2.1 KiB
2.1 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Authenticate with a Discord magic link | Discord users receive private single-use links that establish secure portal sessions. |
|
2026-08-01T20:43:46Z | US-002 | verified |
User Story
As a Discord community member, I want /register and /account to issue a private sign-in link, so that I can access the portal without creating another password.
Acceptance Criteria
- Given the configured guild, when a user runs
/registeror/account, then the bot responds ephemerally with a private link. - Given a generated link, then the raw login token is never stored in PostgreSQL.
- Given a login token, then it expires after ten minutes and can be consumed only once.
- Given repeated link requests, then requests are rate limited per Discord user and older active links are invalidated.
- Given a valid link, when it is consumed, then the Discord user is created or refreshed and a secure seven-day session is established.
- Given a magic-link result behind a reverse proxy, then the browser is redirected through the configured public application URL rather than an internal container address.
- Given an invalid, expired, or consumed link, then the user sees a safe recovery page instructing them to request another link.
Implementation
apps/discord-bot/src/index.tspackages/auth/src/index.tspackages/database/src/auth-repository.tsapps/web/src/app/auth/discord/route.tsapps/web/src/lib/application-url.ts
Validation
packages/auth/test/magic-link.test.tsapps/web/src/lib/application-url.test.ts- Discord command and authentication workspaces pass TypeScript validation.