Tadrisino/MathApp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove guest login: every user registers with a phone number

Browse Source 
POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Zareian
2026-10-05 17:38:18 +03:30
parent 03e81abe7e
commit 8835e01595
18 changed files with 101 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/technical-handbook.md
View File

@@ -448,7 +448,6 @@ with transaction.atomic():
| روش | مسیر | دسترسی | کار |
|---|---|---|---|
| **هویت و پروفایل — `accounts`** | | | |
| POST | `/api/auth/session` | عمومی | ساختِ کاربرِ مهمان با `deviceId` |
| POST | `/api/auth/otp/request` | عمومی | فرستادنِ کدِ ورود |
| POST | `/api/auth/login` | عمومی | ورود با شماره و کد |
| POST | `/api/auth/refresh` | عمومی | توکنِ تازه با refresh token |