[godzam]

Summary

Replaces the broken account features from the freebuff/… branch (parse error in app_settings.php, a migration calling a method CodeIgniter does not have, OAuth state never sent, guessable md5(uniqid()) tokens, verification never enforced, views/routes that did not exist) with a rewrite. All three features are off by default (Settings → Accounts & e-mail).

• One-time links: 32 random bytes, only the SHA-256 hash is stored, single use (atomic UPDATE … WHERE used_at IS NULL), reset 1 h / confirm 3 days. New migration 20261008000000_add_account_security (users.email_verified_at, users.google_sub, user_tokens); existing users count as confirmed.
• E-mail verification: enforced at login after the password is right (no hint for wrong passwords), never logs anybody in, the link opens a button page (POST) so mail scanners cannot use it up, resend is rate-limited and answers the same for unknown addresses.
• Forgot/reset password: identical answer for known and unknown addresses, limited per IP and per address, Turnstile applies (turnstile_on_forgot), no automatic login afterwards, no-store + Referrer-Policy: no-referrer.
• Google: authorization-code + PKCE + state + nonce, single-use 10-minute sign-in session, ID token checked (client, issuer, expiry, nonce, Google-verified e-mail), safe linking (an unconfirmed local account has its password replaced), respects login blocks. The button is a plain link (no inline script, so the production CSP is kept).
• Mail from .env (mail/smtp/sendmail/log; log is development-only), php index.php console mailtest, console prune removes old tokens. No credentials in the repo.

Test plan

• 12 new unit tests (tokens; Google claims/PKCE incl. the RFC 7636 example); 163 total pass locally with a stub runner; PHPStan and CS-Fixer clean
• Browser run on MariaDB (79 checks, 0 failed) with a fake Google: registration with/without verification, login before confirming, link use/reuse/expiry/forged, resend and rate limits, forgot/reset (same answer for unknown addresses, single use, newer link cancels older), Google new/link/relink-refused, unverified e-mail, wrong nonce/aud/exp, callback without starting, forged and replayed state, blocked account, settings validation, phone layout
• Upgrade path: existing users become confirmed after migrating
• Real SMTP / mail() delivery, real Google, MySQL 8.4 and real PHPUnit: only in CI / not run locally

---

Generated by Claude Code