📝 docs(adr): ADR-0028/0029/0030 — passwordless auth + Mailpit + BDD email strategy #58

arcodange · 2026-05-05T10:42:29+02:00

arcodange commented

2026-05-05 10:42:29 +02:00

Three coordinated ADRs Proposed for the auth-completion sprint requested by user. ADR-0028 sequences passwordless migration (magic link first, OIDC second, password decommission later). ADR-0029 picks Mailpit (already locally pulled as docker image) for local SMTP capture, defers production provider choice. ADR-0030 solves the BDD parallel email assertion problem via per-test recipient scoping (preserves the 2.85x speedup from PR #35). Implementation in next PRs.

arcodange added 1 commit 2026-05-05 10:42:29 +02:00

📝 docs(adr): ADR-0028/0029/0030 — passwordless auth + Mailpit + BDD email strategy 873f449d17

Three coordinated ADRs Proposed for the auth-completion sprint, requested
by user: signup → magic link by email → OpenID Connect Authorization
Code with PKCE, all integrated with Mailpit (already locally available
as docker image) and BDD parallel testing strategy.

ADR-0028 — Passwordless auth migration (sequenced):
- Phase A: magic link by email (no password storage, JWT issued on consume)
- Phase B: OpenID Connect Code flow with PKCE (cross-product SSO, mkcert
  for local HTTPS callbacks)
- Phase C (separate ADR later): decommission password auth

ADR-0029 — Email infra:
- Mailpit (axllent/mailpit:latest) for local dev + BDD (image already
  pulled, 51 MB), defaults SMTP :1025 / HTTP API :8025
- pkg/email.Sender interface for provider portability
- Production sender choice DEFERRED (separate ADR when volume / SLA
  / compliance requirements known — likely AWS SES or Postmark)

ADR-0030 — BDD email parallel strategy:
- Per-test recipient scoping: each scenario generates a unique address
  <scenario-key>-<8hex>@bdd.local
- Mailpit HTTP API filters by recipient → no cross-scenario interference
- pkg/bdd/mailpit/ helper package + pkg/bdd/steps/email_steps.go
- Preserves the 2.85x parallel BDD speedup from PR #35

Implementation lands in subsequent PRs ; today only the design is shipped.
README index updated with 3 new entries (0028/0029/0030 all Proposed).

arcodange merged commit 235cc41f68 into main

2026-05-05 10:42:36 +02:00

arcodange deleted branch docs/adr-auth-completion

2026-05-05 10:42:36 +02:00

arcodange referenced this issue from a commit

2026-05-05 10:42:36 +02:00

📝 docs(adr): ADR-0028/0029/0030 — passwordless auth + Mailpit + BDD email strategy (#58)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: arcodange/dance-lessons-coach#58