---
id: w4/m7/t004
title: "E2E on mock: recovery end-to-end via Mailpit API + verification email on signup"
worker: worker4
status: done
estimate: 40m
depends_on: [w4/m7/t003]
---

## Objective

Script the proof (exit 0 = pass, in the mold of `scripts/auth-e2e.sh`): create an identity, trigger the recovery flow, pull the recovery code/link from Mailpit's HTTP API, complete the reset through Kratos's public API, log in with the new password; then prove a fresh signup produces a verification email and completing it marks the address verified.

## Context

- **Precondition (2026-07-11):** a fresh mock sync leaves the auth substrate Pending — post-m19 base values pin it to `bex.co/pool=platform`, which no CAPD mock node carries; blocked on the `w1` inbox note on mock pool-labels, or retarget this verification at prod (with a real SendGrid inbox instead of Mailpit assertions).
- Kratos self-service recovery via the public API (browser/API flows) — drive the API flow so no real browser is needed; the dashboard pages are verified separately in t005. Verification is proven **here, via the API flow** — the dashboard has no `auth.verification` route (README 2026-07-11 note).
- Mailpit HTTP API: list/search messages, read bodies — extract the code with `jq`/grep.
- Existing harness: `scripts/auth-e2e.sh` (m2/m3) — extend it or add `scripts/auth-mail-e2e.sh`; port-forwards to cluster-internal services, never prints secrets.

## Steps

1. Write the recovery scenario: admin-create identity → submit recovery → poll Mailpit → extract code → complete reset → login succeeds with the new password, fails with the old.
2. Write the verification scenario: registration → verification mail arrives → complete → identity's address shows `verified: true` via the admin API.
3. Run green on the mock cluster from a clean sync (see precondition).
4. Optional (closes w4/m12's delivery gap): once t005 wires `BEX_SMTP_*` into bex-api, assert a workspace-invite email lands in Mailpit too.

## Files

- `scripts/auth-e2e.sh` (extend) or `scripts/auth-mail-e2e.sh` (new)

## Acceptance criteria

- [ ] Script exits 0 on the mock cluster covering both scenarios, including the negative check (old password rejected after reset).
- [ ] No secret values or mail contents beyond what the assertions need in output.

## Out of scope

- Dashboard-page (browser) verification — t005.
