Account registration · AI Saga Arcana

In one sentence

A visitor with a valid invite code registers with username, email, and password; Arcana creates the user and emails a verification link.

User experience

The registration form requires invite code, username, email, password confirmation, CSRF token, and Cloudflare Turnstile. On success the visitor is redirected to login with a flash message. They are not logged in until email is verified.

Current behavior

arcana.register.php validates CSRF, verifies Turnstile via arcana_turnstile_verify_or_die(), checks the invite against access_codes, calls auth_register_user(), deletes the used invite code, generates a verification token, and attempts auth_send_verification_email(). Email failure does not roll back account creation.

Step-by-step flow

GET arcana.register.php renders the form (logged-in users redirect to dashboard).
POST validates CSRF and Turnstile.
Invite code looked up in access_codes.
auth_register_user() inserts into users with hashed password and default credits.
Invite row deleted.
Verification token stored; email sent (PHPMailer/SMTP or mail() fallback).
Redirect to arcana.login.php.

Implementation map

arcana.register.php — controller and form.
auth_lib.php — auth_register_user(), auth_ensure_schema(), CSRF helpers.
arcana.auth_email_verification.php — token + email.
arcana.turnstile.php — bot check.

Data used

Inputs: invite_code, username, email, password, password_confirmation, cf-turnstile-response, _token.
Writes: users row; delete from access_codes; verification columns on users.

Failure cases

Missing/invalid CSRF or Turnstile → error / HTTP 400 exit.
Invalid invite → form error.
Duplicate username/email → registration error.
SMTP failure → account exists; warning flash.

Known limitations

access_codes table is referenced but no CREATE TABLE was found in the repository (schema may be external).
Turnstile site key is hardcoded in the HTML form.