- Shipped
- April 23, 2026 at 8:47 PM UTC
- Author
- Kamo
- Commit
- a4e0789
Move phone-number and security-question collection into the self-service registration flow (where they were originally intended) rather than requiring a post-signup settings page. - New RegistrationPhoneService: generates/verifies 6-digit SMS codes via BulkTextSmsClient, 10-minute TTL, 5-per-hour rate limit per number. - RegistrationService now accepts a RegistrationParams record with optional verifiedPhone and a 3-entry security-question list; security questions are bcrypt-hashed with the existing answer-normalization rule. - /api/security/register accepts **************** and claims the verified phone against the code before persisting the User. - New public endpoints POST /register/phone/initiate (Capcha-gated), POST /register/phone/verify, and GET ****************