Skip to content

IAM - Register

Purpose

A person registers their own account. Registration creates a session and opens the plan step. Adding, editing, and deleting users is outside this slice.

Users and permissions

Anyone may register. No session is required to open the form. The new account is an active user with the plan not chosen. Registration creates a session and does not assign super_admin, admin, or tenant_owner.

Requirements

ID Priority Requirement
REG-01 Must Registration accepts email, full name, and password and returns the new user as a user.
REG-02 Must An email with no @ and domain suffix is rejected before the account is stored.
REG-03 Must A password shorter than 8 characters, or missing a letter, a number, or an uppercase letter, is rejected before the account is stored.
REG-04 Must An email that already belongs to a user is rejected.
REG-05 Must The password is stored as a scrypt hash. The API never returns the hash. The new user can sign in with that email and password.
REG-06 Must A successful registration creates a session and opens the plan step at /sign-up. It does not open the workspace. The password is not carried forward.

Screens

The tenant web app has a registration screen at /register, linked from the sign-in screen.

  • The person enters email, full name, and password.
  • A 400 or 409 response is shown on the form.
  • A successful registration creates a session and opens the plan step at /sign-up with the email and full name. It does not open the workspace. The password is not carried forward.

Business rules

  • Email is trimmed and stored in lower case. Sale@Example.com and sale@example.com are the same address.
  • The part after @ must be a domain with a dot, such as example.com.
  • Full name is trimmed and required.
  • Password must be at least 8 characters and include a letter, a number, and an uppercase letter. admin123 is rejected. Sale1234 is accepted.
  • The new user is active.
  • Until tenant resolution from the subdomain exists, the account is stored in the single local tenant database (TENANT_DATABASE_URL).

Acceptance criteria

  • REG-01: Given a new email, when they post email, full name, and password to /api/auth/register, then the response is 201, the user is active, and the role is user.
  • REG-02: Given an email without a domain after @, when they register, then the response is 400 and no user is stored.
  • REG-03: Given a password that misses the strength rule, when they register, then the response is 400 and no user is stored.
  • REG-04: Given an email that already exists, when they register, then the response is 409.
  • REG-05: Given a new account, when that person signs in with the same email and password, then sign-in succeeds. The register response does not include the password hash.
  • REG-06: Given the registration screen, when registration succeeds, then a session exists, the plan step is open, and the workspace is not.

Out of scope

  • Adding, editing, or deleting a user by an admin.
  • Role assignment.
  • Invitation email and password reset.

Open questions

  • None.