Your account
HOL-D085Story implementation: In progress

Create my account and verify my email

account · Proposed launch phase 1

Start from Home

Review as Visitor

User story

As a visitor, I want to create a free account with my email and password and verify that email so I can save and follow without buying membership.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • Create one registered account; optional Guide, Creator and Athlete setup continues through D090 without HOL approval or duplicate registration.
  • Require email verification before professional publication and before organization creation, claiming, manager-invite acceptance or management. Internal HOL staff access is manually provisioned/invited, never public self-selection.
  • Use a separate registration flow with email as username, password creation/show-hide, password-manager support and clear account terms; public display names are explicit choices, not derived from private email addresses.
  • Apply a minimum 15-character password policy, support long passphrases/paste and screen common/compromised values when connected. Do not require arbitrary character recipes or routine password expiry.
  • Show pending email verification, captured local verification email, resend/cooldown, corrected email, invalid/expired/already-used verification and successful verification. Prevent duplicate registration and provide a safe existing-account sign-in/recovery route.
  • Keep unverified accounts from personal write/participation rights. Successful verification creates ordinary free-account access, not a trial, paid entitlement, professional credential or staff assignment.
  • Return to the attempted public save/follow or continue the same direct membership intent. Cancelled/failed paid joining leaves the verified free account intact; do not create a second user.
  • Use synthetic accounts and local email capture in dev. Do not enable hosted public enrollment, send real email or retain typed credentials in application storage.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review as

Visitor

Start here: Home

Begin on Visitor Home while signed out. If an account is active, use the account/workspace menu → Sign out. Public browsing does not require an account.

Navigation from public entry

  1. 01Begin on Visitor Home, without signing in.
  2. 02Begin on Visitor Home. Use footer Explore → Stories → Open Reading Wind on the Ridge, then Save this story; alternatively use account/workspace menu → Create free account.
  3. 03The feature starts at the Email and Create password form. Confirmation uses the local captured mailbox; it is not a simulated Verify button.

Feature checks start here

Create my account and verify my email

Connected in dev; full acceptance remains In progress. Actual registration, captured email confirmation and later password sign-in work. A free Save signup also survives confirmation in a new tab and returns with the public story saved; expiry/reuse/resend cases remain open.

  1. 04Review Email, Create password, Show create password and the 15-character guidance. Use a fresh fictional account when actually creating one; no paid or staff access is granted.
  2. 05After Create free account inspect the pending confirmation screen. Open its actual message in the local captured mailbox at http://127.0.0.1:54324 and complete the confirmation.
  3. 06Return to the original public story/organization and complete the allowed free action on the same account. Confirmation may open another tab; use that tab for the continuation.
  4. 07Wrong/expired/reused links, duplicate email, resend and cancellation require separately prepared attempts. Record any missing state as incomplete; do not expect fake success/error buttons.

Backend work for this feature

Backend development authorized · Dev only

What needs to be supported

  • Use provider-managed signup/verification and a private account identifier. Require confirmed email for protected personal writes and replace permissive local confirmation/password defaults in dev configuration only.
  • Persist only permitted account/profile values; never derive a public name from email, accept client-set staff/paid attributes or put private email in public people records.
  • Validate password policy, verification token expiry/single use, safe return targets, duplicate/resend behavior and anti-enumeration/rate controls at the trusted service boundary.
  • Use the local captured-email service and synthetic fixtures. If breached-password screening is unavailable locally, document the limitation and a deterministic dev check; no paid tier or external breach API is authorized.

How to verify in dev

  1. Verify pending vs confirmed writes using signed-out, unverified, verified owner and unrelated accounts.
  2. Register/verify twice, expire/reuse tokens, repeat resends and attempt signup with forged metadata; prove no duplicate identity, paid/staff grant or public email-derived name.

Before this can work

  • Begin on Visitor Home while signed out. If an account is active, use the account/workspace menu → Sign out. Public browsing does not require an account.
  • Use only fictional account fixtures and dummy credentials. No real password, factor secret, card or recipient data in the frontend review.
  • UI2 owns frontend; HOL - Backend owns local schema/auth/API/policy/tests. Hosted migrations, public enrollment, outgoing email/payment and deployment remain outside this authorization.
  • HOL-D057 · HOL-D057

    Reviewed local environment/migrations and isolated synthetic fixtures; hosted promotion remains separate.

Connected stories