Accounts — sign up and sign in

Status: draft · Last session: 24 Oct 2026

Who and the job

Visitors plan a trip without an account and sign in only when they want to keep it.
Group leaders and travellers sign in with Google or with an email and password.
People who open a shared trip see it straight away, without an account, and are invited (never forced) to join NepWalk.

The job: never block someone from seeing or planning a trip; make saving and joining one easy step.

Value

Every extra screen before the first useful moment loses people. An account wall before planning would stop most visitors; no account at all would mean nobody can come back to their trip. Inviting shared-link visitors grows the traveller list without blocking them.

Decided (founder, 24 Oct 2026)

No account to plan. Browsing Pailas and planning a trip work signed out. Saving needs an account: the sign-in step appears at save, and the visitor returns to the same step with everything kept (saveTripRequest, afterSignInPath, existing).
Two ways to sign in: Google, and email + password (with "forgot password" by email). No phone, WhatsApp or magic-link sign-in in v1.
Shared link needs no account. The shared trip opens for anyone with the link. A friendly invitation offers "Join NepWalk" (to keep the trip and get updates); closing it leaves the trip fully usable.
The production sign-up hang is a separate bug, not part of this feature (see Bugs).
Owner: Google sign-in and everything about email sending are the founder's tasks. The other tasks can go to any engineer.
Email provider: Brevo (free plan, 300 emails/day). Sending domain: nepwalk.com (owned, active until April 2028; thetecheverest.com is the company site), for example hello@nepwalk.com with SPF, DKIM and DMARC records set on nepwalk.com.
Email verification is required for email sign-ups. Google accounts are already verified by Google.
Joining a trip has two ways (P49): a join request from the shared link, accepted or rejected by the leader (pending until then, trip visible view-only), and a direct email invitation from the leader, which enrols on sign-in. Joined trips show in "Shared with me". NepWalk now has more builders, so v1 can carry more features.

Flows

Flow	Steps	Exists today?
Save a planned trip while signed out	Save → sign-in sheet (Google or email) → back to the trip, saved	Partly (request kept; check the return step)
Sign up with email	Name, email, password → account → verification email (link valid 24 h) → verified; welcome email after	Sign-up yes; verification new
Sign in with email	Email, password	Yes
Forgot password	Email → reset link by email → new password	Yes (`sendPasswordResetEmail`)
Google	"Continue with Google" → account created or signed in	Yes (ID-token check, T18)
Shared link, signed out	Trip opens → invitation (see Shared-link invitation) → sign up → back to the trip, which now shows in "Shared with me"	New (invitation and membership)

Email verification

After email sign-up the person can sign in and use NepWalk straight away; a calm bar says "Check your inbox to verify your email" with "Resend email" (at most once a minute).
Until verified: they cannot share a trip, invite people or receive trip updates by email (these send email to or about them). Planning and saving still work.
The link is single-use and expires after 24 hours; an expired link offers a new one.
Changing the email address later needs verification again.

Shared-link invitation (agreed, 24 Oct 2026)

The invitation asks after the visitor has seen value, never before, and never blocks the trip:

When: after the visitor has looked at the plan for a moment (scrolled past the first day, or switched to a second day), not on arrival.
Where: a slim bar at the bottom on phones (above the browser bar, thumb reach) and a small card at the side on desktop. Not a pop-up.
Text: "Join NepWalk to keep this trip and get updates" · Join · close (×).
After closing: it does not return on this visit; it may return once on a later visit.
Joining: Google or email sign-up, then back to the same day of the trip, now saved in "Shared with me".

Joining a trip (P49)

Two ways in; both make the person a traveller member of the trip:

	Join request (shared link)	Email invitation
Who starts it	The visitor, from the shared trip ("Join this trip")	The leader, by entering email addresses
Account	Sign in or sign up first (email must be verified)	Sign in or sign up with the invited email (verified, or Google with that email)
Approval	Leader accepts or rejects	None: enrolled directly
Meanwhile	Trip in "Shared with me" with a Pending badge; view-only, what the shared link shows	—
Expected use	Main way for the church group	People the leader already knows

Leader side: a "Requests" list on the trip (name, email, when asked) with Accept and Reject; an email and an in-app notice when someone asks. Accepted people become traveller members; rejected people see "Your request was not accepted" and the trip leaves their list.
Invites: personal link per email, expires after 14 days, the leader can resend or revoke; if someone opens an invite with a different email, it becomes a normal join request.
Members: the leader sees all members and can remove anyone; removing takes the trip out of their list. Revoking the shared link stops new join requests; members stay.
What members see: the full view-only trip as the shared link shows it (no prices, commissions or other members' contacts, S3/S4), plus member features as they are added.
Pending and rejected people never see more than the shared link already shows.

States and edge cases

Email already used (by Google or email sign-up): explain and offer the other way in; never reveal more than needed.
Wrong password: one plain message; rate limit repeated tries.
Reset link expired or used: say so and offer a new one.
Email cannot be sent (provider down or daily limit reached): the account still works; log it; show "We could not send the email, try again later" only where the email matters (password reset).
Google pop-up blocked or cancelled: stay on the same step, nothing lost.
Slow server (cold start ~50 s): show progress, never a blank screen.

Research: is it free?

Google sign-in: free. Google charges nothing for "Sign in with Google" with the basic scopes we use (email, profile, openid); these are non-sensitive scopes with no security audit. To show NepWalk's name and logo on Google's consent screen, the app needs Google's brand verification (free; a published privacy policy, a home page on our own domain and a verified domain). Without it, users may see an "unverified app" note. Sources: Google Cloud Help — OAuth verification, Google Developers — consent screen and scopes, SSOJet — consent screen verification.

Sending email: free tiers exist; a domain is the real requirement. Our backend already sends through any SMTP provider (SMTP_* settings), so switching provider is configuration.

Option	Free amount	Notes
Resend	3,000 emails/month, 100/day, 1 domain	Simple, developer-friendly; day cap is the limit to watch. usecarly, SuperDupr
Brevo	300/day (~9,000/month)	Transactional included; check whether transactional counts against the daily cap. ecommerce-platforms, TechRadar
Amazon SES	3,000/month for the first 12 months, then about $0.10 per 1,000	Cheapest at scale; more setup (AWS account, sandbox approval). cloudburn
Gmail SMTP	~500/day from a personal account	Not recommended: sends from a gmail.com address, poor deliverability, not meant for app email.

All of them need our own sending domain with SPF and DKIM records (for example mail.nepwalk.com) so emails do not land in spam; a domain costs about $10–15 a year. Free-tier numbers come from 2026 third-party summaries; confirm on each provider's pricing page before choosing.

Chosen (founder, 24 Oct 2026): Brevo free (300/day), sending from nepwalk.com.

TBD (founder)

Bugs (separate)

Sign-up hangs on production (found 1 Oct, tasks.md): POST /auth/register creates the account but the response never arrives; likely the welcome email waiting on the mail server. Fix: send in the background (sendInBackground exists) with a short timeout, then verify on production. Ticket to be filed on its own.

Acceptance checks

Signed out, a visitor can browse Pailas and plan a whole trip; only "Save" asks to sign in.
After signing in from "Save", the visitor is back on the same trip with nothing lost.
"Continue with Google" works on phone and desktop browsers; cancelling keeps the step.
Email sign-up, sign-in and forgot-password work; the reset link works once and expires.
A shared trip opens signed out; the invitation appears only after the first day is seen, can be dismissed and does not return on the same visit; joining brings the person back to the same day and the trip shows in "Shared with me".
An email sign-up gets a verification email from nepwalk.com within a minute; until verified, sharing and inviting are blocked with a clear message; a used or expired link is refused.
A removed member no longer sees the trip in "Shared with me".
A join request shows Pending to the requester until the leader acts; accept makes them a member, reject removes the trip from their list with a clear message.
An email invitation enrols the invited person on sign-in with that email, without approval; an expired or revoked invite is refused; another email becomes a join request.
No email failure ever blocks sign-up or sign-in.
Google's consent screen shows the NepWalk name (after brand verification).

Tasks (proposed)

Task	Owner	Size
`auth-google-brand`: Google consent screen brand verification, privacy policy link, domain	Prakash	10 XP
`email-provider`: Brevo account, `nepwalk.com` SPF/DKIM/DMARC, switch `SMTP_*`, test welcome, reset and verification emails	Prakash	20 XP
`email-verification`: verification token, email, verify page, resend, limits until verified	Prakash (email) + engineer (pages)	20 XP
`join-requests`: Join from the shared link, Pending in "Shared with me", leader Requests list with accept/reject, notices	engineer (backend + frontend)	40 XP
`trip-invites`: leader invites by email, personal expiring links, direct enrolment, resend/revoke	engineer + Prakash (invite email)	20 XP
`trip-members`: members list, remove member, "Shared with me" list	engineer	20 XP
`auth-save-return`: sign-in at save returns to the same step on phone and desktop	engineer	10 XP
`share-invite`: the shared-link invitation card and the join flow back to the trip	engineer	20 XP
`auth-edge-cases`: messages for email-in-use, wrong password, expired link, cancelled Google	engineer	10 XP
`auth-qa`: test plan from the checks, phone and desktop	Niwesh	10 XP
Bug: sign-up hang on production	Prakash (email-related)	5 XP

Each implementation task gets a spec in docs/v1/tasks/ (team-spec) before assignment.