template

Files in westside-app:

src/routes/register/+page.svelte — new "check your email" intermediate step

Acceptance Criteria

Parent submits form → receives verification email with confirmation link
Clicking link marks email as verified
Payment step only available after email verified
Invalid/bounced emails never reach payment step
Existing promo/cash/card flows still work after verification

Test Expectations

Unit test: registration without verified email returns 400 on payment
Unit test: verification link marks email as verified
Integration test: full flow with verification → payment → credentials
Run command: pytest tests/test_promo_registration.py -v

Constraints

Verification link must expire (24h?)
Must work for all payment methods (card, cash, promo)
Consider: MX record check as fast first-pass validation before sending verification email

Checklist

PR opened
Tests pass
No unrelated changes

westside-basketball — project
Discovered during Phase 6 E2E verification of registration pipeline

### Type Feature ### Lineage `plan-wkq` → Phase 11 → Discovered Scope ### Repo `forgejo_admin/basketball-api` ### User Story As a program administrator I want parents to verify their email before paying So that we don't send confirmation emails to invalid addresses and flood our Gmail with bounces ### Context Production problem: parents enter typo'd or invalid emails → register and pay → system sends confirmation email → Gmail bounces → Marcus's inbox fills with bounce notifications → parent never gets credentials and is locked out. No way to recover without manual intervention. Current flow: form → pay → send email (no verification) Required flow: form → verification email with link → parent clicks link → THEN pay → send credentials ### File Targets Files to modify: - `src/basketball_api/routes/register.py` — add email verification step before payment - `src/basketball_api/models.py` — may need email_verified field on Parent - `src/basketball_api/services/email.py` — new verification email template Files in westside-app: - `src/routes/register/+page.svelte` — new "check your email" intermediate step ### Acceptance Criteria - [ ] Parent submits form → receives verification email with confirmation link - [ ] Clicking link marks email as verified - [ ] Payment step only available after email verified - [ ] Invalid/bounced emails never reach payment step - [ ] Existing promo/cash/card flows still work after verification ### Test Expectations - [ ] Unit test: registration without verified email returns 400 on payment - [ ] Unit test: verification link marks email as verified - [ ] Integration test: full flow with verification → payment → credentials - Run command: `pytest tests/test_promo_registration.py -v` ### Constraints - Verification link must expire (24h?) - Must work for all payment methods (card, cash, promo) - Consider: MX record check as fast first-pass validation before sending verification email ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `westside-basketball` — project - Discovered during Phase 6 E2E verification of registration pipeline