16 行
1.0 KiB
Markdown
16 行
1.0 KiB
Markdown
# Implementation Notes
|
|
|
|
## Approach
|
|
|
|
- Backend exposes `/api/auth/capabilities` with non-secret email delivery readiness.
|
|
- Email-login code and forgot-password code requests fail before account lookup when SMTP delivery is not configured, preserving account enumeration protection.
|
|
- Verification email copy uses Chinese Beijing-time expiry wording instead of ISO UTC timestamps.
|
|
- Normal browsers show Enterprise WeChat as an informational entry only; Enterprise WeChat WebView keeps one-click login as the primary CTA.
|
|
- Frontend email-code login and forgot-password pages disable code sending when delivery is not ready.
|
|
|
|
## Verification Focus
|
|
|
|
- Backend unit coverage for delivery capability, delivery-unavailable behavior and Beijing-time email wording.
|
|
- Frontend E2E coverage for password visibility, PWA update prompt, email-code login, disabled email delivery state, forgot-password flow and Enterprise WeChat entry hierarchy.
|
|
- Deployment checks report public auth capability status without printing SMTP values.
|