test(login/register): via password or magic-link

Password login ┌─────┬────────────────────────────────────────────────────┬────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────┐ │ # │ Case │ Where │ Assertion │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L1 │ Login by username │ auth_login.hurl Case 1 │ 200 + access_token, user.email match │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L2 │ Login by email (dispatch on @) │ auth_login.hurl Case 2 │ 200, same session shape as L1 │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L3 │ Bad password on username path │ auth_login.hurl Case 3 │ 403 anti-enum │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L4 │ Bad password on email path │ auth_login.hurl Case 4 │ 403 anti-enum (same shape as L3) │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L5 │ Unknown username │ auth_login.hurl Case 5 │ 403 anti-enum (same shape as L3) │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L6 │ Unknown email │ auth_login.hurl Case 6 │ 403 anti-enum (same shape as L3) │ ├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤ │ L7 │ /api/auth/oidc/providers reports methods correctly │ auth_login.hurl Case 7 │ password_login_enabled: true, magic_link_login_enabled: true, require_verified_email: false │ └─────┴────────────────────────────────────────────────────┴────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────┘ Password registration ┌─────┬───────────────────────────────────────────────────┬──────────────────────────────┬─────────────────────────────────────────────────────────┐ │ # │ Case │ Where │ Assertion │ ├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤ │ R1 │ Classic username + email + password → uniform 200 │ registration.hurl Step 2 │ anti-enum message contains "request received" │ ├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤ │ R2 │ Login after register works │ registration.hurl Step 2b │ 200 + session for the new user │ ├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤ │ R3 │ Email collision → uniform 200 (no rewrite) │ registration.hurl Steps 8-10 │ attacker password doesn't work; original account intact │ ├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤ │ R4 │ Username collision → uniform 200 │ registration.hurl Step 11 │ same anti-enum shape │ ├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤ │ R5 │ Off-domain rejection │ registration.hurl Step 12 │ 403 RegistrationDomainNotAllowed │ ├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤ │ R6 │ Case-insensitive domain match │ registration.hurl Step 12b │ uniform 200 on charlie@EXAMPLE.COM │ └─────┴───────────────────────────────────────────────────┴──────────────────────────────┴────────────────────────────┘ Magic-link registration (email-only signup) ┌─────┬──────────────────────────────────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────┐ │ # │ Case │ Where │ Assertion │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR1 │ Email-only signup → welcome mail queued │ registration.hurl Step 3 │ uniform 200 + browser-binding cookie set │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR2 │ Welcome mail contains magic-link URL │ registration.hurl Step 4 │ captured from mock SMTP │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR3 │ PR 22 cross-browser confirmation page │ registration.hurl Step 5a │ 200 HTML "different browser" │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR4 │ Cookie-bound redemption lands on SPA │ registration.hurl Step 5b │ 302 → /files (SvelteKit route, post-migration) │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR5 │ email_verified_at stamped after redemption │ registration.hurl Step 6 │ field present on /api/auth/me │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR6 │ Second magic-link post-signup │ registration.hurl Step 7 │ uniform 200 │ ├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤ │ MR7 │ Profile PATCH — no-op, name set, empty-string rejected, username-taken 409, claim-once 409, etc. │ registration.hurl Steps 6a–6i │ full profile lifecycle │ └─────┴──────────────────────────────────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────┘ Magic-link login (existing account) ┌─────┬──────────────────────────────────────────────────────────┬──────────────────────────────────────┬───────────────────────────────────────┐ │ # │ Case │ Where │ Assertion │ ├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤ │ ML1 │ Baseline password login still works │ auth_magic_link_login.hurl Steps 1-2 │ 200 │ ├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤ │ ML2 │ magic-link/send with email identifier │ auth_magic_link_login.hurl Step 3 │ uniform 200 + cookie │ ├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤ │ ML3 │ magic-link/send with username identifier (dispatch on @) │ auth_magic_link_login.hurl Step 4 │ uniform 200 │ ├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤ │ ML4 │ Password-user policy: mail actually sent │ auth_magic_link_login.hurl Step 5 │ SMTP capture proves permit_magic_link_for_password_users in effect │ ├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤ │ ML5 │ Redemption creates a session │ auth_magic_link_login.hurl Steps 6-7 │ 302 → /files, /api/auth/me returns the same user │ ├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤ │ ML6 │ Anti-enum on unknown identifier │ auth_magic_link_login.hurl Step 8 │ same uniform 200 shape as ML3 │ └─────┴──────────────────────────────────────────────────────────┴──────────────────────────────────────┴───────────────────────────────────────┘ OIDC ┌─────┬────────────────────────────────────────────────────────────────────────┬───────────────────┬────────────────────────────────────────────────────────────────────────────────────────────┐ │ # │ Case │ Where │ Assertion │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O1 │ Setup local admin (bootstrap) │ oidc.hurl Step 1 │ 201 │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O2 │ Providers endpoint — OIDC visible │ oidc.hurl Step 2 │ enabled: true, provider_name: MockSSO, password_login_enabled: true, magic_link_login_enabled: false (OIDC-master rule) │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O2b │ Magic-link/send refused (endpoint layer) │ oidc.hurl Step 2b │ 403 MagicLinkLoginDisabled — proves the policy gate fires, not a 503 SMTP-unwired │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O3 │ Authorize redirect includes PKCE + state │ oidc.hurl Step 3 │ 307 to fake IdP │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O4 │ IdP round-trip + JIT provisioning │ oidc.hurl Step 4 │ Callback lands on /login?oidc_code=… │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O5 │ Code exchange → session cookies │ oidc.hurl Step 5 │ 200 + all three cookies │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O6 │ JIT profile mapping (name, given/family, picture, groups → admin role) │ oidc.hurl Step 6 │ every claim reflected on /api/auth/me │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O7 │ Refresh rotation on OIDC session │ oidc.hurl Step 7 │ new access/refresh/CSRF cookies │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O8 │ Refreshed cookies authenticate │ oidc.hurl Step 8 │ 200 on /api/auth/me │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O9 │ Repeat login = same local user (no dup) │ oidc.hurl Step 9 │ user_id stable │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O10 │ Anti-takeover: unverified email → refused │ oidc.hurl Step 10 │ 401/403 │ ├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤ │ O11 │ One-time code replay refused │ oidc.hurl Step 11 │ second /exchange → 401 │ └─────┴────────────────────────────────────────────────────────────────────────┴───────────────────┴────────────────────────────────────────────────────────────────────────────────────────────┘ test
2026-07-14 01:46:33 +02:00
parent 01da450cf6
commit e94063d96a
27 changed files with 1746 additions and 300 deletions
@@ -56,7 +56,8 @@ The frontend's "Username or email" field submits whatever the user typed; the JS
 ```
 1. has_oidc()        → reject "oidc_user"   (unconditional)
 2. has_password()    → reject "has_password" by default
-                       allow when OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true
+                       allow when OXICLOUD_AUTH_POLICIES contains
+                       `permit_magic_link_for_password_users`
 3. neither           → allow
 ```

@@ -133,7 +134,7 @@ In all four cases the real reason is recorded in the `audit` channel — operato

 | Concern | Current treatment |
 |---|---|
-| **Mailbox compromise = account compromise (lenient mode)** | When `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true`, a user's mailbox is as strong as their password — flip the password by mail. Operator opt-in only; off by default. Aligns with modern SaaS norms (Slack, Notion, Substack). |
+| **Mailbox compromise = account compromise (lenient mode)** | When `OXICLOUD_AUTH_POLICIES` contains `permit_magic_link_for_password_users`, a user's mailbox is as strong as their password — flip the password by mail. Operator opt-in only; off by default. Aligns with modern SaaS norms (Slack, Notion, Substack). |
 | **Mailbox compromise = account compromise (strict mode)** | Only applies to magic-link-eligible users (no other credential). Their mailbox **is** their credential by design. Password-secured accounts are unaffected. |
 | **No native MFA** | Today OIDC delegation is the only path to MFA — the IdP (Keycloak, Authentik, Okta) enforces TOTP/WebAuthn/etc., OxiCloud sees only the resulting ID token. This is why OIDC users are unconditionally excluded from magic-link. Native TOTP / WebAuthn enrolment is a future feature. |
 | **Magic-link as bearer token (login-via-email)** | Closed (PR 22). Login tokens carry a per-request challenge mirrored into the originating browser's `oxicloud_magic_request` cookie. Redemption from a different browser shows a confirmation page rather than auto-signing. Asymmetric TTL: login tokens expire in 10 min, invitations in 24 h. |
@@ -1,16 +1,18 @@
 # Authentication

-OxiCloud ships with JWT-based authentication and Argon2id password hashing for local accounts. It also exposes status and OIDC-related auth endpoints under the same `/api/auth` namespace.
+OxiCloud ships with JWT-based authentication and Argon2id password hashing for local accounts. It also exposes status and OIDC-related auth endpoints under the same `/api/auth` namespace, plus a magic-link (email link) sign-in flow for accounts that don't use a password.

 ## Core Endpoints

 | Method | Endpoint | Description |
 | --- | --- | --- |
-| `POST` | `/api/auth/register` | Create a local user account |
-| `POST` | `/api/auth/login` | Exchange username and password for access and refresh tokens |
+| `POST` | `/api/auth/register` | Create a local user account. `email` is required; `username` and `password` are both optional. |
+| `POST` | `/api/auth/login` | Exchange an identifier (username **or** email — dispatches on `@`) and password for access and refresh tokens |
+| `POST` | `/api/auth/magic-link/send` | Send a one-click sign-in link to the account's email. Accepts either a username or an email in the request body |
+| `GET` | `/magic/v1/{token}` | Redeem a magic-link — creates a session and stamps `email_verified_at` on the account |
 | `POST` | `/api/auth/refresh` | Refresh the session tokens |
 | `GET` | `/api/auth/me` | Return the current authenticated user |
-| `PUT` | `/api/auth/change-password` | Change the current user's password |
+| `PUT` | `/api/auth/change-password` | Change the current user's password (requires the current password) |
 | `POST` | `/api/auth/logout` | Invalidate the current session |
 | `GET` | `/api/auth/status` | Return auth system state, including OIDC availability |

@@ -18,55 +20,174 @@ OxiCloud ships with JWT-based authentication and Argon2id password hashing for l

 | Method | Endpoint | Description |
 | --- | --- | --- |
-| `GET` | `/api/auth/oidc/providers` | List configured OIDC provider info |
+| `GET` | `/api/auth/oidc/providers` | Report which self-service auth methods this deployment offers (see fields below) |
 | `GET` | `/api/auth/oidc/authorize` | Build the authorization redirect URL |
 | `GET` | `/api/auth/oidc/callback` | Handle provider redirect callback |
 | `POST` | `/api/auth/oidc/exchange` | Exchange the auth code for OxiCloud session tokens |

+`GET /api/auth/oidc/providers` fields:
+
+| Field | Meaning |
+| --- | --- |
+| `enabled` | OIDC is configured on this deployment |
+| `provider_name` | Display name for the IdP (shown on the SSO button) |
+| `authorize_endpoint` | Where the SPA should start the OIDC round-trip |
+| `password_login_enabled` | `POST /api/auth/login` will accept credentials |
+| `magic_link_login_enabled` | `POST /api/auth/magic-link/send` will mint tokens (SMTP wired + allowlist + no OIDC — see rules below) |
+| `require_verified_email` | `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set — the SPA uses this hint to explain `EmailNotVerified` responses |
+
+## Configuring which methods are offered
+
+Two environment variables control the self-service surface (OIDC is orthogonal — see `OXICLOUD_OIDC_ENABLED`).
+
+### `OXICLOUD_AUTH_METHODS`
+
+Comma-separated allowlist of `password` and/or `magic_link`. Default `password,magic_link`.
+
+| Configuration | Effect |
+| --- | --- |
+| Unset or `password,magic_link` | Both methods allowed (default) |
+| `password` | Password login OK. Magic-link send / redeem → 403 `MagicLinkLoginDisabled` |
+| `magic_link` | Password login → 403 `PasswordLoginDisabled`. Password-based `register` → 403 `PasswordRegistrationDisabled`. Email-only signup still works |
+
+**Startup gate.** If `magic_link` is the only method allowed AND no SMTP transport is configured (`OXICLOUD_SMTP_HOST` empty), the server refuses to start with a fatal message. A magic-link-only policy without a working mailer silently locks every user out.
+
+**OIDC master rule.** When `OXICLOUD_OIDC_ENABLED=true`, magic-link login is **hard-disabled** regardless of this list. The IdP is the identity boundary; magic-link would bypass any 2FA / step-up policy the IdP enforces. The startup gate above does **not** trigger in this case — OIDC provides the login path.
+
+Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes `password` from the effective allowlist.
+
+### `OXICLOUD_REQUIRE_VERIFIED_EMAIL`
+
+Default `false`. When `true`, `POST /api/auth/login` returns 403 `EmailNotVerified` for any account whose `email_verified_at IS NULL`.
+
+**Order matters:** the verified-email check runs **after** password validation. An attacker without the password sees only the generic `Invalid credentials` shape — they can't probe whether an account's email is verified.
+
+**Verification piggyback.** When the branch fires (password OK, email unverified), the server auto-sends a verification magic-link to the account's registered address using the same login request. The user sees `EmailNotVerified` in the response and a "check your inbox" hint on the login page; resubmitting the form re-sends the link. This is why there is no separate "resend verification" endpoint — offering an unauthenticated one would leak `has_password` state.
+
+**Admin exemption.** Admin accounts (role `admin`) are exempt from this gate at login, regardless of `email_verified_at`. Rationale: an operator who flips the flag on an existing deployment must not lock the admin(s) out of their own instance. Fresh admin accounts created via `POST /api/setup` or `POST /api/admin/users` are stamped verified at creation; the exemption covers pre-existing accounts that predate the flag.
+
+**Auto-verified on creation:** OIDC-JIT users, admin-created users (`POST /api/admin/users`), and the first-run setup admin (`POST /api/setup`). Verification is only ever missing on regular users who signed up before the flag was turned on.
+
+## Login identifier dispatch
+
+`POST /api/auth/login` accepts either a username (no `@`) or an email (contains `@`) in the `username` field. The two namespaces are provably disjoint — usernames forbid `@` — so the dispatch is unambiguous and both paths return the same session shape.
+
+`POST /api/auth/magic-link/send` mirrors this convention. The `email` field can be either an email or a username; the server resolves username → registered email before rate-limiting so both shapes share one budget (no bypass).
+
+## Registration flow
+
+Since PR 18, both `username` and `password` are optional on `POST /api/auth/register`. The only required field is `email`.
+
+| Combination | Result |
+| --- | --- |
+| `email + password` | Classic signup — account gets a password hash; user can log in immediately |
+| `email + password + username` | Same, plus the username is claimed at creation |
+| `email` only | Email-only signup — no password stored; server sends a welcome magic-link. Clicking it creates a session and stamps `email_verified_at`. The user can later claim a handle via `PATCH /api/auth/me/profile` and set a password via `PUT /api/auth/change-password` |
+
+The response body is uniform across success, email collision, and username collision — the SPA does not learn whether an address is already taken. The real reason lands in the audit log.
+
+### `OXICLOUD_DISABLE_REGISTRATION`
+
+Turns the endpoint off entirely (returns 403 `RegistrationDisabled`).
+
+### `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS`
+
+Comma-separated allowlist. Rejected registrations return 403 `RegistrationDomainNotAllowed`. Distinct from `OXICLOUD_EXTERNAL_EMAIL_DOMAINS`, which gates external-user **invitations**; self-registration and invitations have independent policies.
+
+## Magic-link eligibility
+
+`POST /api/auth/magic-link/send` looks up the resolved email → user, then applies the eligibility ladder:
+
+1. **OIDC-linked user** → refused with `reason="oidc_user"`. Unconditional; the IdP is the security boundary and may enforce MFA that magic-link would sidestep.
+2. **Has a password configured** → refused with `reason="has_password"` (default). Set `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users` to allow — this weakens the password to mailbox-strength for affected accounts; opt-in only.
+3. **No credential** (typical external user or fresh email-only signup) → allow.
+
+The verification-piggyback flow above deliberately **bypasses the `has_password` gate** — that path is only reachable after the user has already proven identity via password on the same login request, so mailbox-only trust is not being extended beyond what the password already established.
+
+## Auth policy vector
+
+`OXICLOUD_AUTH_POLICIES` is a comma-separated list of additive policy switches. Distinct from `OXICLOUD_AUTH_METHODS` (which enables/disables a method wholesale), each entry here grants a specific exception or restriction to default auth behaviour. Vector shape so future policies can be added by appending a token instead of introducing a new env var per behaviour. Variant names carry their own polarity (`Permit...`, future `Require...` / `Deny...`).
+
+| Token | Effect |
+| --- | --- |
+| `permit_magic_link_for_password_users` | Allow magic-link login for accounts that also have a password. OIDC-linked users are still refused. |
+
+Unknown tokens are logged-and-skipped at startup so a typo doesn't silently zero the vector.
+
 ## Example Flows

-### Register
+### Register — classic

 ```json
-{
-  "username": "testuser",
-  "email": "test@example.com",
-  "password": "SecurePassword123"
-}
+{ "username": "testuser", "email": "test@example.com", "password": "SecurePassword123" }
+```
+
+### Register — email-only
+
+```json
+{ "email": "test@example.com" }
 ```

 ### Login

 ```json
-{
-  "username": "testuser",
-  "password": "SecurePassword123"
-}
+{ "username": "testuser", "password": "SecurePassword123" }
+```
+
+Or equivalently:
+
+```json
+{ "username": "test@example.com", "password": "SecurePassword123" }
 ```

 Typical successful login response:

 ```json
-{
-  "accessToken": "...",
-  "refreshToken": "...",
-  "expiresIn": 3600
-}
+{ "accessToken": "...", "refreshToken": "...", "expiresIn": 3600 }
+```
+
+### Send a sign-in link (magic-link)
+
+```json
+{ "email": "testuser" }
+```
+
+Uniform response regardless of whether the account exists / is eligible:
+
+```json
+{ "message": "If an account exists for that email, a sign-in link will be sent." }
 ```

 ### Current User

-`GET /api/auth/me` returns the authenticated user's identity, role, and storage information.
+`GET /api/auth/me` returns the authenticated user's identity, role, `email_verified_at`, and storage information.
+
+## Distinguished error codes
+
+The `error_type` field on 4xx responses lets frontends render specific UX. Codes surfaced by this subsystem:
+
+| `error_type` | HTTP | Meaning |
+| --- | --- | --- |
+| `PasswordLoginDisabled` | 403 | `OXICLOUD_AUTH_METHODS` doesn't include `password` |
+| `PasswordRegistrationDisabled` | 403 | Same, on `register` with a password field |
+| `MagicLinkLoginDisabled` | 403 | `OXICLOUD_AUTH_METHODS` doesn't include `magic_link`, OIDC is enabled, or email-only signup is attempted on a password-only deployment |
+| `EmailNotVerified` | 403 | Password validated, but `email_verified_at IS NULL` and `OXICLOUD_REQUIRE_VERIFIED_EMAIL=true`. Server has already sent a verification link |
+| `RegistrationDisabled` | 403 | Global registration off |
+| `RegistrationDomainNotAllowed` | 403 | Email domain outside `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS` |
+| `AccountLocked` | 429 | Too many failed login attempts for (account, IP) — see rate-limit config |

 ## Security Model

- local passwords are hashed with Argon2id
- access control is role-based (`admin` and `user`)
- refresh tokens support session renewal without forcing frequent re-login
+- Local passwords hashed with Argon2id
+- Access control is role-based (`admin` and `user`)
+- Refresh tokens support session renewal without forcing frequent re-login
+- Login endpoint uses anti-enumeration response shapes — bad-username and bad-password return the same 403
+- Magic-link `send` returns a uniform 200 whether the account exists or not; the truth lands in the `audit` log target
 - OIDC can coexist with local auth or disable password login entirely
+- OIDC-enabled deployments have magic-link login hard-disabled to prevent IdP-MFA bypass

 ## Related Pages

 - [OIDC / SSO](/config/oidc)
 - [Admin Settings](/config/admin-settings)
- [Environment Variables](/config/env)
+- [Environment Variables](/config/env)
@@ -45,6 +45,9 @@ Most runtime variables use the `OXICLOUD_` prefix. A few build-time or allocator
 | `OXICLOUD_HASH_PARALLELISM` | `2` | Argon2id parallelism lanes |
 | `OXICLOUD_DISABLE_REGISTRATION` | false | Disable registration of new user accounts |
 | `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS` | — | Comma-separated allowlist of email domains accepted on `POST /api/auth/register` (case-insensitive, exact match on the post-`@` part). Empty = any domain is allowed. **Distinct from `OXICLOUD_EXTERNAL_EMAIL_DOMAINS`**: this one gates SELF-registration (public sign-up), the external list gates INVITATIONS (grants + magic-link to third parties). An operator can lock sign-up to their company domain while leaving invitations open. Subdomains must be listed explicitly. Rejected registrations return 403 `RegistrationDomainNotAllowed` and emit an `audit` line. Example: `mycompany.com,mycompany-eu.com`. |
+| `OXICLOUD_AUTH_METHODS` | `password,magic_link` | Comma-separated allowlist of self-service auth methods (`password`, `magic_link`). OIDC is orthogonal (see `OXICLOUD_OIDC_ENABLED`). Removing `password` disables `POST /api/auth/login` (returns 403 `PasswordLoginDisabled`) and password-based `register` (returns 403 `PasswordRegistrationDisabled`). Removing `magic_link` disables `POST /api/auth/magic-link/send` (returns 403 `MagicLinkLoginDisabled`) and the redemption path for login-purpose tokens. **Startup gate**: if `magic_link` is the only method allowed AND no SMTP transport is configured (`OXICLOUD_SMTP_HOST` empty), the server refuses to start. **OIDC master rule**: when `OXICLOUD_OIDC_ENABLED=true`, magic-link login is hard-disabled regardless of this list (would otherwise bypass IdP-enforced MFA / step-up). Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes `password` from the list. |
+| `OXICLOUD_AUTH_POLICIES` | — | Comma-separated additive policy switches. Each token grants an exception or restriction to the default auth behaviour; empty (unset) = pure defaults. Recognised tokens: `permit_magic_link_for_password_users` (allow magic-link login for accounts that also have a password — off by default because magic-link would weaken the password to mailbox-strength; OIDC-linked users are still refused regardless). |
+| `OXICLOUD_REQUIRE_VERIFIED_EMAIL` | `false` | When `true`, `POST /api/auth/login` returns 403 `EmailNotVerified` for any account whose `email_verified_at` is NULL. Users can prove control by requesting a magic-link (whose redemption stamps `email_verified_at`), so this composes with `magic_link` in `OXICLOUD_AUTH_METHODS` to give users a self-service verification path. Admin-created (`POST /api/admin/users`) and setup-admin (`POST /api/setup`) users are auto-verified. OIDC-JIT users are also stamped verified at creation. |

 ### Rate Limiting & Account Lockout

@@ -620,6 +620,58 @@ OXICLOUD_WOPI_ENABLED=false
 # Example (only staff at these two domains can self-register):
 #OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=mycompany.com,mycompany-eu.com

+# ---------------------------------------------------------------------------
+# OXICLOUD_AUTH_METHODS — self-service authentication method allowlist.
+# ---------------------------------------------------------------------------
+# Comma-separated list of `password` and/or `magic_link`. Controls which
+# self-service authentication methods this deployment offers on the login
+# page and accepts at the corresponding endpoints. OIDC is orthogonal —
+# use `OXICLOUD_OIDC_ENABLED` for that.
+#
+# Semantics per configuration:
+#   * Empty (unset) or `password,magic_link`  — both methods allowed
+#     (default). Matches pre-flag behaviour.
+#   * `password`                              — `POST /api/auth/login` OK,
+#                                               magic-link send / redeem
+#                                               return 403 `MagicLinkLoginDisabled`.
+#   * `magic_link`                            — `POST /api/auth/login`
+#                                               returns 403 `PasswordLoginDisabled`;
+#                                               password-based `register`
+#                                               returns 403 `PasswordRegistrationDisabled`.
+#
+# SECURITY — startup gate. When `magic_link` is the ONLY method allowed
+# but no SMTP transport is configured, the server refuses to start with a
+# fatal message. A magic-link-only policy without a mail sender silently
+# locks every user out of the deployment.
+#
+# SECURITY — OIDC master rule. When `OXICLOUD_OIDC_ENABLED=true`, magic-
+# link login is HARD-disabled regardless of what this list says. OIDC is
+# the master identity provider; magic-link would sidestep any 2FA / step-
+# up the IdP enforces. The startup gate above does NOT trigger in this
+# case (OIDC provides a login path).
+#
+# Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes
+# `password` from this list. New deployments should prefer this env var.
+#
+# Default: password,magic_link
+#OXICLOUD_AUTH_METHODS=password,magic_link
+
+# ---------------------------------------------------------------------------
+# OXICLOUD_REQUIRE_VERIFIED_EMAIL — gate login on email verification.
+# ---------------------------------------------------------------------------
+# When `true`, `POST /api/auth/login` returns 403 `EmailNotVerified` for
+# any account whose `email_verified_at` is NULL. Users can prove control
+# by requesting a magic-link (whose redemption stamps
+# `email_verified_at`) — so this composes naturally with `magic_link` in
+# the allowlist above to give users a self-service verification path.
+#
+# Admin-created (`POST /api/admin/users`) and first-run setup-admin
+# (`POST /api/setup`) users are auto-verified — admin fiat counts as
+# verification. OIDC-JIT users are also stamped verified at creation.
+#
+# Default: false
+#OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
+
 # Per-sharer rate limit on email-type grants from POST /api/grants. Keyed on
 # the authenticated caller's user_id. Hitting the cap returns 429 with
 # Retry-After. Default 50/hour — generous for legitimate admin invites,
@@ -640,19 +692,26 @@ OXICLOUD_WOPI_ENABLED=false
 # for client IP resolution. Default 200/hour.
 #OXICLOUD_MAGIC_LINK_SEND_PER_IP_PER_HOUR=200

-# Policy switch: should magic-link sign-in be offered to users who already
-# have a password configured?
-#   false (default, strict) — users with a password are audit-logged
-#     `has_password` and receive no mail. Their password is the only
-#     authentication path; magic-link would weaken it to "mailbox
-#     compromise = account compromise".
-#   true (lenient)          — users with a password can also request a
-#     magic-link as a sign-in path. Aligns with modern SaaS UX
-#     (Slack, Notion, etc.). Operators who already treat email as the
-#     canonical password-reset channel pick this.
-# OIDC-linked users are ALWAYS rejected regardless of this flag — the
-# IdP is the security boundary and may enforce MFA we shouldn't bypass.
-#OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=false
+# ---------------------------------------------------------------------------
+# OXICLOUD_AUTH_POLICIES — additive auth-policy switches (comma-separated).
+# ---------------------------------------------------------------------------
+# Each recognised token grants an exception or restriction to the default
+# auth behaviour. Empty (unset) = pure defaults. Vector shape so future
+# policies can be added without new env vars.
+#
+# Recognised tokens:
+#
+#   permit_magic_link_for_password_users
+#     Allow magic-link sign-in for accounts that ALSO have a password.
+#     Off by default — magic-link would otherwise weaken the password to
+#     mailbox-strength. Aligns with modern SaaS UX (Slack, Notion, etc.)
+#     when set. OIDC-linked users are ALWAYS rejected regardless of this
+#     policy — the IdP is the security boundary and may enforce MFA we
+#     shouldn't bypass.
+#
+# Example:
+#OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users
+

 # Operator-level kill switch for share-notification emails to internal
 # users (the "Alice shared 'Project Alpha' with you" mail that fires when
@@ -142,12 +142,26 @@ export async function apiJson<T>(input: RequestInfo | URL, init?: RequestInit):
 }

 export class ApiError extends Error {
+	/**
+	 * `error_type` field from the backend's `ErrorResponse` body, when
+	 * present. Callers switch on this to render specific UX for
+	 * distinguished failures (e.g. `EmailNotVerified` → "resend
+	 * verification link" prompt). Falls back to `undefined` when the
+	 * response body isn't parseable or the endpoint doesn't emit one.
+	 */
+	readonly errorType?: string;
+
 	constructor(
 		readonly status: number,
 		readonly statusText: string,
-		readonly resource: RequestInfo | URL
+		readonly resource: RequestInfo | URL,
+		errorType?: string,
+		serverMessage?: string
 	) {
-		super(`API ${status} ${statusText} for ${urlString(resource as RequestInfo | URL)}`);
+		super(
+			serverMessage ?? `API ${status} ${statusText} for ${urlString(resource as RequestInfo | URL)}`
+		);
 		this.name = 'ApiError';
+		this.errorType = errorType;
 	}
 }
@@ -22,7 +22,7 @@ it('exercises the auth endpoints (success paths)', async () => {
 	await auth.getAuthStatus().catch(() => {});
 	await auth.setupAdmin('e@x.test', 'p').catch(() => {});
 	await auth.exchangeOidcCode('code').catch(() => {});
-	await auth.register('u', 'e@x.test', 'p').catch(() => {});
+	await auth.register('e@x.test', 'p', 'u').catch(() => {});
 	await auth.sendMagicLink('e@x.test').catch(() => {});
 	await auth.logout().catch(() => {});
 	const fc = (globalThis.fetch as unknown as ReturnType<typeof vi.fn>).mock.calls.length;
@@ -3,10 +3,32 @@
 * primitives here intentionally bypass it (see client.ts) so a 401 surfaces as
 * a genuine failure to the caller.
 */
-import { apiFetch } from '$lib/api/client';
+import { ApiError, apiFetch } from '$lib/api/client';
 import { getCsrfHeaders } from '$lib/api/csrf';
 import type { AuthResponse, User } from '$lib/api/types';

+/**
+ * Best-effort parse of the backend `ErrorResponse` shape
+ * (`{ status, error, message, error_type }`). Returns whatever it could
+ * extract; never throws — a malformed body just yields undefineds.
+ */
+async function parseErrorBody(res: Response): Promise<{ errorType?: string; message?: string }> {
+	try {
+		const body = (await res.clone().json()) as {
+			error_type?: unknown;
+			message?: unknown;
+			error?: unknown;
+		};
+		const errorType = typeof body.error_type === 'string' ? body.error_type : undefined;
+		const rawMessage =
+			(typeof body.message === 'string' ? body.message : undefined) ??
+			(typeof body.error === 'string' ? body.error : undefined);
+		return { errorType, message: rawMessage };
+	} catch {
+		return {};
+	}
+}
+
 const JSON_HEADERS = { 'Content-Type': 'application/json' };

 /**
@@ -48,7 +70,13 @@ export async function login(emailOrUsername: string, password: string): Promise<
 		headers: { ...JSON_HEADERS, ...getCsrfHeaders() },
 		body: JSON.stringify({ username: emailOrUsername, password })
 	});
-	if (!res.ok) throw new Error(`login failed: ${res.status}`);
+	if (!res.ok) {
+		// Surface the backend `error_type` so the login page can offer
+		// specific UX: `EmailNotVerified` → "resend verification link",
+		// `PasswordLoginDisabled` → nudge toward magic-link / SSO, etc.
+		const { errorType, message } = await parseErrorBody(res);
+		throw new ApiError(res.status, res.statusText, '/api/auth/login', errorType, message);
+	}
 	return (await res.json()) as AuthResponse;
 }

@@ -56,6 +84,20 @@ export interface OidcProviders {
 	enabled: boolean;
 	provider_name?: string;
 	password_login_enabled?: boolean;
+	/**
+	 * True when the server accepts magic-link login requests. The backend
+	 * composes three factors: SMTP wired, `OXICLOUD_AUTH_METHODS` allowlist
+	 * includes `magic_link`, and OIDC is NOT enabled at the deployment
+	 * (OIDC-enabled deployments must not offer magic-link — it would bypass
+	 * any 2FA / step-up the IdP enforces).
+	 */
+	magic_link_login_enabled?: boolean;
+	/**
+	 * True when `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set. The login page
+	 * uses this to explain the `EmailNotVerified` login response and
+	 * surface a "resend verification link" affordance.
+	 */
+	require_verified_email?: boolean;
 	authorize_endpoint?: string;
 }

@@ -135,16 +177,21 @@ export async function exchangeOidcCode(code: string): Promise<User | null> {
 }

 /**
- * Register a new user. Raw `fetch` (NOT apiFetch) so a 401/validation failure
- * surfaces to the caller instead of tripping the global refresh-and-redirect
- * interceptor — mirrors the login primitive.
+ * Register a new user. Since PR 18 both `username` and `password` are optional
+ * on the backend: an email-only signup is valid and mints a welcome magic-link.
+ * Raw `fetch` (NOT apiFetch) so a 401/validation failure surfaces to the caller
+ * instead of tripping the global refresh-and-redirect interceptor — mirrors
+ * the login primitive.
 */
-export async function register(username: string, email: string, password: string): Promise<void> {
+export async function register(email: string, password?: string, username?: string): Promise<void> {
+	const body: Record<string, unknown> = { email, role: 'user' };
+	if (password) body.password = password;
+	if (username) body.username = username;
 	const res = await fetch('/api/auth/register', {
 		method: 'POST',
 		credentials: 'same-origin',
 		headers: { ...JSON_HEADERS, ...getCsrfHeaders() },
-		body: JSON.stringify({ username, email, password, role: 'user' })
+		body: JSON.stringify(body)
 	});
 	if (!res.ok) {
 		const e = (await res.json().catch(() => ({}))) as { error?: string; message?: string };
@@ -307,10 +307,15 @@
 }

 .auth-toggle-link {
+    background: transparent;
+    border: 0;
+    padding: 0;
    color: var(--color-accent-text);
    cursor: pointer;
    text-decoration: none;
    font-weight: var(--weight-medium);
+    font-family: inherit;
+    font-size: inherit;
 }

 .auth-toggle-link:hover {
@@ -7,6 +7,7 @@
 	import { page } from '$app/state';
 	import type { Pathname } from '$app/types';
 	import { onMount } from 'svelte';
+	import { ApiError } from '$lib/api/client';
 	import {
 		exchangeOidcCode,
 		fetchMe,
@@ -37,16 +38,20 @@
 	let error = $state('');
 	let busy = $state(false);

-	// Register
+	// Register. Since PR 18 both `username` and `password` are optional on
+	// the backend — email-only signup mints a welcome magic-link. Leaving
+	// the password blank is a deliberate first-class UX path here.
 	let regUsername = $state('');
 	let regEmail = $state('');
 	let regPassword = $state('');
 	let regConfirm = $state('');
 	let regError = $state('');
-	let regSuccess = $state('');
 	let regShowPassword = $state(false);
 	let regShowConfirm = $state(false);
 	let regCapsOn = $state(false);
+	// True when the user has chosen the passwordless-signup branch —
+	// hides the confirm-password field and switches the submit label.
+	const regEmailOnly = $derived(regPassword.length === 0);

 	// Admin setup (first run)
 	let setupEmail = $state('');
@@ -61,14 +66,51 @@
 		setupConfirm.length === 0 ? '' : setupPassword === setupConfirm ? 'ok' : 'bad'
 	);

-	// Magic link
-	let magicOpen = $state(false);
-	let magicEmail = $state('');
+	// Magic-link submit status (rendered inline after a link is sent).
 	let magicStatus = $state<{ text: string; ok: boolean } | null>(null);

-	// OIDC
+	// OIDC + auth-method flags exposed by /api/auth/oidc/providers.
 	let oidc = $state<OidcProviders>({ enabled: false });
+	// Default `true` here: on older backends the field is absent, and the
+	// legacy behaviour was always-on password login.
 	const passwordLoginEnabled = $derived(oidc.password_login_enabled !== false);
+	// Default `false`: only render magic-link UI when the backend
+	// affirmatively enables it (SMTP wired + allowlist + non-OIDC deployment).
+	const magicLinkLoginEnabled = $derived(oidc.magic_link_login_enabled === true);
+	// Single-form UX: the identifier + password fields double as the
+	// magic-link path. When the password is empty (and the server offers
+	// magic-link), submit sends a link to the identifier instead of
+	// attempting password login. This eliminates the duplicate
+	// identifier input the old two-form layout carried.
+	const submitAsMagicLink = $derived(
+		magicLinkLoginEnabled && (password.length === 0 || !passwordLoginEnabled)
+	);
+	// The login failure remap for "email not verified". The server
+	// auto-sends a verification magic-link on this branch (piggybacked
+	// on the successful password proof — see login handler), so the
+	// resend "affordance" is simply resubmitting the form. Kept as a
+	// flag to let the UI render a specific hint.
+	let emailNotVerified = $state<{ email: string } | null>(null);
+	// One-shot "your session expired" banner. Triggered by the fetch
+	// interceptor via `?source=session_expired`. Set to true only if
+	// the query param is present on mount; the URL is stripped
+	// immediately after so revisits / manual logouts don't re-show
+	// the stale message.
+	let sessionExpiredNotice = $state(false);
+	// Refs used by the mode-driven auto-focus effect. Bound with
+	// `bind:this` on the first input of each mode's form so the effect
+	// can focus the "primary" field each time the mode changes without
+	// walking the DOM.
+	let loginIdentifierInput = $state<HTMLInputElement | null>(null);
+	let registerEmailInput = $state<HTMLInputElement | null>(null);
+	let setupEmailInput = $state<HTMLInputElement | null>(null);
+	// "Account created, follow the email link" banner. Set by the
+	// register submit handler right before switching mode='login',
+	// so the message stays on screen for the whole time the user is
+	// looking at the login form (instead of vanishing on the register
+	// form under a hard-to-read timeout). Cleared on the next
+	// successful login OR when the user dismisses it.
+	let postRegisterNotice = $state<string | null>(null);

 	// The redirect target is an in-SPA destination (e.g. /files or a deep link a
 	// guard bounced us from). It's user-supplied via the query string so its exact
@@ -94,9 +136,21 @@
 		setupCapsOn = e.getModifierState?.('CapsLock') ?? false;
 	}

+	// Unified login submit. Two modes dispatched from ONE form:
+	//   * password filled → POST /api/auth/login
+	//   * password empty  → POST /api/auth/magic-link/send (backend
+	//     accepts either a username or an email as identifier)
+	// The `submitAsMagicLink` derived tracks which mode is active;
+	// button label + hint text render off it.
 	async function onLogin(e: SubmitEvent) {
 		e.preventDefault();
 		error = '';
+		emailNotVerified = null;
+		magicStatus = null;
+		if (submitAsMagicLink) {
+			await submitMagicLink();
+			return;
+		}
 		busy = true;
 		try {
 			const data = await login(username, password);
@@ -108,9 +162,58 @@
 				return;
 			}
 			session.setUser(data.user);
+			postRegisterNotice = null;
 			await goto(resolve(redirectTarget), { replaceState: true });
 		} catch (err) {
-			error = err instanceof Error ? err.message : t('auth.login_error', 'Error logging in');
+			if (err instanceof ApiError && err.errorType === 'EmailNotVerified') {
+				// Server auto-sent a verification magic-link on the
+				// piggyback-of-successful-password path (see the login
+				// handler). Just tell the user; resubmitting the form
+				// re-triggers the same auto-send.
+				emailNotVerified = { email: username };
+				error = t(
+					'auth.email_not_verified',
+					'Your email is not verified. We sent a verification link to your inbox — click it, then sign in again. If it did not arrive, submit the form again.'
+				);
+			} else if (err instanceof ApiError && err.errorType === 'PasswordLoginDisabled') {
+				error = t(
+					'auth.password_login_disabled',
+					'Password login is disabled on this server. Leave the password blank to receive a sign-in link, or use SSO.'
+				);
+			} else {
+				error = err instanceof Error ? err.message : t('auth.login_error', 'Error logging in');
+			}
+		} finally {
+			busy = false;
+		}
+	}
+
+	// Password-empty branch of the unified submit. Uses the same
+	// `username` identifier the password form does — the backend
+	// dispatches on `@` (username vs email). Anti-enum uniform 200.
+	async function submitMagicLink() {
+		if (!username) return;
+		busy = true;
+		try {
+			const result = await sendMagicLink(username);
+			magicStatus =
+				result === 'sent'
+					? {
+							text: t(
+								'auth.magic_sent',
+								'If an account exists, a sign-in link has been sent. Check your inbox.'
+							),
+							ok: true
+						}
+					: {
+							text: t(
+								'auth.magic_unavailable',
+								'Sign-in by email is not available on this server.'
+							),
+							ok: false
+						};
+		} catch {
+			magicStatus = { text: t('auth.magic_error', 'Something went wrong. Try again.'), ok: false };
 		} finally {
 			busy = false;
 		}
@@ -119,17 +222,25 @@
 	async function onRegister(e: SubmitEvent) {
 		e.preventDefault();
 		regError = '';
-		regSuccess = '';
 		if (regPassword !== regConfirm) {
 			regError = t('auth.passwords_mismatch', 'Passwords do not match');
 			return;
 		}
 		busy = true;
 		try {
-			await register(regUsername, regEmail, regPassword);
-			regSuccess = t('auth.account_success', 'Account created. You can now sign in.');
+			// Username is optional since PR 18 — pass undefined when the
+			// field is left blank so the backend keeps `username = None`
+			// (the user can claim a handle later via profile settings).
+			await register(regEmail, regPassword, regUsername.trim() || undefined);
 			regUsername = regEmail = regPassword = regConfirm = '';
-			setTimeout(() => (mode = 'login'), 2000);
+			// Move the success notice to the LOGIN screen so it's actually
+			// readable — the register form is about to be replaced, so a
+			// message shown here would flash and disappear.
+			postRegisterNotice = t(
+				'auth.account_success',
+				'If the address is available, a confirmation email is on its way. Follow the link to finish.'
+			);
+			mode = 'login';
 		} catch (err) {
 			regError =
 				err instanceof Error ? err.message : t('auth.register_error', 'Registration failed');
@@ -165,38 +276,22 @@
 		}
 	}

-	async function onMagicLink(e: SubmitEvent) {
-		e.preventDefault();
-		if (!magicEmail) return;
-		magicStatus = null;
-		busy = true;
-		try {
-			const result = await sendMagicLink(magicEmail);
-			magicStatus =
-				result === 'sent'
-					? {
-							text: t(
-								'auth.magic_sent',
-								'If an account exists, a sign-in link has been sent. Check your inbox.'
-							),
-							ok: true
-						}
-					: {
-							text: t(
-								'auth.magic_unavailable',
-								'Sign-in by email is not available on this server.'
-							),
-							ok: false
-						};
-			if (result === 'sent') magicEmail = '';
-		} catch {
-			magicStatus = { text: t('auth.magic_error', 'Something went wrong. Try again.'), ok: false };
-		} finally {
-			busy = false;
-		}
-	}
-
 	onMount(async () => {
+		// 0) Consume the one-shot `?source=session_expired` flag, if any.
+		//    Strip it from the URL so the banner never re-appears on
+		//    reloads / manual logout redirects. Uses history.replaceState
+		//    (no navigation, no scroll jump).
+		if (page.url.searchParams.get('source') === 'session_expired') {
+			sessionExpiredNotice = true;
+			const stripped = new URL(page.url);
+			stripped.searchParams.delete('source');
+			window.history.replaceState(
+				window.history.state,
+				'',
+				stripped.pathname + stripped.search + stripped.hash
+			);
+		}
+
 		// 1) OIDC code-exchange fallback: the IdP round-trip may land back here
 		//    with ?oidc_code=. Exchange it for a session and redirect into the app.
 		const oidcCode = page.url.searchParams.get('oidc_code');
@@ -230,6 +325,22 @@

 		booting = false;
 	});
+
+	// Auto-focus the primary input for the current mode. Fires once the
+	// booting probes settle AND on every mode swap. The `booting` guard
+	// avoids stealing focus from something else during the loading
+	// splash; the input-ref guard covers the render-order case where
+	// the effect fires before the DOM has the target.
+	$effect(() => {
+		if (booting) return;
+		const target =
+			mode === 'login'
+				? loginIdentifierInput
+				: mode === 'register'
+					? registerEmailInput
+					: setupEmailInput;
+		target?.focus();
+	});
 </script>

 <svelte:head>
@@ -249,9 +360,13 @@
 			<div class="auth-logo-text"><span class="brand-oxi">Oxi</span>Cloud</div>
 		</div>

-		{#if booting}
-			<p class="auth-subtitle">{t('common.loading', 'Loading…')}</p>
-		{:else}
+			<!-- Form paints immediately alongside the logo — the onMount
+			     probes (OIDC code exchange, session probe, providers
+			     lookup) run concurrently and either redirect the user
+			     away or upgrade the visible affordances (OIDC button,
+			     magic-link toggle) in place. Guarding the whole form
+			     behind `booting` caused a "logo only, then form" flash
+			     on first paint. -->
 			<h1 class="auth-title">
 				{#if mode === 'login'}
 					{t('auth.sign_in', 'Sign in')}
@@ -262,19 +377,73 @@
 				{/if}
 			</h1>

-			{#if page.url.searchParams.get('source') === 'session_expired'}
-				<div class="auth-error" style="display: block">
-					{t('auth.session_expired', 'Your session expired. Please sign in again.')}
+			{#if sessionExpiredNotice}
+				<div
+					class="auth-error auth-error--dismissible"
+					style="display: flex"
+					role="alert"
+					data-testid="login-session-expired-notice"
+				>
+					<span>{t('auth.session_expired', 'Your session expired. Please sign in again.')}</span>
+					<button
+						type="button"
+						class="auth-notice-dismiss"
+						aria-label={t('common.dismiss', 'Dismiss')}
+						data-testid="login-session-expired-dismiss-btn"
+						onclick={() => (sessionExpiredNotice = false)}>×</button
+					>
+				</div>
+			{/if}
+
+			{#if postRegisterNotice && mode === 'login'}
+				<div
+					class="auth-success auth-error--dismissible"
+					style="display: flex"
+					role="status"
+					data-testid="login-post-register-notice"
+				>
+					<span>{postRegisterNotice}</span>
+					<button
+						type="button"
+						class="auth-notice-dismiss"
+						aria-label={t('common.dismiss', 'Dismiss')}
+						data-testid="login-post-register-dismiss-btn"
+						onclick={() => (postRegisterNotice = null)}>×</button
+					>
 				</div>
 			{/if}

 			{#if mode === 'login'}
-				{#if passwordLoginEnabled}
-					{#if error}<div class="auth-error" style="display: block" role="alert">{error}</div>{/if}
+				<!-- Unified login form. One identifier + one (optional)
+				     password field drive both flows:
+				       * password filled       → POST /api/auth/login
+				       * password empty        → POST /api/auth/magic-link/send
+				       * password-only server  → password field is required, no hint
+				       * magic-link-only server → password field hides entirely -->
+				{#if passwordLoginEnabled || magicLinkLoginEnabled}
+					{#if error}
+						<div
+							class={emailNotVerified ? 'auth-success' : 'auth-error'}
+							style="display: block"
+							role="alert"
+						>
+							{error}
+						</div>
+					{/if}
+					{#if magicStatus}
+						<div
+							class={magicStatus.ok
+								? 'auth-status auth-status-success'
+								: 'auth-status auth-status-error'}
+							role={magicStatus.ok ? 'status' : 'alert'}
+						>
+							{magicStatus.text}
+						</div>
+					{/if}
 					<form class="auth-form" data-testid="login-form" onsubmit={onLogin} novalidate>
 						<div class="auth-input-group">
 							<label class="auth-label" for="login-username">
-								{t('auth.username', 'Username or email')}
+								{t('auth.login_identifier', 'Username or email')}
 							</label>
 							<div class="auth-input-wrap auth-input-wrap--user">
 								<input
@@ -283,42 +452,54 @@
 									data-testid="login-username-input"
 									type="text"
 									bind:value={username}
+									bind:this={loginIdentifierInput}
 									autocomplete="username"
+									placeholder={t(
+										'auth.login_identifier_placeholder',
+										'Enter your username or email'
+									)}
 									required
 									disabled={busy}
 								/>
 							</div>
 						</div>

-						<div class="auth-input-group">
-							<label class="auth-label" for="login-password">{t('auth.password', 'Password')}</label
-							>
-							<div class="auth-input-wrap auth-input-wrap--lock has-toggle">
-								<input
-									id="login-password"
-									class="auth-input"
-									data-testid="login-password-input"
-									type={showPassword ? 'text' : 'password'}
-									bind:value={password}
-									onkeydown={onPwKey}
-									onkeyup={onPwKey}
-									autocomplete="current-password"
-									required
-									disabled={busy}
-								/>
-								<button
-									type="button"
-									class="auth-pw-toggle"
-									aria-pressed={showPassword}
-									data-testid="login-password-toggle-btn"
-									aria-label={t('auth.toggle_password', 'Show password')}
-									onclick={() => (showPassword = !showPassword)}
-								></button>
+						{#if passwordLoginEnabled}
+							<div class="auth-input-group">
+								<label class="auth-label" for="login-password">
+									{#if magicLinkLoginEnabled}
+										{t('auth.password_or_link_hint', 'Password (leave blank for a sign-in link)')}
+									{:else}
+										{t('auth.password', 'Password')}
+									{/if}
+								</label>
+								<div class="auth-input-wrap auth-input-wrap--lock has-toggle">
+									<input
+										id="login-password"
+										class="auth-input"
+										data-testid="login-password-input"
+										type={showPassword ? 'text' : 'password'}
+										bind:value={password}
+										onkeydown={onPwKey}
+										onkeyup={onPwKey}
+										autocomplete="current-password"
+										required={!magicLinkLoginEnabled}
+										disabled={busy}
+									/>
+									<button
+										type="button"
+										class="auth-pw-toggle"
+										aria-pressed={showPassword}
+										data-testid="login-password-toggle-btn"
+										aria-label={t('auth.toggle_password', 'Show password')}
+										onclick={() => (showPassword = !showPassword)}
+									></button>
+								</div>
+								{#if capsOn}
+									<div class="auth-caps-warning">{t('auth.caps_lock', 'Caps Lock is on')}</div>
+								{/if}
 							</div>
-							{#if capsOn}
-								<div class="auth-caps-warning">{t('auth.caps_lock', 'Caps Lock is on')}</div>
-							{/if}
-						</div>
+						{/if}

 						<button
 							class="auth-button"
@@ -327,62 +508,17 @@
 							disabled={busy}
 							aria-busy={busy}
 						>
-							{busy ? t('auth.signing_in', 'Signing in…') : t('auth.sign_in', 'Sign in')}
+							{#if busy}
+								{submitAsMagicLink
+									? t('auth.sending', 'Sending…')
+									: t('auth.signing_in', 'Signing in…')}
+							{:else if submitAsMagicLink}
+								{t('auth.magicLinkSubmit', 'Send sign-in link')}
+							{:else}
+								{t('auth.sign_in', 'Sign in')}
+							{/if}
 						</button>
 					</form>
-
-					<button
-						class="auth-magic-toggle"
-						data-testid="login-magic-toggle-btn"
-						onclick={() => (magicOpen = !magicOpen)}
-					>
-						{t('auth.magic_prompt', 'No password? Sign in with an email link')}
-					</button>
-					{#if magicOpen}
-						<div class="auth-magic-reveal">
-							<p class="auth-hint">
-								{t(
-									'auth.magic_hint',
-									"No password? Enter your email and we'll send you a one-time sign-in link."
-								)}
-							</p>
-							<form class="auth-form" data-testid="login-magic-form" onsubmit={onMagicLink}>
-								<div class="auth-input-group">
-									<label class="auth-label" for="magic-email">
-										{t('auth.magic_email_label', 'Email address')}
-									</label>
-									<div class="auth-input-wrap auth-input-wrap--mail">
-										<input
-											id="magic-email"
-											class="auth-input"
-											data-testid="login-magic-email-input"
-											type="email"
-											bind:value={magicEmail}
-											autocomplete="email"
-											placeholder={t('auth.email', 'you@example.com')}
-										/>
-									</div>
-								</div>
-								<button
-									class="auth-button auth-button-secondary"
-									type="submit"
-									data-testid="login-magic-send-btn"
-									disabled={busy}
-								>
-									{t('auth.magic_send', 'Send link')}
-								</button>
-							</form>
-							{#if magicStatus}
-								<div
-									class={magicStatus.ok
-										? 'auth-status auth-status-success'
-										: 'auth-status auth-status-error'}
-								>
-									{magicStatus.text}
-								</div>
-							{/if}
-						</div>
-					{/if}
 				{/if}

 				{#if oidc.enabled}
@@ -433,19 +569,11 @@
 				{#if regError}<div class="auth-error" style="display: block" role="alert">
 						{regError}
 					</div>{/if}
-				{#if regSuccess}<div class="auth-success" style="display: block">{regSuccess}</div>{/if}
 				<form class="auth-form" data-testid="login-register-form" onsubmit={onRegister} novalidate>
-					<div class="auth-input-group">
-						<label class="auth-label" for="reg-username">{t('auth.username', 'Username')}</label>
-						<input
-							id="reg-username"
-							class="auth-input"
-							data-testid="login-register-username-input"
-							bind:value={regUsername}
-							required
-							disabled={busy}
-						/>
-					</div>
+					<!-- Email is the only required identifier since PR 18 — the
+					     backend accepts email-only signup and mints a welcome
+					     magic-link. Username is optional at this stage; the user
+					     can claim a handle later via profile settings. -->
 					<div class="auth-input-group">
 						<label class="auth-label" for="reg-email">{t('auth.email', 'Email')}</label>
 						<input
@@ -454,74 +582,101 @@
 							data-testid="login-register-email-input"
 							type="email"
 							bind:value={regEmail}
+							bind:this={registerEmailInput}
+							autocomplete="email"
 							required
 							disabled={busy}
 						/>
 					</div>
 					<div class="auth-input-group">
-						<label class="auth-label" for="reg-password">{t('auth.password', 'Password')}</label>
-						<div class="auth-input-wrap auth-input-wrap--lock has-toggle">
-							<input
-								id="reg-password"
-								class="auth-input"
-								data-testid="login-register-password-input"
-								type={regShowPassword ? 'text' : 'password'}
-								bind:value={regPassword}
-								onkeydown={onRegPwKey}
-								onkeyup={onRegPwKey}
-								autocomplete="new-password"
-								required
-								disabled={busy}
-							/>
-							<button
-								type="button"
-								class="auth-pw-toggle"
-								aria-pressed={regShowPassword}
-								data-testid="login-register-password-toggle-btn"
-								aria-label={t('auth.toggle_password', 'Show password')}
-								onclick={() => (regShowPassword = !regShowPassword)}
-							></button>
-						</div>
-						{#if regCapsOn}
-							<div class="auth-caps-warning">{t('auth.caps_lock', 'Caps Lock is on')}</div>
-						{/if}
+						<label class="auth-label" for="reg-username">
+							{t('auth.username_optional', 'Username (optional)')}
+						</label>
+						<input
+							id="reg-username"
+							class="auth-input"
+							data-testid="login-register-username-input"
+							bind:value={regUsername}
+							autocomplete="username"
+							disabled={busy}
+						/>
 					</div>
-					<div class="auth-input-group">
-						<label class="auth-label" for="reg-confirm"
-							>{t('auth.confirm_password', 'Confirm password')}</label
-						>
-						<div class="auth-input-wrap auth-input-wrap--lock has-toggle">
-							<input
-								id="reg-confirm"
-								class="auth-input"
-								data-testid="login-register-confirm-input"
-								type={regShowConfirm ? 'text' : 'password'}
-								bind:value={regConfirm}
-								onkeydown={onRegPwKey}
-								onkeyup={onRegPwKey}
-								autocomplete="new-password"
-								required
-								disabled={busy}
-							/>
-							<button
-								type="button"
-								class="auth-pw-toggle"
-								aria-pressed={regShowConfirm}
-								data-testid="login-register-confirm-toggle-btn"
-								aria-label={t('auth.toggle_password', 'Show password')}
-								onclick={() => (regShowConfirm = !regShowConfirm)}
-							></button>
+					<!-- Password fields hide entirely when policy forbids password
+					     login — the whole form becomes email-only in that mode. -->
+					{#if passwordLoginEnabled}
+						<div class="auth-input-group">
+							<label class="auth-label" for="reg-password">
+								{t(
+									'auth.password_optional',
+									'Password (optional — leave blank for a sign-in link)'
+								)}
+							</label>
+							<div class="auth-input-wrap auth-input-wrap--lock has-toggle">
+								<input
+									id="reg-password"
+									class="auth-input"
+									data-testid="login-register-password-input"
+									type={regShowPassword ? 'text' : 'password'}
+									bind:value={regPassword}
+									onkeydown={onRegPwKey}
+									onkeyup={onRegPwKey}
+									autocomplete="new-password"
+									disabled={busy}
+								/>
+								<button
+									type="button"
+									class="auth-pw-toggle"
+									aria-pressed={regShowPassword}
+									data-testid="login-register-password-toggle-btn"
+									aria-label={t('auth.toggle_password', 'Show password')}
+									onclick={() => (regShowPassword = !regShowPassword)}
+								></button>
+							</div>
+							{#if regCapsOn}
+								<div class="auth-caps-warning">{t('auth.caps_lock', 'Caps Lock is on')}</div>
+							{/if}
 						</div>
-						{#if matchState}
-							<div
-								class="auth-match show {matchState === 'ok' ? 'auth-match--ok' : 'auth-match--bad'}"
-							>
-								{matchState === 'ok'
-									? t('auth.passwords_match', 'Passwords match')
-									: t('auth.passwords_mismatch', "Passwords don't match")}
+						{#if !regEmailOnly}
+							<div class="auth-input-group">
+								<label class="auth-label" for="reg-confirm"
+									>{t('auth.confirm_password', 'Confirm password')}</label
+								>
+								<div class="auth-input-wrap auth-input-wrap--lock has-toggle">
+									<input
+										id="reg-confirm"
+										class="auth-input"
+										data-testid="login-register-confirm-input"
+										type={regShowConfirm ? 'text' : 'password'}
+										bind:value={regConfirm}
+										onkeydown={onRegPwKey}
+										onkeyup={onRegPwKey}
+										autocomplete="new-password"
+										required
+										disabled={busy}
+									/>
+									<button
+										type="button"
+										class="auth-pw-toggle"
+										aria-pressed={regShowConfirm}
+										data-testid="login-register-confirm-toggle-btn"
+										aria-label={t('auth.toggle_password', 'Show password')}
+										onclick={() => (regShowConfirm = !regShowConfirm)}
+									></button>
+								</div>
+								{#if matchState}
+									<div
+										class="auth-match show {matchState === 'ok'
+											? 'auth-match--ok'
+											: 'auth-match--bad'}"
+									>
+										{matchState === 'ok'
+											? t('auth.passwords_match', 'Passwords match')
+											: t('auth.passwords_mismatch', "Passwords don't match")}
+									</div>
+								{/if}
 							</div>
 						{/if}
-					</div>
+					{/if}
 					<button
 						class="auth-button"
 						type="submit"
@@ -529,7 +684,9 @@
 						disabled={busy}
 						aria-busy={busy}
 					>
-						{t('auth.register', 'Create account')}
+						{!passwordLoginEnabled || regEmailOnly
+							? t('auth.register_email_only', 'Send me a sign-in link')
+							: t('auth.register', 'Create account')}
 					</button>
 				</form>
 				<div class="auth-toggle">
@@ -591,6 +748,7 @@
 								data-testid="login-setup-email-input"
 								type="email"
 								bind:value={setupEmail}
+								bind:this={setupEmailInput}
 								autocomplete="email"
 								required
 								disabled={busy}
@@ -691,7 +849,6 @@
 					</button>
 				</div>
 			{/if}
-		{/if}

 		<div class="auth-lang">
 			<select
@@ -721,4 +878,24 @@
 		background: var(--color-bg-input);
 		color: var(--color-text-muted);
 	}
+
+	.auth-error--dismissible {
+		align-items: center;
+		gap: var(--space-2);
+		justify-content: space-between;
+	}
+
+	.auth-notice-dismiss {
+		background: transparent;
+		border: 0;
+		color: inherit;
+		cursor: pointer;
+		font-size: var(--font-size-lg);
+		line-height: 1;
+		padding: 0 var(--space-1);
+	}
+
+	.auth-notice-dismiss:hover {
+		opacity: 0.7;
+	}
 </style>
@@ -622,6 +622,7 @@
    "login_identifier_placeholder": "Enter your username or email",
    "password": "Password",
    "password_placeholder": "Enter your password",
+    "password_or_link_hint": "Password (leave blank for a sign-in link)",
    "login_button": "Sign in",
    "no_account": "Don't have an account?",
    "register": "Sign up",
@@ -676,6 +677,7 @@
    "session_expired": "Your session expired. Please sign in again.",
    "sign_in": "Sign in",
    "signing_in": "Signing in…",
+    "sending": "Sending…",
    "toggle_password": "Show password"
  },
  "storage": {
@@ -264,13 +264,26 @@ pub struct OidcExchangeDto {
    pub code: String,
 }

-/// Information about available OIDC providers
+/// Information about available OIDC providers + self-service auth
+/// methods enabled on the deployment. Consumed by the login page to
+/// decide which forms/buttons to render.
 #[derive(Debug, Serialize, Deserialize, ToSchema)]
 pub struct OidcProviderInfoDto {
    pub enabled: bool,
    pub provider_name: String,
    pub authorize_endpoint: String,
    pub password_login_enabled: bool,
+    /// True iff the server accepts magic-link login requests
+    /// (`OXICLOUD_AUTH_METHODS` includes `magic_link` AND SMTP is
+    /// configured). Frontend renders the magic-link form when true.
+    #[serde(default)]
+    pub magic_link_login_enabled: bool,
+    /// True iff `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set. Frontend uses
+    /// this hint to explain the `EmailNotVerified` login response and
+    /// to nudge new users toward the magic-link verification path
+    /// straight after signup.
+    #[serde(default)]
+    pub require_verified_email: bool,
 }

 /// Claims extracted from the validated OIDC ID token
@@ -7,7 +7,7 @@ use crate::application::ports::auth_ports::{
 };
 use crate::application::ports::user_lifecycle::{DeletionMode, LogoutReason};
 use crate::application::services::user_lifecycle_service::UserLifecycleService;
-use crate::common::config::OidcConfig;
+use crate::common::config::{AuthMethod, OidcConfig};
 use crate::common::errors::{DomainError, ErrorKind};
 use crate::domain::entities::magic_link_token::{MagicLinkResourceKind, MagicLinkStatus};
 use crate::domain::entities::session::Session;
@@ -148,6 +148,16 @@ pub struct AuthApplicationService {
    /// per request; the known mutation paths (`change_user_role`,
    /// `set_user_active`) also invalidate eagerly.
    user_flags_cache: Cache<Uuid, UserFlags>,
+    /// Self-service auth-method allowlist (mirrors
+    /// `AuthConfig::allowed_auth_methods`). Empty = both methods
+    /// allowed. Consulted by login / register / magic-link handlers via
+    /// `is_password_login_allowed()` / `is_magic_link_login_allowed()`
+    /// so callers don't have to reach for the app config.
+    allowed_auth_methods: Vec<AuthMethod>,
+    /// Whether `POST /api/auth/login` refuses accounts whose
+    /// `email_verified_at IS NULL`. Mirrors
+    /// `AuthConfig::require_verified_email`.
+    require_verified_email: bool,
 }

 /// TTL for [`AuthApplicationService::user_flags_cache`]. Upper bound on how
@@ -191,9 +201,95 @@ impl AuthApplicationService {
                .max_capacity(10_000)
                .time_to_live(USER_FLAGS_CACHE_TTL)
                .build(),
+            allowed_auth_methods: vec![AuthMethod::Password, AuthMethod::MagicLink],
+            require_verified_email: false,
        }
    }

+    /// Populates the auth-method allowlist + `require_verified_email`
+    /// snapshot from the loaded config. Called by the DI factory. If
+    /// left uncalled (test builds), defaults are permissive: both
+    /// methods enabled, verified-email not required.
+    pub fn with_auth_policy(
+        mut self,
+        allowed_methods: Vec<AuthMethod>,
+        require_verified_email: bool,
+    ) -> Self {
+        self.allowed_auth_methods = allowed_methods;
+        self.require_verified_email = require_verified_email;
+        self
+    }
+
+    /// True iff `POST /api/auth/login` is a supported endpoint on this
+    /// deployment. Composes the OIDC `disable_password_login` legacy
+    /// flag with the newer `OXICLOUD_AUTH_METHODS` allowlist.
+    pub fn is_password_login_allowed(&self) -> bool {
+        !self.password_login_disabled()
+            && (self.allowed_auth_methods.is_empty()
+                || self.allowed_auth_methods.contains(&AuthMethod::Password))
+    }
+
+    /// True iff `POST /api/auth/magic-link/send` should mint tokens for
+    /// end-user login on this deployment.
+    ///
+    /// Requires ALL of:
+    ///   * repo wired (SMTP configured, tokens can actually be minted);
+    ///   * allowlist permits `MagicLink` (or is empty = permissive);
+    ///   * OIDC is NOT enabled at the deployment level.
+    ///
+    /// The OIDC guard is a hard rule: when OIDC is enabled it is the
+    /// master identity provider — magic-link would bypass any 2FA / step-up
+    /// policy that the IdP enforces. An operator running OIDC + local
+    /// accounts hybrid must NOT expose magic-link login for the local
+    /// accounts either, because a user provisioned via OIDC-JIT could
+    /// receive a magic-link on the same mailbox and sidestep MFA. Admin-
+    /// mediated invites use OIDC or password bootstrap instead.
+    pub fn is_magic_link_login_allowed(&self) -> bool {
+        self.magic_link_enabled()
+            && !self.oidc_enabled()
+            && (self.allowed_auth_methods.is_empty()
+                || self.allowed_auth_methods.contains(&AuthMethod::MagicLink))
+    }
+
+    /// True iff login should reject accounts with `email_verified_at IS
+    /// NULL`. Backed by `OXICLOUD_REQUIRE_VERIFIED_EMAIL`.
+    pub fn require_verified_email(&self) -> bool {
+        self.require_verified_email
+    }
+
+    /// Resolve a login-identifier (username OR email) to the account's
+    /// registered email address. Mirrors the `POST /api/auth/login`
+    /// dispatcher (`@` presence → email lookup, else → username
+    /// lookup). Returns `None` when the identifier doesn't match any
+    /// account — callers that need anti-enumeration semantics MUST
+    /// still return their uniform response after logging the reason.
+    ///
+    /// The username namespace forbids `@` (PR 16), so the two paths
+    /// are disjoint — no ambiguity.
+    pub async fn resolve_login_identifier_to_email(&self, identifier: &str) -> Option<String> {
+        if identifier.contains('@') {
+            Some(identifier.to_string())
+        } else {
+            self.user_storage
+                .get_user_by_username(identifier)
+                .await
+                .ok()
+                .map(|u| u.email().to_string())
+        }
+    }
+
+    /// Direct lookup helpers used by handlers that need the full `User`
+    /// entity (not just the email). Mirrors the internal `user_storage`
+    /// calls the service already makes in `login`. Currently used by
+    /// the login handler to auto-mint a verification magic-link after
+    /// a successful password check.
+    pub async fn find_user_by_email(&self, email: &str) -> Result<User, DomainError> {
+        self.user_storage.get_user_by_email(email).await
+    }
+    pub async fn find_user_by_username(&self, username: &str) -> Result<User, DomainError> {
+        self.user_storage.get_user_by_username(username).await
+    }
+
    /// Wire the magic-link token repository. Called from the DI factory
    /// when the magic-link feature is configured. Mirrors the
    /// `with_oidc` / `with_user_lifecycle` builder pattern.
@@ -508,6 +604,13 @@ impl AuthApplicationService {
            )
        })?;

+        // First-run admin is authoritative by definition — they set the
+        // password themselves, at the console, on a fresh install. Mark
+        // verified so `OXICLOUD_REQUIRE_VERIFIED_EMAIL` never locks the
+        // sole account with root-level power out of their own instance.
+        let mut user = user;
+        user.mark_email_verified();
+
        let created_user = self.user_storage.create_user(user).await?;

        // Lifecycle: notify hooks. PR 3 moves home-folder creation into
@@ -527,6 +630,26 @@ impl AuthApplicationService {
    }

    pub async fn login(&self, dto: LoginDto) -> Result<AuthResponseDto, DomainError> {
+        // Gate: policy may forbid password logins entirely (either the
+        // legacy OIDC-only mode or the newer `OXICLOUD_AUTH_METHODS`
+        // allowlist without `password`). Refuse BEFORE the user lookup
+        // so we don't leak account existence via timing on a disabled
+        // endpoint.
+        if !self.is_password_login_allowed() {
+            tracing::info!(
+                target: "audit",
+                event = "auth.login_rejected",
+                reason = "password_login_disabled",
+                attempted_username = %dto.username,
+                "🔐 login rejected: password login disabled by policy",
+            );
+            return Err(DomainError::new(
+                ErrorKind::AccessDenied,
+                "Auth",
+                "Password login is disabled",
+            ));
+        }
+
        // Dispatch on `@` in the input: presence of `@` means an email
        // was typed, absence means a username. The two namespaces are
        // provably disjoint (PR 16 forbids `@` in usernames), so this
@@ -612,6 +735,45 @@ impl AuthApplicationService {
            ));
        }

+        // Gate: `OXICLOUD_REQUIRE_VERIFIED_EMAIL`. Checked AFTER password
+        // validation so an attacker with only a username cannot probe
+        // account verification state (the response shape is
+        // `Invalid credentials` for bad passwords regardless of whether
+        // the email is verified — a wrong-password observer learns
+        // nothing).
+        //
+        // ADMIN EXEMPTION: admins are trusted by fiat and predate this
+        // gate. Fresh admin accounts (admin_create_user /
+        // setup_create_admin) are stamped verified at creation; the
+        // exemption covers pre-existing admin accounts installed before
+        // the flag shipped.
+        //
+        // The auto-send of a verification magic-link when this branch
+        // fires is done at the handler layer (login handler triggers
+        // `send_verification_link_authenticated`) rather than here —
+        // the service returns the distinguished error and the handler
+        // orchestrates the side effect. Keeps this method side-effect-
+        // free on the audit path.
+        if self.require_verified_email
+            && !matches!(user.role(), UserRole::Admin)
+            && !user.is_email_verified()
+        {
+            tracing::info!(
+                target: "audit",
+                event = "auth.login_rejected",
+                reason = "email_not_verified",
+                user_id = %user.id(),
+                username = %user.display_for_audit(),
+                "🔐 login rejected: email not verified for '{}' (password OK)",
+                user.display_for_audit(),
+            );
+            return Err(DomainError::new(
+                ErrorKind::AccessDenied,
+                "Auth",
+                "Email not verified",
+            ));
+        }
+
        // Lifecycle: dispatch login BEFORE register_login() so hooks
        // observing `last_login_at().is_none()` see "first ever login"
        // correctly. See tip #1 in user_lifecycle.rs.
@@ -689,6 +851,17 @@ impl AuthApplicationService {
            )
        })?;

+        // Defense-in-depth: if magic-link login was minted under an older
+        // policy and the operator has since flipped OIDC on (or dropped
+        // `MagicLink` from `OXICLOUD_AUTH_METHODS`), we must not honour
+        // pre-existing login tokens. Invitation tokens (resource_kind =
+        // File / Folder) are checked separately below — they represent
+        // an admin-mediated invite, which is a distinct policy question
+        // from "self-service login via email".
+        //
+        // We do the token lookup FIRST so we can classify by
+        // `resource_kind()` before applying the gate — invitations
+        // survive, plain logins do not.
        let mlt = repo.find_by_token(token).await?.ok_or_else(|| {
            // Audit: unknown / forged magic-link redemption. The first
            // 8 chars of the bogus token are logged so a recurring
@@ -710,6 +883,27 @@ impl AuthApplicationService {
            )
        })?;

+        // Enforce the login-magic-link policy on stale tokens.
+        // resource_kind = None means "plain login-via-email"; anything
+        // else is an invite (which follows its own admin-mediated
+        // trust chain). Refuse the login case if the current policy
+        // forbids magic-link login.
+        if mlt.resource_kind().is_none() && !self.is_magic_link_login_allowed() {
+            tracing::info!(
+                target: "audit",
+                event = "magic_link.redemption_rejected",
+                reason = "login_disabled_by_policy",
+                token_id = %mlt.id(),
+                user_id = %mlt.user_id(),
+                "🔗 magic-link rejected: login-via-email disabled by policy (OIDC-master or allowlist)",
+            );
+            return Err(DomainError::new(
+                ErrorKind::AccessDenied,
+                "MagicLink",
+                "magic-link login is disabled",
+            ));
+        }
+
        // Friendly early-rejection messages. The atomic `mark_used`
        // below is the canonical single-use guard.
        if mlt.status() == MagicLinkStatus::Used {
@@ -1717,6 +1911,16 @@ impl AuthApplicationService {
            )
        })?;

+        // Admin fiat counts as verification. When
+        // `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set, admin-created users
+        // still get to log in without a magic-link round-trip — the
+        // operator explicitly vouched for the address at creation. This
+        // mirrors the OIDC-JIT convention (see `redeem_pending_oidc_token`
+        // and `login_oidc_callback` which also stamp
+        // `email_verified_at` on first sight).
+        let mut user = user;
+        user.mark_email_verified();
+
        // Persist
        let created = self.user_storage.create_user(user).await?;

@@ -615,6 +615,123 @@ impl MagicLinkInviteService {
        Ok(())
    }

+    /// Mint + email a magic-link for **email verification**, called
+    /// only after another authentication factor has already proven the
+    /// caller's identity (currently: the login handler after a
+    /// successful password check).
+    ///
+    /// Contract: the caller MUST have validated the user's identity via
+    /// an independent factor before invoking this. The method does NOT
+    /// re-verify credentials — it exists specifically to bypass the
+    /// `has_password` eligibility gate, which would otherwise deadlock
+    /// the `OXICLOUD_REQUIRE_VERIFIED_EMAIL` flow (login rejected as
+    /// unverified → user asks for a verification link → refused
+    /// because they have a password).
+    ///
+    /// Rejected: OIDC-linked users, deactivated users. Everything else
+    /// gets a token — including the "has password" case that
+    /// `send_login_link` refuses.
+    pub async fn send_verification_link_authenticated(
+        &self,
+        user: &User,
+        request_challenge: &str,
+    ) -> Result<(), DomainError> {
+        // OIDC boundary is unconditional even here — the IdP owns the
+        // identity contract and we must not mint a session-primitive
+        // for a user it manages.
+        if user.is_oidc_user() {
+            tracing::info!(
+                target: "audit",
+                event = "auth.magic_link_send",
+                reason = "oidc_user",
+                user_id = %user.id(),
+                username = %user.display_for_audit(),
+                "🔗 verify-link suppressed: OIDC user",
+            );
+            return Ok(());
+        }
+        if !user.is_active() {
+            tracing::info!(
+                target: "audit",
+                event = "auth.magic_link_send",
+                reason = "account_deactivated",
+                user_id = %user.id(),
+                username = %user.display_for_audit(),
+                "🔗 verify-link suppressed: account deactivated",
+            );
+            return Ok(());
+        }
+
+        let token = MagicLinkToken::new(
+            user.id(),
+            chrono::Duration::minutes(self.magic_link_cfg.login_ttl_minutes as i64),
+            None,
+            Some(request_challenge.to_string()),
+        );
+        self.magic_link_repo.create(&token).await?;
+
+        let link = format!(
+            "{}/magic/v1/{}",
+            self.public_base_url.trim_end_matches('/'),
+            token.token(),
+        );
+        // Reuses the login email template for now — same call to
+        // action (click the link), same TTL, same challenge binding.
+        // A dedicated "verify your email" template can land later
+        // without wire changes.
+        let locale = self.locale_for(user);
+        let ttl_minutes = self.magic_link_cfg.login_ttl_minutes.to_string();
+        let login_args: Vec<(&str, &str)> = vec![("link", &link), ("ttl_minutes", &ttl_minutes)];
+
+        let subject = self
+            .i18n_or(
+                "server.magic_link.email.login.subject",
+                &locale,
+                &login_args,
+            )
+            .await;
+        let text_body = self
+            .render_bilingual("server.magic_link.email.login.body", &locale, &login_args)
+            .await;
+
+        let message = EmailMessage {
+            to: user.email().to_string(),
+            subject,
+            text_body,
+            html_body: None,
+        };
+
+        match self.email_sender.send(message).await {
+            Ok(outcome) => {
+                tracing::info!(
+                    target: "audit",
+                    event = "auth.magic_link_send",
+                    reason = "sent_verification",
+                    user_id = %user.id(),
+                    username = %user.display_for_audit(),
+                    email = %user.email(),
+                    smtp_code = outcome.code,
+                    smtp_message = %outcome.message,
+                    "🔗 verify-link sent to '{}'",
+                    user.email(),
+                );
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target: "audit",
+                    event = "auth.magic_link_send_failed",
+                    user_id = %user.id(),
+                    email = %user.email(),
+                    error = %e.message,
+                    "🔗 verify-link SMTP send failed for '{}'",
+                    user.email(),
+                );
+            }
+        }
+
+        Ok(())
+    }
+
    /// Resolve a translation, falling back to the literal key on any
    /// lookup error. Identical to the handler-side helper — kept inline
    /// here because the service layer can't pull in a UI util module
@@ -486,7 +486,7 @@ impl RecipientNotificationService {
        // body — same pattern as `MagicLinkInviteService::issue_invitation`.
        let inviter_short = granter.display_full(false);
        let inviter_full = granter.display_full(true);
-        let login_link = format!("{}/#/login", self.public_base_url.trim_end_matches('/'),);
+        let login_link = format!("{}/login", self.public_base_url.trim_end_matches('/'),);

        let args: Vec<(&str, &str)> = vec![
            ("inviter", inviter_short.as_str()),
@@ -497,6 +497,120 @@ pub struct AuthConfig {
    /// Env: `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS` (comma-
    /// separated).
    pub registration_allowed_email_domains: Vec<String>,
+    /// Additive auth-policy toggles the operator has opted into.
+    /// Distinct from `allowed_auth_methods` (which enables/disables a
+    /// method wholesale) — this vector composes policy switches that
+    /// tweak the default auth behaviour. Empty = pure defaults in
+    /// effect, matching legacy behaviour.
+    ///
+    /// Vector shape (rather than one boolean per policy) so future
+    /// switches can be added by appending a variant instead of
+    /// growing the env-var surface — `OXICLOUD_AUTH_POLICIES=policy_a,policy_b`.
+    /// Each variant's name carries its own polarity (`Permit...`,
+    /// future `Require...` / `Deny...`); the field name stays neutral
+    /// so a future deny-style policy reads correctly at the call site.
+    ///
+    /// Env: `OXICLOUD_AUTH_POLICIES` (comma-separated).
+    ///
+    /// Deprecated legacy alias: `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true`
+    /// still adds `PermitMagicLinkForPasswordUsers` to the vector for
+    /// backwards compatibility; emits a startup warning encouraging
+    /// migration to the vector form.
+    pub auth_policies: Vec<AuthPolicy>,
+    /// Allowlist of self-service auth methods offered on the login
+    /// page and accepted by their respective endpoints. Empty (the
+    /// default) = both methods allowed, matching legacy behaviour.
+    /// OIDC is orthogonal — controlled via `OxidcConfig::enabled`.
+    ///
+    /// Semantics:
+    ///   * `AuthMethod::Password` allowed → `POST /api/auth/login`
+    ///     accepts credentials; password-based `register` works.
+    ///   * `AuthMethod::MagicLink` allowed → `POST /api/auth/magic-
+    ///     link/send` mints tokens; email-only `register` works.
+    ///
+    /// A method NOT in the list returns 403 with a specific
+    /// `error_type` (`PasswordLoginDisabled`,
+    /// `MagicLinkLoginDisabled`) so frontends can render a
+    /// contextual message rather than a generic auth error.
+    ///
+    /// Startup guard: when `MagicLink` is in the list but
+    /// `SmtpConfig::is_enabled()` is false, the server refuses to
+    /// start. A magic-link policy without a mail sender is a
+    /// misconfiguration that silently locks users out.
+    ///
+    /// Env: `OXICLOUD_AUTH_METHODS` (comma-separated:
+    /// `password,magic_link`). Alias: the older
+    /// `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes
+    /// Password from this list when set (backwards-compat).
+    pub allowed_auth_methods: Vec<AuthMethod>,
+    /// Require the user's email to be verified before login is
+    /// permitted. When `true`, `POST /api/auth/login` returns 403
+    /// `EmailNotVerified` for any account whose `email_verified_at`
+    /// is NULL. Users can prove control by clicking a magic-link
+    /// (which stamps `email_verified_at`) — so this composes with
+    /// `AuthMethod::MagicLink` in the allowlist above to provide a
+    /// verification path.
+    ///
+    /// Admin-created users (`POST /api/admin/users`) and the
+    /// first-run setup admin (`POST /api/setup`) get
+    /// `email_verified_at = NOW()` at creation — admin fiat counts
+    /// as verification, matching the OIDC-JIT convention.
+    ///
+    /// Env: `OXICLOUD_REQUIRE_VERIFIED_EMAIL` (default `false`).
+    pub require_verified_email: bool,
+}
+
+/// Self-service auth method. Exposed as `AuthConfig::allowed_auth_methods`
+/// and parsed from `OXICLOUD_AUTH_METHODS` (comma-separated). OIDC is
+/// deliberately excluded — it lives in `OidcConfig` with its own gate.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuthMethod {
+    Password,
+    MagicLink,
+}
+
+impl AuthMethod {
+    /// Case-insensitive parse: accepts `password`, `magic_link`, and the
+    /// dash form `magic-link` (some operators habitually use dashes).
+    /// Unknown token returns `None` so the caller can log-and-skip.
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "password" => Some(Self::Password),
+            "magic_link" | "magic-link" | "magiclink" => Some(Self::MagicLink),
+            _ => None,
+        }
+    }
+}
+
+/// Additive auth-policy switches. Exposed as `AuthConfig::auth_policies`
+/// and parsed from `OXICLOUD_AUTH_POLICIES` (comma-separated). Each
+/// variant's name states its own polarity — `Permit...` grants an
+/// exception, future `Require...` / `Deny...` variants restrict.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuthPolicy {
+    /// Allow magic-link login for accounts that ALSO have a password
+    /// configured. Off by default — magic-link is otherwise gated by
+    /// `magic_link_eligibility()` to users without a password
+    /// (mailbox-strength should not shadow a stronger credential).
+    /// Enabling this weakens the password to mailbox-strength for
+    /// affected accounts; opt-in only.
+    ///
+    /// Deprecated legacy alias: `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true`
+    /// adds this variant to the vector with a startup warning.
+    PermitMagicLinkForPasswordUsers,
+}
+
+impl AuthPolicy {
+    /// Case-insensitive parse: accepts `permit_magic_link_for_password_users`
+    /// (canonical) and the dash form. Unknown token returns `None` so
+    /// the caller can log-and-skip.
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "permit_magic_link_for_password_users"
+            | "permit-magic-link-for-password-users" => Some(Self::PermitMagicLinkForPasswordUsers),
+            _ => None,
+        }
+    }
 }

 /// Rate limiting and brute-force protection configuration.
@@ -549,10 +663,29 @@ impl Default for AuthConfig {
            hash_parallelism: 2,
            rate_limit: RateLimitConfig::default(),
            registration_allowed_email_domains: Vec::new(),
+            auth_policies: Vec::new(),
+            allowed_auth_methods: vec![AuthMethod::Password, AuthMethod::MagicLink],
+            require_verified_email: false,
        }
    }
 }

+impl AuthConfig {
+    /// True iff `method` is enabled (or the allowlist is empty — meaning
+    /// "all methods allowed", matching pre-`OXICLOUD_AUTH_METHODS`
+    /// behaviour when the operator hasn't opted in yet).
+    pub fn is_method_allowed(&self, method: AuthMethod) -> bool {
+        self.allowed_auth_methods.is_empty() || self.allowed_auth_methods.contains(&method)
+    }
+
+    /// True iff `policy` has been opted into via `OXICLOUD_AUTH_POLICIES`
+    /// (or its legacy alias). Default policies are OFF — the vector is
+    /// additive only, no invert / defaults.
+    pub fn has_policy(&self, policy: AuthPolicy) -> bool {
+        self.auth_policies.contains(&policy)
+    }
+}
+
 /// OpenID Connect (OIDC) configuration
 #[derive(Debug, Clone)]
 pub struct OidcConfig {
@@ -1550,6 +1683,96 @@ impl AppConfig {
                .collect();
        }

+        // Self-service auth-method allowlist. Empty (unset) = both methods
+        // allowed. Unknown tokens are logged-and-skipped; a completely
+        // unparseable value falls back to the default rather than locking
+        // the operator out. If the resulting list is empty (e.g. the
+        // operator wrote `OXICLOUD_AUTH_METHODS=nope`), we restore the
+        // default — a zero-method allowlist would refuse every login.
+        if let Ok(v) = env::var("OXICLOUD_AUTH_METHODS") {
+            let methods: Vec<AuthMethod> = v
+                .split(',')
+                .filter_map(|s| {
+                    let parsed = AuthMethod::parse(s);
+                    if parsed.is_none() && !s.trim().is_empty() {
+                        eprintln!(
+                            "⚠️  OXICLOUD_AUTH_METHODS: ignoring unknown token '{}' \
+                             (expected: password, magic_link)",
+                            s.trim()
+                        );
+                    }
+                    parsed
+                })
+                .collect();
+            if methods.is_empty() {
+                eprintln!(
+                    "⚠️  OXICLOUD_AUTH_METHODS parsed to an empty allowlist; \
+                     falling back to default (password, magic_link)"
+                );
+            } else {
+                config.auth.allowed_auth_methods = methods;
+            }
+        }
+
+        // Legacy alias: OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true still
+        // removes Password from the allowlist. Its main handling in the
+        // OIDC config block below is preserved for the `login_options`
+        // response; this line makes the effect apply uniformly through
+        // `is_method_allowed(Password)` so services don't need to check
+        // both flags.
+        if let Ok(v) = env::var("OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN")
+            && v.parse::<bool>().unwrap_or(false)
+        {
+            config
+                .auth
+                .allowed_auth_methods
+                .retain(|m| *m != AuthMethod::Password);
+        }
+
+        if let Ok(v) = env::var("OXICLOUD_REQUIRE_VERIFIED_EMAIL") {
+            config.auth.require_verified_email = v.parse::<bool>().unwrap_or(false);
+        }
+
+        // Auth-policy vector. Additive — each recognised token adds a
+        // variant; unknown tokens are logged-and-skipped so a typo
+        // doesn't silently zero the whole vector (an operator wanting
+        // "no policies" simply doesn't set the env var).
+        //
+        // The legacy alias
+        // `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true` is applied
+        // AFTER this block (see the MagicLinkConfig section below) so a
+        // deployment setting BOTH env vars ends up with a single copy
+        // of `PermitMagicLinkForPasswordUsers` regardless of order.
+        if let Ok(v) = env::var("OXICLOUD_AUTH_POLICIES") {
+            for token in v.split(',') {
+                match AuthPolicy::parse(token) {
+                    Some(policy) => {
+                        if !config.auth.auth_policies.contains(&policy) {
+                            config.auth.auth_policies.push(policy);
+                        }
+                    }
+                    None if !token.trim().is_empty() => {
+                        eprintln!(
+                            "⚠️  OXICLOUD_AUTH_POLICIES: ignoring unknown token '{}' \
+                             (known: permit_magic_link_for_password_users)",
+                            token.trim()
+                        );
+                    }
+                    None => {}
+                }
+            }
+            // Reflect the vector into the legacy magic_link config field
+            // so `magic_link_eligibility()` (the site that reads the
+            // boolean today) doesn't need to know about the new form.
+            if config
+                .auth
+                .auth_policies
+                .contains(&AuthPolicy::PermitMagicLinkForPasswordUsers)
+            {
+                config.magic_link.open_to_password_users = true;
+            }
+        }
+
        // Feature flags
        if let Ok(enable_auth) = env::var("OXICLOUD_ENABLE_AUTH").map(|v| v.parse::<bool>())
            && let Ok(val) = enable_auth
@@ -2114,8 +2337,29 @@ impl AppConfig {
        {
            config.magic_link.send_per_ip_per_hour = n;
        }
+        // Legacy alias — writes the same effect as
+        // `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`.
+        // Warn once at boot so operators know to migrate before we drop
+        // the old var. Kept indefinitely for compat, but the encouraged
+        // form is the vector.
        if let Ok(v) = env::var("OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS") {
-            config.magic_link.open_to_password_users = v == "true" || v == "1";
+            let enabled = v == "true" || v == "1";
+            config.magic_link.open_to_password_users = enabled;
+            if enabled
+                && !config
+                    .auth
+                    .auth_policies
+                    .contains(&AuthPolicy::PermitMagicLinkForPasswordUsers)
+            {
+                config
+                    .auth
+                    .auth_policies
+                    .push(AuthPolicy::PermitMagicLinkForPasswordUsers);
+            }
+            eprintln!(
+                "⚠️  OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS is deprecated. \
+                 Use `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users` instead."
+            );
        }
        if let Ok(v) = env::var("OXICLOUD_NOTIFY_INTERNAL_USERS_ON_SHARE") {
            config.magic_link.notify_internal_users_on_share = v == "true" || v == "1";
@@ -52,6 +52,14 @@ pub async fn create_auth_services(
    // direct FolderService dependency for that path.
    auth_app_service = auth_app_service.with_user_lifecycle(user_lifecycle);

+    // Wire the auth-method allowlist + email-verification requirement so
+    // login / magic-link / register handlers consult a single snapshot
+    // rather than reaching into the app config on every call.
+    auth_app_service = auth_app_service.with_auth_policy(
+        config.auth.allowed_auth_methods.clone(),
+        config.auth.require_verified_email,
+    );
+
    // Wire the magic-link token repo. Enables `GET /magic/v1/{token}`
    // and the future `POST /api/auth/magic-link/send` endpoint to mint
    // and consume tokens. The repo is unconditional (it's just SQL on
@@ -127,21 +127,37 @@ pub async fn register(
        }
    };

-    // Block password registration when OIDC-only mode is active.
-    // Email-only signup still works in OIDC-only mode (no password
-    // stored; the user authenticates via magic-link).
+    // Block password registration when the policy forbids password
+    // logins (OIDC-only mode OR `OXICLOUD_AUTH_METHODS` allowlist
+    // without `password`). Email-only signup still works — the user
+    // authenticates via magic-link or SSO on their first visit.
    if dto.password.is_some()
-        && auth_service
+        && !auth_service
            .auth_application_service
-            .password_login_disabled()
+            .is_password_login_allowed()
    {
        return Err(AppError::new(
            StatusCode::FORBIDDEN,
-            "Password registration is disabled. Please use SSO/OIDC to sign in.",
+            "Password registration is disabled by policy.",
            "PasswordRegistrationDisabled",
        ));
    }

+    // Symmetric guard: when magic-link is off, an email-only signup has
+    // no path to a session (there's no token to click). Refuse rather
+    // than silently succeed and leave the user with an unusable account.
+    if dto.password.is_none()
+        && !auth_service
+            .auth_application_service
+            .is_magic_link_login_allowed()
+    {
+        return Err(AppError::new(
+            StatusCode::FORBIDDEN,
+            "Email-only registration requires magic-link login, which is disabled.",
+            "MagicLinkLoginDisabled",
+        ));
+    }
+
    // Admin disabled public registration globally — surface 403.
    if let Some(admin_svc) = state.admin_settings_service.as_ref()
        && !admin_svc.get_registration_enabled().await
@@ -351,13 +367,19 @@ pub async fn login(
        ));
    }

-    // Check if password login is disabled (OIDC-only mode)
-    if auth_service
+    // Check if password login is allowed (composes the legacy OIDC-only
+    // flag with the newer `OXICLOUD_AUTH_METHODS` allowlist). When
+    // disabled, return `PasswordLoginDisabled` so the SPA can hide the
+    // password field and surface the available fallback (magic-link or
+    // SSO) instead of showing a generic "invalid credentials".
+    if !auth_service
        .auth_application_service
-        .password_login_disabled()
+        .is_password_login_allowed()
    {
-        return Err(AppError::unauthorized(
-            "Password login is disabled. Please use SSO/OIDC to sign in.",
+        return Err(AppError::new(
+            StatusCode::FORBIDDEN,
+            "Password login is disabled by policy.",
+            "PasswordLoginDisabled",
        ));
    }

@@ -425,6 +447,55 @@ pub async fn login(
                .login_lockout
                .record_failure(&dto.username, &client_ip);
            tracing::error!("Login failed for user {}: {}", dto.username, err);
+            // Remap the `require_verified_email` refusal (message
+            // string comes from AuthApplicationService::login) into a
+            // distinguished error_type and, critically, PIGGYBACK a
+            // verification link on the successful-password proof: the
+            // caller just showed they know the password, so we can
+            // safely mint a verification magic-link for their address
+            // without going through the anti-enum-fronted
+            // `magic-link/send` (which would refuse `has_password`).
+            //
+            // This branch is reached ONLY when the password validated
+            // successfully — the service checks `require_verified_email`
+            // AFTER the password check specifically so an attacker
+            // without the password can't discover an account's
+            // verification state from the response shape.
+            if err.message == "Email not verified" {
+                // Best-effort auto-send. We swallow any error and still
+                // return the same EmailNotVerified response — the
+                // frontend hint ("check your inbox") doubles as the
+                // resend affordance if delivery didn't land.
+                if let Some(invite_svc) = state.magic_link_invite_service.as_ref() {
+                    // Re-look up the user by identifier (mirrors the
+                    // service's login dispatch) to get the User entity
+                    // that the verification helper needs. On any
+                    // lookup failure we skip the send — attacker never
+                    // sees the difference.
+                    let lookup = if dto.username.contains('@') {
+                        auth_service
+                            .auth_application_service
+                            .find_user_by_email(&dto.username)
+                            .await
+                    } else {
+                        auth_service
+                            .auth_application_service
+                            .find_user_by_username(&dto.username)
+                            .await
+                    };
+                    if let Ok(user) = lookup {
+                        let challenge = cookie_auth::generate_magic_request_challenge();
+                        let _ = invite_svc
+                            .send_verification_link_authenticated(&user, &challenge)
+                            .await;
+                    }
+                }
+                return Err(AppError::new(
+                    StatusCode::FORBIDDEN,
+                    "Your email is not verified. We sent a verification link to your inbox.",
+                    "EmailNotVerified",
+                ));
+            }
            Err(err.into())
        }
    }
@@ -870,12 +941,22 @@ pub async fn oidc_providers(

    let auth_app = &auth_service.auth_application_service;

+    // Policy questions the SPA needs to decide which forms to render.
+    // `is_magic_link_login_allowed()` composes SMTP wiring + allowlist +
+    // the "OIDC master → no magic-link login" hard rule; the login page
+    // shows the magic-link tab iff this is true.
+    let password_login_enabled = auth_app.is_password_login_allowed();
+    let magic_link_login_enabled = auth_app.is_magic_link_login_allowed();
+    let require_verified_email = auth_app.require_verified_email();
+
    if !auth_app.oidc_enabled() {
        return Ok(Json(OidcProviderInfoDto {
            enabled: false,
            provider_name: String::new(),
            authorize_endpoint: String::new(),
-            password_login_enabled: true,
+            password_login_enabled,
+            magic_link_login_enabled,
+            require_verified_email,
        }));
    }

@@ -885,7 +966,9 @@ pub async fn oidc_providers(
        enabled: true,
        provider_name: config.provider_name.clone(),
        authorize_endpoint: "/api/auth/oidc/authorize".to_string(),
-        password_login_enabled: !config.disable_password_login,
+        password_login_enabled,
+        magic_link_login_enabled,
+        require_verified_email,
    }))
 }

@@ -1127,6 +1210,21 @@ pub async fn send_magic_link(
        ));
    };

+    // Policy: `OXICLOUD_AUTH_METHODS` may forbid magic-link login even
+    // when SMTP is wired (an operator might want the invite path — used
+    // by admins to seed accounts — without offering it as a login
+    // fallback). Refuse with the same anti-enum shape as any other
+    // policy-gated endpoint.
+    if let Some(auth) = state.auth_service.as_ref()
+        && !auth.auth_application_service.is_magic_link_login_allowed()
+    {
+        return Err(AppError::new(
+            StatusCode::FORBIDDEN,
+            "Magic-link login is disabled by policy.",
+            "MagicLinkLoginDisabled",
+        ));
+    }
+
    // Authentication signal — presence (not validity) of Bearer header
    // OR access cookie. We deliberately don't decode the JWT here: a
    // stale-cookie holder gets a 401 from any other endpoint they
@@ -1164,6 +1262,26 @@ pub async fn send_magic_link(
        )
    })?;

+    // Login-identifier resolution. The DTO field is named `email` for
+    // backwards-compat, but the value may be either an email address or
+    // a username — dispatch matches the `POST /api/auth/login`
+    // convention (`@` present → email, else → username). Username
+    // lookups happen BEFORE rate-limiting so `alice` and
+    // `alice@example.com` bucket on the same key; without this,
+    // alternating shapes would double the effective per-email budget.
+    //
+    // Anti-enum: username misses fall through to `body.email` unchanged
+    // and land in the malformed_email / no_account branches downstream,
+    // both of which return the uniform 200 with an audit line.
+    let resolved_email = if let Some(auth) = state.auth_service.as_ref() {
+        auth.auth_application_service
+            .resolve_login_identifier_to_email(&body.email)
+            .await
+            .unwrap_or_else(|| body.email.clone())
+    } else {
+        body.email.clone()
+    };
+
    // Per-request browser-binding challenge (PR 22). Generated for
    // every request and set as a cookie on every 200 response —
    // including the silent-rate-limit paths — so the cookie's
@@ -1211,8 +1329,11 @@ pub async fn send_magic_link(
        // casing/IDN-host tricks don't multiply the budget. Malformed
        // addresses skip this check and fall through to the service,
        // which records its own audit entry under reason="malformed_email".
+        // Buckets on the RESOLVED email (post-username lookup) so
+        // username and email inputs for the same account share one
+        // budget — see resolve_login_identifier_to_email() above.
        if let Ok(normalised) =
-            crate::domain::services::email_normalize::normalize_email(&body.email)
+            crate::domain::services::email_normalize::normalize_email(&resolved_email)
            && state
                .magic_link_send_per_email_rate_limiter
                .check_and_increment(&normalised)
@@ -1232,8 +1353,12 @@ pub async fn send_magic_link(
    // The service swallows every operational outcome and logs the truth
    // via the audit channel; we surface only an internal error (DB down,
    // etc.). Anti-enumeration means we always return the same body.
+    // We pass the resolved email — if the caller sent a username, the
+    // service sees the corresponding address; if the caller sent a
+    // bare unknown identifier, the service still audits it as
+    // malformed_email / no_account.
    invite_svc
-        .send_login_link(&body.email, &challenge)
+        .send_login_link(&resolved_email, &challenge)
        .await
        .map_err(AppError::from)?;

@@ -574,24 +574,32 @@ fn build_success_response(state: &Arc<AppState>, redemption: MagicLinkRedemption
    response
 }

-/// Build the SPA hash-route the redemption should land on. Mirrors the
-/// front-end's `deserializeHash()` parser at `static/js/app/main.js`.
+/// Build the SPA route the redemption should land on.
 ///
-/// - **Resource token** (folder invitation): deep-link to the resource.
-/// - **NULL-resource token + external user**: land on `/#/sharedwithme`
+/// - **Resource token** (folder invitation): deep-link into the folder
+///   view. SvelteKit `files/[...path]` accepts folder IDs as path
+///   segments (see `frontend/src/routes/files/[...path]/+page.svelte`
+///   — `goto(resolve(`/files/${folder.id}`))`).
+/// - **NULL-resource token + external user**: land on `/shared-with-me`
 ///   (their entry point — they own no folders themselves).
-/// - **NULL-resource token + internal user**: land on `/#/files` (the
+/// - **NULL-resource token + internal user**: land on `/files` (the
 ///   user has a home folder; the "shared with me" view would be empty
 ///   on first signup, so home is the better welcome). Internal users
 ///   on NULL-resource tokens come from the email-only-signup welcome
 ///   path (PR 18) or from a magic-link they requested themselves
 ///   while password-eligible-and-lenient-mode (PR 19).
+///
+/// Historical: pre-SvelteKit these were hash routes
+/// (`/#/files`, `/#/sharedwithme`, `/#/files/folder/{id}`) served by the
+/// legacy vanilla frontend. Landing on those now serves the legacy
+/// shell (with old meta-CSP + inline scripts) instead of the SPA and
+/// triggers a CSP violation on modern deployments.
 fn redirect_target(redemption: &MagicLinkRedemption) -> String {
    match (redemption.resource_kind, redemption.resource_id) {
        (Some(MagicLinkResourceKind::Folder), Some(folder_id)) => {
-            format!("/#/files/folder/{}", folder_id)
+            format!("/files/{}", folder_id)
        }
-        _ if redemption.auth.user.is_external => "/#/sharedwithme".to_string(),
-        _ => "/#/files".to_string(),
+        _ if redemption.auth.user.is_external => "/shared-with-me".to_string(),
+        _ => "/files".to_string(),
    }
 }
@@ -285,6 +285,33 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
    // Load configuration from environment variables
    let config = common::config::AppConfig::from_env();

+    // SECURITY: fail-closed on incoherent auth-method configuration. A
+    // magic-link-only policy without a working SMTP sender locks every
+    // user out — nothing can mint tokens, so nobody can log in. Refuse
+    // to start rather than boot into a bricked auth surface.
+    //
+    // The SMTP-mock (`OXICLOUD_SMTP_MOCK=true` in `tests/common/server.env`)
+    // sets `OXICLOUD_SMTP_HOST=localhost`, so `is_enabled()` returns
+    // true and the Hurl test harness satisfies this gate without a real
+    // mail server.
+    if config
+        .auth
+        .allowed_auth_methods
+        .contains(&common::config::AuthMethod::MagicLink)
+        && !config
+            .auth
+            .allowed_auth_methods
+            .contains(&common::config::AuthMethod::Password)
+        && !config.smtp.is_enabled()
+    {
+        panic!(
+            "FATAL: OXICLOUD_AUTH_METHODS enables `magic_link` as the ONLY \
+             self-service auth method, but no SMTP transport is configured. \
+             Set OXICLOUD_SMTP_HOST (and matching OXICLOUD_SMTP_* settings) \
+             or add `password` to OXICLOUD_AUTH_METHODS. Refusing to start."
+        );
+    }
+
    // Surface the upload-size limits at startup. Operators (and the
    // CI runner) need to see what's actually in effect — a silent
    // fallback to the 100 MB default when `OXICLOUD_CHUNK_MAX_BYTES`
@@ -82,3 +82,26 @@ Content-Type: application/json
 { "username": "ghost@nowhere.invalid", "password": "{{password}}" }

 HTTP 403
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 7 — /api/auth/oidc/providers advertises the auth-method
+#           policy the SPA needs to render the correct forms.
+#
+# tests/common/server.env has OXICLOUD_OIDC_ENABLED=false,
+# OXICLOUD_SMTP_MOCK=true (so SMTP is "wired"), and the default
+# OXICLOUD_AUTH_METHODS (both methods allowed). Expected shape:
+#   enabled: false                  — no OIDC IdP configured
+#   password_login_enabled: true    — default allowlist includes it
+#   magic_link_login_enabled: true  — SMTP wired + allowlist + no OIDC
+#   require_verified_email: false   — default
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/auth/oidc/providers
+
+HTTP 200
+[Asserts]
+jsonpath "$.enabled" == false
+jsonpath "$.password_login_enabled" == true
+jsonpath "$.magic_link_login_enabled" == true
+jsonpath "$.require_verified_email" == false
+
@@ -0,0 +1,162 @@
+# =============================================================
+# OxiCloud — magic-link login for password users
+# =============================================================
+# Regression pin for the `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`
+# switch. Default eligibility ladder refuses `has_password` accounts
+# (the strict argument: mailbox-strength shouldn't shadow the stronger
+# credential). Operators who prefer modern-SaaS UX opt-in via this
+# policy; when set, `POST /api/auth/magic-link/send` mints a login token
+# for accounts that also have a password.
+#
+# Cross-file coupling: `tests/common/server.env` sets
+# `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`. Without
+# it, Step 2 below would land on `reason="has_password"` and mail nothing
+# — Step 3's SMTP capture would fail with an empty inbox.
+#
+# What is NOT exercised here:
+#   * OIDC-master rule: covered separately in tests/oidc/oidc.hurl
+#     step 2b (magic-link SEND refused when OIDC is enabled).
+#   * `has_password` rejection under the strict default: can't be
+#     exercised in the same run — the env is global. Rust unit test
+#     on `magic_link_eligibility()` covers it directly.
+# =============================================================
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 1 — Admin login. Needed to reach the mock-SMTP capture
+#          endpoint (admin-scoped: /api/admin/smtp/test/captured).
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "{{username}}", "password": "{{password}}" }
+
+HTTP 200
+[Captures]
+alice_token: jsonpath "$.access_token"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 2 — Baseline: admin logs in normally with a password.
+#          Confirms nothing about the policy has broken the
+#          classic path. Same call as Step 1, kept as a
+#          named baseline for readers of the test log.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "{{username}}", "password": "{{password}}" }
+
+HTTP 200
+[Asserts]
+jsonpath "$.access_token" exists
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 3 — Request a magic-link for the SAME user via email.
+#          Anti-enum uniform 200 regardless of eligibility, so
+#          the real proof of "policy fired, mail actually sent"
+#          is the SMTP capture in Step 5. Without the policy
+#          in server.env, this same request would be refused
+#          under `reason="has_password"` and no mail would be
+#          captured.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/magic-link/send
+Content-Type: application/json
+{ "email": "{{email}}" }
+
+HTTP 200
+[Asserts]
+jsonpath "$.message" contains "sign-in link"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 4 — Same request, but with the LOGIN-IDENTIFIER passed
+#          as a username (no `@`). Server dispatches on `@` and
+#          resolves the username to the registered email BEFORE
+#          rate-limiting, so `admin` and `admin@example.com`
+#          bucket on one budget. Uniform 200 either way.
+#
+#          The browser-binding challenge cookie is captured HERE
+#          (not on Step 3): each `/send` request mints a fresh
+#          challenge, and Step 5 will fetch the MOST RECENT mail —
+#          which was minted by this very request. Capturing from
+#          Step 3 instead would pair a stale cookie with Step 4's
+#          token, and Step 6's redemption would land on PR 22's
+#          cross-browser confirmation page (200 HTML) instead of
+#          the direct 302.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/magic-link/send
+Content-Type: application/json
+{ "email": "{{username}}" }
+
+HTTP 200
+[Asserts]
+jsonpath "$.message" contains "sign-in link"
+[Captures]
+alice_magic_cookie: header "set-cookie" regex "oxicloud_magic_request=([^;]+)"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 5 — Capture the mail. The mock SMTP records every
+#          outbound message keyed on the recipient. Two magic-
+#          link mails should have landed (steps 3 and 4), both
+#          addressed to the admin's registered email. The
+#          captured endpoint returns the MOST RECENT one — we
+#          extract its link.
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/admin/smtp/test/captured?to={{email}}
+Authorization: Bearer {{alice_token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$.to" == "{{email}}"
+jsonpath "$.text_body" matches "/magic/v1/[A-Za-z0-9_-]+"
+[Captures]
+alice_magic_url: jsonpath "$.text_body" regex "(https?://[^\\s]+/magic/v1/[A-Za-z0-9_-]+)"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 6 — Redeem the link with the matching browser-binding
+#          cookie. Internal user, no resource target → lands
+#          on `/files` (SPA route). Access-token cookie is set
+#          on the redirect response.
+# ─────────────────────────────────────────────────────────────
+GET {{alice_magic_url}}
+Cookie: oxicloud_magic_request={{alice_magic_cookie}}
+
+HTTP 302
+[Asserts]
+header "Location" == "/files"
+[Captures]
+alice_magic_access_token: cookie "oxicloud_access"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 7 — The cookie session works: /api/auth/me returns the
+#          admin's own profile. Proves the magic-link redemption
+#          created a real session for the password-holding user
+#          — the point of the whole `permit_magic_link_for_password_users`
+#          policy.
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/auth/me
+Authorization: Bearer {{alice_magic_access_token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$.email" == "{{email}}"
+jsonpath "$.username" == "{{username}}"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 8 — Anti-enum sanity: magic-link for a non-existent
+#          identifier. Same uniform 200 shape, no mail sent.
+#          The audit log records reason="no_account" — not
+#          observable from the client, but the response shape
+#          is IDENTICAL to Step 3, which is the whole point.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/magic-link/send
+Content-Type: application/json
+{ "email": "ghost-user-that-doesnt-exist" }
+
+HTTP 200
+[Asserts]
+jsonpath "$.message" contains "sign-in link"
@@ -159,7 +159,11 @@ GET {{magic_url}}

 HTTP 302
 [Asserts]
-header "Location" == "/#/files/folder/{{ext_folder_id}}"
+# SvelteKit `files/[...path]` accepts a folder ID as a path segment.
+# Historical value pre-migration was `/#/files/folder/{id}` (legacy
+# vanilla-frontend hash-routing). Kept in sync with the redemption
+# handler in src/interfaces/api/handlers/magic_link_handler.rs.
+header "Location" == "/files/{{ext_folder_id}}"
 [Captures]
 bob_access_token: cookie "oxicloud_access"

@@ -240,9 +244,15 @@ HTTP 200
 [Asserts]
 jsonpath "$.id" == "{{alice_user_id}}"
 jsonpath "$.is_external" == false
-# PR 23 — alice is the admin set up via classic password registration
-# and has never clicked a magic-link, so her email is unverified.
-jsonpath "$.email_verified_at" not exists
+# Setup admin is auto-verified at creation. `setup_create_admin` stamps
+# `email_verified_at = NOW()` — admin fiat counts as verification,
+# matching the OIDC-JIT convention. Rationale: an operator running the
+# first-run wizard is authoritative by construction (they set the
+# password at the console on a fresh install). Without this, flipping
+# `OXICLOUD_REQUIRE_VERIFIED_EMAIL=true` on an existing deployment
+# would lock the sole admin out of their own instance. The admin login
+# exemption is a second layer of defense; this stamp is the primary.
+jsonpath "$.email_verified_at" exists

 # 11e — bob CANNOT enumerate unrelated users. A random UUID returns 404
 #        (anti-enumeration; same response as "user doesn't exist").
@@ -350,7 +360,7 @@ jsonpath "$.message" contains "sign-in link"

 # 15b — Capture the fresh email; extract the NEW magic-link URL.
 #       This is a NULL-resource token (login flow), so redemption
-#       will land on /#/sharedwithme rather than a deep-link.
+#       will land on /shared-with-me rather than a deep-link.
 GET {{base_url}}/api/admin/smtp/test/captured?to=bob@externalcompany.com
 Authorization: Bearer {{alice_token}}

@@ -376,13 +386,17 @@ body contains "different browser"
 # 15c-ii — Same token, with `?confirm=1` to acknowledge the
 #          cross-browser redemption. PR 22 audit-logs
 #          `cross_browser_confirmed=true` on the success line.
-#          Lands on /#/sharedwithme since the token has no
-#          resource target.
+#          Lands on /shared-with-me since the token has no
+#          resource target (external user, NULL resource_kind).
 GET {{login_magic_url}}?confirm=1

 HTTP 302
 [Asserts]
-header "Location" == "/#/sharedwithme"
+# SvelteKit route (path-based). Historical value pre-migration was
+# `/#/sharedwithme` (legacy vanilla-frontend hash-routing). Kept in
+# sync with `redirect_target()` in
+# src/interfaces/api/handlers/magic_link_handler.rs.
+header "Location" == "/shared-with-me"
 [Captures]
 bob_relogin_token: cookie "oxicloud_access"

@@ -408,10 +422,15 @@ Authorization: Bearer {{alice_token}}
 HTTP 404

 # 15f — Email maps to an existing internal user with a password
-#        (Alice the admin) → uniform 200 but the magic link is NOT
-#        actually sent. has_login_credential() short-circuits the
-#        service so password/OIDC accounts cannot be bypassed via
-#        mailbox ownership at the moment of request.
+#        (Alice the admin). The test env has
+#        `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`
+#        set globally in `tests/common/server.env`, so the `has_password`
+#        eligibility check is bypassed and the link IS minted. Under
+#        the STRICT default (policy absent), the eligibility ladder
+#        would refuse with `reason="has_password"` and no mail would
+#        ship — that path is covered by a Rust unit test on
+#        `magic_link_eligibility()` because it needs the opposite env
+#        which we can't hot-swap mid-run.
 POST {{base_url}}/api/auth/magic-link/send
 Content-Type: application/json
 { "email": "{{email}}" }
@@ -420,10 +439,15 @@ HTTP 200
 [Asserts]
 jsonpath "$.message" contains "sign-in link"

+# With the permit policy, a mail WAS captured. Rate-limit slot burned
+# either way (increment fires before eligibility) — Step 16's math
+# still holds.
 GET {{base_url}}/api/admin/smtp/test/captured?to={{email}}
 Authorization: Bearer {{alice_token}}

-HTTP 404
+HTTP 200
+[Asserts]
+jsonpath "$.to" == "{{email}}"


 # ─────────────────────────────────────────────────────────────
@@ -5,8 +5,8 @@
 # `POST /api/auth/register`. Email-only signup:
 #   - returns a uniform 200 message (no JWT, no UserDto)
 #   - mints a welcome magic-link mailed to `email`
-#   - redemption lands the new internal user on `/#/files`
-#     (not `/#/sharedwithme`, which is for externals)
+#   - redemption lands the new internal user on `/files`
+#     (not `/shared-with-me`, which is for externals)
 #
 # Requires `OXICLOUD_SMTP_MOCK=true` (set in tests/common/server.env).
 # =============================================================
@@ -111,14 +111,19 @@ body contains "different browser"
 # Step 5b — Same link, this time with the matching cookie.
 #           PR 22 binds the magic-link to the requesting browser;
 #           a matching cookie redeems instantly. Internal user
-#           with no resource target → lands on `/#/files`.
+#           with no resource target → lands on `/files`.
 # ─────────────────────────────────────────────────────────────
 GET {{pr18_magic_url}}
 Cookie: oxicloud_magic_request={{pr18_magic_cookie}}

 HTTP 302
 [Asserts]
-header "Location" == "/#/files"
+# SPA route (SvelteKit path-based). Historical value pre-migration was
+# `/#/files` (legacy vanilla frontend hash-routing). Changed alongside
+# the migration off the legacy shell — landing on the hash route now
+# serves the legacy `static/index.html` with its meta-CSP inline
+# scripts, which the SPA CSP blocks.
+header "Location" == "/files"
 [Captures]
 pr18_access_token: cookie "oxicloud_access"

@@ -147,6 +147,7 @@ hurl --variables-file "$API_DIR/test.env" --file-root "$REPO_ROOT/tests" --test
  "$API_DIR/setup.hurl" \
  "$API_DIR/auth_login.hurl" \
  "$API_DIR/auth_session_lifecycle.hurl" \
+  "$API_DIR/auth_magic_link_login.hurl" \
  "$API_DIR/registration.hurl" \
  "$API_DIR/nc_status_capabilities.hurl" \
  "$API_DIR/nc_login_flow_v2.hurl" \
@@ -39,6 +39,19 @@ OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
 OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
 OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0

+# Mock SMTP — same block as server.env. Required so `magic-link/send`
+# reaches the policy gate (returns 403 MagicLinkLoginDisabled under the
+# OIDC-master rule) instead of short-circuiting to 503 ServiceUnavailable
+# because the invite service is unconfigured. The captured-mail endpoint
+# is still available even when magic-link login is refused — invitations
+# to non-OIDC recipients still route through this transport.
+OXICLOUD_SMTP_MOCK=true
+OXICLOUD_SMTP_HOST=localhost
+OXICLOUD_SMTP_PORT=25
+OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
+OXICLOUD_SMTP_TLS=none
+OXICLOUD_ALLOW_EXTERNAL_USERS=true
+
 # ── OIDC client wired at the fake-idp sidecar ──────────────────────────────
 # tests/oidc/fake_idp/server.js (panva/node-oidc-provider) publishes the
 # issuer at the root URL; discovery is at /.well-known/openid-configuration
@@ -66,3 +79,6 @@ OXICLOUD_OIDC_PROVIDER_NAME=MockSSO
 # match. This is the standard Authentik/Keycloak/Entra pattern: an
 # IdP group becomes an OxiCloud role.
 OXICLOUD_OIDC_ADMIN_GROUPS=admin-users
+
+OXICLOUD_AUTH_METHODS=password,magic_link
+OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
@@ -79,6 +79,21 @@ OXICLOUD_ALLOW_EXTERNAL_USERS=true
 # outside it deliberately.
 OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=example.com,example.test

+# Auth-policy vector. Enables the "magic-link login is allowed for
+# accounts that also have a password" branch — required by
+# auth_magic_link_login.hurl (alice has a password AND requests a
+# magic-link login). Inert for every other test: `has_password`
+# refusal only fires when the endpoint is called, and no other file
+# calls `magic-link/send` for a password-holding account.
+OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users
+OXICLOUD_AUTH_METHODS=password,magic_link
+# Explicit pin — `--config` now overrides shell env (main.rs uses
+# `from_filename_override`), but pinning here documents the intended
+# test-env state. Flip to true for the deferred `tests/verify_email/`
+# suite; leaving false here keeps every other suite on the "verified
+# email not required" path (charlie's classic register+login etc.).
+OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
+
 # PR 12 — magic-link rate-limit caps lowered so external_users.hurl can
 # exercise the cap behaviour with a small, deterministic request count.
 # Production defaults are 50 / 5 / 200 respectively (see example.env).
@@ -69,6 +69,31 @@ jsonpath "$.enabled" == true
 jsonpath "$.provider_name" == "MockSSO"
 jsonpath "$.authorize_endpoint" == "/api/auth/oidc/authorize"
 jsonpath "$.password_login_enabled" == true
+# OIDC-master rule: magic-link login must be reported as OFF when OIDC
+# is enabled, regardless of `OXICLOUD_AUTH_METHODS` or SMTP wiring.
+# Magic-link would bypass any 2FA / step-up the IdP enforces; refusing
+# it at the deployment level is a hard invariant. The SPA reads this
+# to hide the "Send sign-in link" affordance.
+jsonpath "$.magic_link_login_enabled" == false
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 2b — OIDC-master rule regression at the endpoint layer.
+#           `POST /api/auth/magic-link/send` is refused with 403
+#           `MagicLinkLoginDisabled` when OIDC is enabled. The
+#           mock SMTP is configured (server-with-oidc.env has the
+#           full SMTP block) so this proves the policy gate fires
+#           BEFORE the "SMTP not wired" 503, which would otherwise
+#           mask the real reason. The 403 error_type is the machine-
+#           readable contract the SPA switches on.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/magic-link/send
+Content-Type: application/json
+{ "email": "someone@example.com" }
+
+HTTP 403
+[Asserts]
+jsonpath "$.error_type" == "MagicLinkLoginDisabled"


 # ─────────────────────────────────────────────────────────────