---
name: ai-shifu/user-auth-flows
source: https://app.decimal.ai/s/ai-shifu-user-auth-flows@1/SKILL.md
source_sha256: 7dba7b1fb025
---

# User Auth Flows

## Core Rules

- Keep repository, token-store, and auth-factory paths as the source of truth.
- Preserve verification-code consumption semantics and retry safety.
- Update frontend-facing auth payloads together with backend persistence logic.

## Workflow

1. Start from `repository.py`, `token_store.py`, `auth/factory.py`, and the
   specific flow file such as `email_flow.py` or `phone_flow.py`.
2. Confirm whether the change affects credentials, tokens, temp users, or
   provider dispatch.
3. Update validation and persistence together; avoid one-sided changes in route
   or provider code.
4. Add or update tests under `src/api/tests/service/user/`.

## Regression Checklist

- Happy-path login or verification.
- Retry or duplicate submission path.
- Invalid or expired verification code.
- Token persistence and logout semantics when affected.