Passwordless login for the public gateway

• A user with a diamant-software.de address receives a 6-digit code by email.

  Resend integration in auth/otp.ts; domain check at issue (step 2).

• The code expires after 10 minutes and is single-use.

  TTL + consumed-flag on the verification token (step 3).

• Repeated code requests for one address are rate-limited.

  Partial

  In-memory limiter added — but the threshold is hard-coded, not read from policy.

• Every login attempt is written to the audit trail.

  Gap

  Not addressed in this plan — no audit write is included.

Implementation · 4 steps

1. 1

   Create the verification-token table

   Store a hash of the code, an expiry, and a consumed flag — never the raw code.

   src/db/migrations/0042_otp_tokens.sql
2. 2

   Issue codes via Resend, domain-gated

   Reject non-diamant-software.de addresses before sending. Send a 6-digit code.

   src/auth/otp.tssrc/auth/routes.ts
3. 3

   Verify and exchange for a session

   Constant-time compare, enforce TTL + single-use, then mint a session.

   src/auth/otp.tssrc/auth/session.ts
4. 4

   Retire the password path

   Delete password auth and its routes once OTP is the only flow.

   src/auth/password.tssrc/auth/routes.ts

Files · 5

• +src/auth/otp.tsGenerate, send, and verify one-time codes.
• ~src/auth/routes.tsAdd POST /otp/request and /otp/verify endpoints.
• ~src/auth/session.tsExchange a verified code for a session token.
• +src/db/migrations/0042_otp_tokens.sqlTable for verification tokens (hash, ttl, consumed).
• −src/auth/password.tsRemove the now-dead password path.

Test plan

• ·Unit: code generation, TTL expiry, single-use enforcement, constant-time compare.
• ·Integration: request → email → verify → session happy path.
• ·Integration: non-domain address is rejected at request time.
• ·Integration: expired and reused codes are refused.