From 6b3866a99f3f5c100a754ab3aa5b0383ec800083 Mon Sep 17 00:00:00 2001
From: DebaucheryLibrarian <DebaucheryLibrarian@unknown.name>
Date: Thu, 23 Jul 2026 22:12:33 +0200
Subject: [PATCH] Changed sign-up flow to require e-mail verification up front,
 preventing account existence leakage.

---
 components/emails/password.vue    |   2 +-
 components/emails/recovery.vue    |   2 +-
 components/emails/signup.vue      |  80 ++++++++++++++++++++
 components/emails/unavailable.vue |  62 +++++++++++++++
 components/emails/verify.vue      |  10 +--
 components/user/account.vue       |   9 ++-
 config/default.cjs                |   1 +
 pages/auth/signup/+Page.vue       | 121 ++++++++++++++++++++++--------
 src/auth.js                       | 118 ++++++++++++++++++++++++-----
 src/stashes.js                    |   6 +-
 src/users.js                      |  10 ++-
 src/web/auth.js                   |  45 +++++++----
 12 files changed, 387 insertions(+), 79 deletions(-)
 create mode 100644 components/emails/signup.vue
 create mode 100644 components/emails/unavailable.vue
diff --git a/components/emails/password.vue b/components/emails/password.vue
index 9da8f29..02d696f 100644
--- a/components/emails/password.vue
+++ b/components/emails/password.vue
@@ -49,7 +49,7 @@ const mockUser = {
 <template>
 	<Html>
 		<Body style="font-family: sans-serif;">
-			<Preview>Your traxxx password has been changed.</Preview>
+			<Preview>Your traxxx password has been changed</Preview>
 
 			<Container>
 				<Img
diff --git a/components/emails/recovery.vue b/components/emails/recovery.vue
index b4ac193..0223884 100644
--- a/components/emails/recovery.vue
+++ b/components/emails/recovery.vue
@@ -42,7 +42,7 @@ const mockUser = {
 <template>
 	<Html>
 		<Body style="font-family: sans-serif;">
-			<Preview>Recovering your traxxx password.</Preview>
+			<Preview>Reset your traxxx password</Preview>
 
 			<Container>
 				<Img
diff --git a/components/emails/signup.vue b/components/emails/signup.vue
new file mode 100644
index 0000000..20cffae
--- /dev/null
+++ b/components/emails/signup.vue
@@ -0,0 +1,80 @@
+<script setup>
+import {
+	Body,
+	Button,
+	Container,
+	Heading,
+	Html,
+	Img,
+	Preview,
+	Text,
+} from '@vue-email/components';
+
+import config from 'config';
+
+defineProps({
+	user: {
+		type: Object,
+		default: () => mockUser,
+	},
+	verifyUrl: {
+		type: String,
+		default: 'http://localhost:5100/verify?userId=0&token=00000000000000000000000000000000',
+	},
+	trigger: {
+		type: String,
+		default: 'change',
+	},
+	address: {
+		type: String,
+		default: 'http://localhost:5100',
+	},
+});
+</script>
+
+<script>
+// defineProps' default factory (above, in <script setup>) references this. It must live in a plain
+// <script> block: Vue's compiler forbids defineProps from referencing variables declared inside
+// <script setup> itself, since that block gets hoisted out of the setup() function.
+const mockUser = {
+	id: 1,
+	username: 'DebuggingLibrarian',
+	email: 'debug@alerts.traxxx.me',
+};
+</script>
+
+<template>
+	<Html>
+		<Body style="font-family: sans-serif;">
+			<Preview>Sign up for traxxx</Preview>
+
+			<Container>
+				<Img
+					:src="`${address}/img/logo.png`"
+					width="150"
+					alt="traxxx"
+					style="margin: 15px auto 25px auto;"
+				/>
+
+				<Heading
+					as="h3"
+					style="color: #f65596; margin: 0 auto 0 auto;"
+				>Hi,</Heading>
+
+				<Text style="font-size: 16px;">
+					<strong>Thank you for signing up for traxxx!</strong>
+					<br>
+					Please complete your registration by clicking the button below:
+				</Text>
+
+				<Button
+					:href="verifyUrl"
+					target="_blank"
+					style="background: #f65596; color: #fff; font-size: 16px; padding: 1rem 1.5rem; border-radius: .5rem; margin: 1rem 0;"
+				><strong>Create my account</strong></Button>
+
+				<Text style="font-size: 16px; margin: 20px 0;">The link will expire in {{ config.auth.signupTokenExpiry }} minutes. If you did not sign up, you can safely ignore this e-mail.</Text>
+			</Container>
+		</Body>
+	</Html>
+</template>
diff --git a/components/emails/unavailable.vue b/components/emails/unavailable.vue
new file mode 100644
index 0000000..b100c99
--- /dev/null
+++ b/components/emails/unavailable.vue
@@ -0,0 +1,62 @@
+<script setup>
+import {
+	Body,
+	Container,
+	Heading,
+	Html,
+	Img,
+	Preview,
+	Text,
+} from '@vue-email/components';
+
+defineProps({
+	user: {
+		type: Object,
+		default: () => mockUser,
+	},
+	address: {
+		type: String,
+		default: 'http://localhost:5100',
+	},
+});
+</script>
+
+<script>
+// defineProps' default factory (above, in <script setup>) references this. It must live in a plain
+// <script> block: Vue's compiler forbids defineProps from referencing variables declared inside
+// <script setup> itself, since that block gets hoisted out of the setup() function.
+const mockUser = {
+	id: 1,
+	username: 'DebuggingLibrarian',
+	email: 'debug@alerts.traxxx.me',
+};
+</script>
+
+<template>
+	<Html>
+		<Body style="font-family: sans-serif;">
+			<Preview>Someone tried to use this e-mail address for traxxx</Preview>
+
+			<Container>
+				<Img
+					:src="`${address}/img/logo.png`"
+					width="150"
+					alt="traxxx"
+					style="margin: 15px auto 25px auto;"
+				/>
+
+				<Heading
+					as="h3"
+					style="color: #f65596; margin: 0 auto 0 auto;"
+				>Hi, {{ user.username }}</Heading>
+
+				<Heading
+					as="h3"
+					style="margin-top: 30px;"
+				>Someone tried to assign this e-mail address to a traxxx account.</Heading>
+
+				<Text style="font-size: 16px; margin: 20px 0;">If this was you with this account, your e-mail address is already set correctly. If this was you with another account, you will need to use another e-mail address. If this was not you, you can safely ignore this e-mail.</Text>
+			</Container>
+		</Body>
+	</Html>
+</template>
diff --git a/components/emails/verify.vue b/components/emails/verify.vue
index 0f1bd26..951b9fc 100644
--- a/components/emails/verify.vue
+++ b/components/emails/verify.vue
@@ -46,7 +46,7 @@ const mockUser = {
 <template>
 	<Html>
 		<Body style="font-family: sans-serif;">
-			<Preview>Please verify your traxxx e-mail address.</Preview>
+			<Preview>Please verify your traxxx e-mail address</Preview>
 
 			<Container>
 				<Img
@@ -62,8 +62,7 @@ const mockUser = {
 				>Hi, {{ user.username }}</Heading>
 
 				<Text>
-					<strong v-if="trigger === 'signup'">Thank you for creating your traxxx account!</strong>
-					<strong v-else>You requested to {{ trigger === 'verify' ? 'verify' : 'change' }} the e-mail address for your traxxx account.</strong>
+					<strong>You requested to {{ trigger === 'verify' ? 'verify' : 'change' }} the e-mail address for your traxxx account.</strong>
 					<br>
 					Please confirm your e-mail address by clicking the button below:
 				</Text>
@@ -75,10 +74,7 @@ const mockUser = {
 				><strong>Verify e-mail address</strong></Button>
 
 				<Text style="font-size: 16px; margin: 20px 0;">
-					The link will expire in {{ config.auth.emailTokenExpiry }} minutes, or when you request an(other) e-mail change or verification.
-					<template v-if="trigger === 'signup'">If you did not sign up, you can safely ignore this e-mail.</template>
-					<template v-else>If you did not request this {{ trigger === 'verify' ? 'verification' : 'change' }}, you can safely ignore this e-mail.</template>
-				</Text>
+					The link will expire in {{ config.auth.emailTokenExpiry }} minutes, or when you request an(other) e-mail change or verification. If you did not request this {{ trigger === 'verify' ? 'verification' : 'change' }}, you can safely ignore this e-mail.</Text>
 			</Container>
 		</Body>
 	</Html>
diff --git a/components/user/account.vue b/components/user/account.vue
index 4d0896a..85c7512 100644
--- a/components/user/account.vue
+++ b/components/user/account.vue
@@ -23,6 +23,7 @@ const saving = ref(false);
 const submitted = ref(false);
 const verifying = ref(false);
 const verified = ref(false);
+const feedback = ref(null);
 
 function getFeedback() {
 	if (credentials.email && Object.entries(credentials).some(([key, value]) => key !== 'email' && value !== null)) {
@@ -38,13 +39,16 @@ function getFeedback() {
 
 async function updateAccount() {
 	saving.value = true;
+	feedback.value = null;
 
 	try {
+		const feedback = getFeedback();
+
 		await patch('/me', {
 			credentials,
 			password: currentPassword.value,
 		}, {
-			successFeedback: getFeedback(),
+			successFeedback: feedback,
 			errorFeedback: 'Failed to update account',
 			appendErrorMessage: true,
 		});
@@ -54,6 +58,7 @@ async function updateAccount() {
 		credentials.password = null;
 
 		submitted.value = true;
+		feedback.value = feedback;
 	}
 	finally {
 		saving.value = false;
@@ -175,7 +180,7 @@ async function verifyEmail() {
 			<strong
 				v-else-if="submitted"
 				class="success"
-			>{{ getFeedback() }}</strong>
+			>{{ feedback }}</strong>
 
 			<button
 				v-else
diff --git a/config/default.cjs b/config/default.cjs
index 52f3930..23fcd2f 100755
--- a/config/default.cjs
+++ b/config/default.cjs
@@ -161,6 +161,7 @@ module.exports = {
 		tokenCooldown: 10, // minutes, how often a token can be requested
 		emailTokenExpiry: 120, // minutes
 		passwordTokenExpiry: 120, // minutes
+		signupTokenExpiry: 120, // minutes
 	},
 	bans: {
 		defaultExpiry: 60 * 24 * 3, // in minutes, 3 days
diff --git a/pages/auth/signup/+Page.vue b/pages/auth/signup/+Page.vue
index f4e5ba7..cac4cc5 100644
--- a/pages/auth/signup/+Page.vue
+++ b/pages/auth/signup/+Page.vue
@@ -3,32 +3,29 @@ import VueHCaptcha from '@hcaptcha/vue3-hcaptcha';
 import { inject, onMounted, ref } from 'vue';
 
 import Password from '#/components/form/password.vue';
+import Ellipsis from '#/components/loading/ellipsis.vue';
 
 import { post } from '#/src/api.js';
 import navigate from '#/src/navigate.js';
 
 const pageContext = inject('pageContext');
 const { user, env } = pageContext;
+const { token } = pageContext.urlParsed.search;
 
 const username = ref('');
 const email = ref('');
 const password = ref('');
-const passwordConfirm = ref('');
 
 const errorMsg = ref(null);
 const submitted = ref(false);
-const userInput = ref(null);
+const success = ref(false);
+const mainInput = ref(null);
 const captcha = ref(null);
 
 async function signup() {
 	errorMsg.value = null;
 	submitted.value = true;
 
-	if (password.value !== passwordConfirm.value) {
-		errorMsg.value = 'Passwords do not match';
-		return;
-	}
-
 	if (env.captcha.enabled && !captcha.value) {
 		errorMsg.value = 'Please complete the CAPTCHA';
 		return;
@@ -36,11 +33,14 @@ async function signup() {
 
 	try {
 		const newUser = await post('/users', {
+			token,
 			username: username.value,
-			email: email.value,
 			password: password.value,
 			redirect: pageContext.urlParsed.search.r,
 			captcha: captcha.value,
+		}, {
+			successFeedback: 'Sign-up successful!',
+			appendErrorMessage: true,
 		});
 
 		navigate(`/user/${newUser.username}`, null, { redirect: true });
@@ -53,8 +53,30 @@ async function signup() {
 	}
 }
 
+async function request() {
+	errorMsg.value = null;
+	submitted.value = true;
+
+	try {
+		await post('/signups', {
+			email: email.value,
+		}, {
+			successFeedback: 'Sign-up requested, please check your inbox',
+			appendErrorMessage: true,
+		});
+
+		success.value = true;
+	}
+	catch (error) {
+		errorMsg.value = error.message;
+	}
+	finally {
+		submitted.value = false;
+	}
+}
+
 onMounted(() => {
-	userInput.value.focus();
+	mainInput.value.focus();
 });
 </script>
 
@@ -88,7 +110,7 @@ onMounted(() => {
 		</div>
 
 		<form
-			v-else
+			v-else-if="token"
 			autocomplete="off"
 			class="login-panel"
 			@submit.prevent="signup"
@@ -99,34 +121,19 @@ onMounted(() => {
 			>{{ errorMsg }}</div>
 
 			<input
-				ref="userInput"
+				ref="mainInput"
 				v-model="username"
 				placeholder="Username"
 				class="input"
 				required
 			>
 
-			<input
-				v-model="email"
-				type="email"
-				placeholder="E-mail"
-				class="input"
-				required
-			>
-
 			<Password
 				:password="password"
 				autocomplete="new-password"
 				@input="(newPassword) => password = newPassword"
 			/>
 
-			<Password
-				:password="passwordConfirm"
-				autocomplete="new-password"
-				placeholder="Confirm password"
-				@input="(newPassword) => passwordConfirm = newPassword"
-			/>
-
 			<VueHCaptcha
 				v-if="env.captcha.enabled"
 				:sitekey="env.captcha.siteKey"
@@ -135,15 +142,53 @@ onMounted(() => {
 				@expired="captcha = null"
 			/>
 
+			<Ellipsis v-if="submitted" />
+
 			<button
+				v-else
 				class="button button-submit"
 				:disabled="submitted"
 			>Sign up</button>
+		</form>
 
-			<a
-				href="/login"
-				class="link"
-			>I already have an account</a>
+		<form
+			v-else
+			autocomplete="off"
+			class="login-panel"
+			@submit.prevent="request"
+		>
+			<span
+				v-if="success"
+				class="success"
+			>
+				<strong class="success-heading">Thank you for signing up!</strong>
+				Please check your e-mail inbox to continue.
+			</span>
+
+			<template v-else>
+				<input
+					ref="mainInput"
+					v-model="email"
+					type="email"
+					placeholder="E-mail"
+					class="input"
+					required
+				>
+
+				<Ellipsis v-if="submitted" />
+
+				<template v-else>
+					<button
+						class="button button-submit"
+						:disabled="submitted"
+					>Send signup e-mail</button>
+
+					<a
+						href="/login"
+						class="link login"
+					>I already have an account</a>
+				</template>
+			</template>
 		</form>
 	</div>
 </template>
@@ -179,7 +224,7 @@ onMounted(() => {
 	}
 
 	.link {
-		margin-top: .5rem;
+		margin-top: 1rem;
 		text-align: center;
 	}
 }
@@ -235,4 +280,18 @@ onMounted(() => {
 	font-weight: bold;
 	text-align: center;
 }
+
+.success {
+	line-height: 1.25;
+}
+
+.success-heading {
+	display: block;
+	color: var(--primary);
+	margin-bottom: .5rem;
+}
+
+.load-container {
+	justify-content: center;
+}
 </style>
diff --git a/src/auth.js b/src/auth.js
index fac4c94..262b9f2 100755
--- a/src/auth.js
+++ b/src/auth.js
@@ -6,7 +6,7 @@ import { shapes } from '@dicebear/collection';
 import { createAvatar } from '@dicebear/core';
 import { faker } from '@faker-js/faker';
 import config from 'config';
-import { verify } from 'hcaptcha';
+import { verify as verifyCaptcha } from 'hcaptcha';
 
 import slugify from '../utils/slugify.js';
 import { sendEmails } from './email.js';
@@ -332,11 +332,78 @@ export async function resetPassword(userId, emailToken, newPassword) {
 	}
 }
 
+export async function sendSignup(email) {
+	if (!config.auth.signup || !config.email.enabled) {
+		throw new HttpError('Sign-ups are disabled', 503);
+	}
+
+	if (!email) {
+		throw new HttpError('No e-mail address provided', 400);
+	}
+
+	await tokenCooldown(email);
+
+	const user = await fetchUser(email, {
+		email: true,
+		includePrivate: true,
+		throwError: false,
+	});
+
+	if (user) {
+		await sendEmails([{
+			template: 'unavailable',
+			to: email,
+			subject: 'Someone tried to use your e-mail address for traxxx',
+			props: {
+				user,
+			},
+		}]);
+
+		logger.info(`Duplicate signup with '${email}' attempted, user e-mailed`);
+
+		// we don't throw an error because the requesting user shouldn't know whether the account exists or not
+		return;
+	}
+
+	const token = crypto.randomBytes(32).toString('hex');
+	const tokenKey = `traxxx:token_signup:${token}`;
+
+	const tokenData = {
+		email,
+	};
+
+	await redis.set(tokenKey, JSON.stringify(tokenData));
+	await redis.expire(tokenKey, config.auth.signupTokenExpiry * 60);
+
+	const verifyUrl = `${config.web.address}/signup?${new URLSearchParams({
+		token,
+	}).toString()}`;
+
+	logger.info(`Signup e-mail sent to ${email}: ${verifyUrl}`);
+
+	await sendEmails([{
+		template: 'signup',
+		to: email,
+		subject: 'Sign up for traxxx',
+		props: {
+			verifyUrl,
+		},
+	}]);
+}
+
 export async function signup(credentials, userIp) {
 	if (!config.auth.signup) {
 		throw new HttpError('Sign-ups are currently disabled', 503);
 	}
 
+	if (!credentials.token) {
+		throw new HttpError('Token required', 400);
+	}
+
+	if (credentials.password?.length < 3) {
+		throw new HttpError('Password must be 3 characters or longer', 400);
+	}
+
 	const curatedUsername = credentials.username.trim();
 
 	if (!curatedUsername) {
@@ -355,30 +422,34 @@ export async function signup(credentials, userIp) {
 		throw new HttpError('Username contains invalid characters', 400);
 	}
 
-	if (!credentials.email) {
-		throw new HttpError('E-mail required', 400);
-	}
+	const existingUser = await knex('users')
+		.where(knex.raw('lower(username)'), curatedUsername.toLowerCase())
+		.first();
 
-	if (credentials.password?.length < 3) {
-		throw new HttpError('Password must be 3 characters or longer', 400);
+	if (existingUser) {
+		throw new HttpError('Username already in use', 409);
 	}
 
 	if (config.auth.captcha.enabled) {
-		const captchaVerification = await verify(config.auth.captcha.secretKey, credentials.captcha);
+		const captchaVerification = await verifyCaptcha(config.auth.captcha.secretKey, credentials.captcha);
 
 		if (!captchaVerification.success) {
-			logger.warn(`Invalid sign-up CAPTCHA from '${curatedUsername}' (${credentials.email}, ${userIp})`);
+			logger.warn(`Invalid sign-up CAPTCHA from '${curatedUsername}' (${userIp})`);
 			throw new HttpError('Invalid CAPTCHA', 400);
 		}
 	}
 
-	const existingUser = await knex('users')
-		.where(knex.raw('lower(username)'), curatedUsername.toLowerCase())
-		.orWhere(knex.raw('lower(email)'), credentials.email.toLowerCase())
-		.first();
+	const tokenKey = `traxxx:token_signup:${credentials.token}`;
+	const tokenEntry = await redis.getDel(tokenKey);
 
-	if (existingUser) {
-		throw new HttpError('Username or e-mail already in use', 409);
+	if (!tokenEntry) {
+		throw new HttpError('Invalid sign-up link', 401);
+	}
+
+	const { email } = JSON.parse(tokenEntry);
+
+	if (!email) {
+		throw new HttpError('Invalid sign-up link', 401);
 	}
 
 	const { storedPassword } = await hashPassword(credentials.password);
@@ -386,8 +457,9 @@ export async function signup(credentials, userIp) {
 	const [{ id: userId }] = await knex('users')
 		.insert({
 			username: curatedUsername,
-			email: credentials.email,
+			email,
 			password: storedPassword,
+			email_verified: true,
 		})
 		.returning('id');
 
@@ -399,7 +471,7 @@ export async function signup(credentials, userIp) {
 		primary: true,
 	});
 
-	logger.info(`Signup from '${curatedUsername}' (${userId}, ${credentials.email}, ${userIp})`);
+	logger.info(`Signup from '${curatedUsername}' (${userId}, ${email}, ${userIp})`);
 
 	await generateAvatar({
 		id: userId,
@@ -410,7 +482,8 @@ export async function signup(credentials, userIp) {
 		includePrivate: true,
 	});
 
-	await sendEmailVerification(user, null, 'signup');
+	// no longer needed with token-first signup flow
+	// await sendEmailVerification(user, null, 'signup');
 
 	return user;
 }
@@ -447,7 +520,16 @@ async function updateEmail(email, reqUser) {
 	});
 
 	if (user) {
-		throw new HttpError('This e-mail address is already in use', 409);
+		await sendEmails([{
+			template: 'unavailable',
+			to: email,
+			subject: 'Someone tried to use your e-mail address for traxxx',
+			props: {
+				user, // not reqUser, we don't want to leak details about the requester
+			},
+		}]);
+
+		return;
 	}
 
 	await sendEmailVerification(reqUser, email, 'change');
diff --git a/src/stashes.js b/src/stashes.js
index 10445b0..40a3ff1 100755
--- a/src/stashes.js
+++ b/src/stashes.js
@@ -126,6 +126,10 @@ export async function fetchStashByUsernameAndSlug(usernameOrId, stashSlug, sessi
 }
 
 export async function fetchUserStashes(usernameOrId, reqUser) {
+	if (!usernameOrId) {
+		throw new HttpError(`No username or user ID provided`, 400);
+	}
+
 	const userId = typeof usernameOrId === 'number'
 		? usernameOrId
 		: await knex('users')
@@ -134,7 +138,7 @@ export async function fetchUserStashes(usernameOrId, reqUser) {
 				.then((user) => user?.id);
 
 	if (!userId) {
-		throw new HttpError(`Could not find user '${usernameOrId}'`);
+		throw new HttpError(`Could not find user '${usernameOrId}'`, 404);
 	}
 
 	const stashes = await knex('stashes')
diff --git a/src/users.js b/src/users.js
index 90734a5..5f92b72 100755
--- a/src/users.js
+++ b/src/users.js
@@ -56,6 +56,14 @@ function whereUser(builder, userId, options = {}) {
 }
 
 export async function fetchUser(userId, options = {}, reqUser) {
+	if (!userId) {
+		if (options.raw) {
+			return { user: null };
+		}
+
+		return null;
+	}
+
 	const user = await knex('users')
 		.select(knex.raw('users.*, users_roles.abilities as role_abilities'))
 		.modify((builder) => whereUser(builder, userId, options))
@@ -119,8 +127,6 @@ export async function removeTemplate(templateId, reqUser) {
 }
 
 export async function createBan(ban, reqUser) {
-	console.log(ban);
-
 	if (reqUser.role !== 'admin') {
 		throw new HttpError('You do not have sufficient privileges to set a ban', 403);
 	}
diff --git a/src/web/auth.js b/src/web/auth.js
index f207c2a..3513fbe 100755
--- a/src/web/auth.js
+++ b/src/web/auth.js
@@ -13,6 +13,7 @@ import {
 	resetPassword,
 	sendEmailVerification,
 	sendPasswordReset,
+	sendSignup,
 	signup,
 	updateSettings,
 	updateUser,
@@ -23,25 +24,20 @@ import {
 	fetchUser,
 } from '../users.js';
 
-// changes every time the process restarts, so a deploy invalidates all cached session users
-// even if they're within the staleness window below
-const sessionStaleThreshold = 5 * 60 * 1000;
-
 // spread into a new object rather than mutating the user we're about to hand back to the
 // client (loginApi/signupApi send this straight to the browser) — runtimeId/refreshedAt are
 // session bookkeeping only, they shouldn't leak into the API response
 function toSession(user) {
+	if (!user) {
+		return null;
+	}
+
 	return {
 		...user,
 		runtimeId,
 		refreshedAt: Date.now(),
 	};
 }
-
-function isSessionStale(sessionUser) {
-	return sessionUser.runtimeId !== runtimeId || Date.now() - sessionUser.refreshedAt > sessionStaleThreshold;
-}
-
 // concurrent requests for the same user (e.g. the burst of asset/API requests a single page
 // load fires) share one in-flight refresh instead of each independently hitting the DB
 const pendingSessionRefreshes = new Map();
@@ -90,16 +86,24 @@ function getIp(req) {
 	return expandedIp.addressStart?.addressMinusSuffix || null;
 }
 
+// changes every time the process restarts, so a deploy invalidates all cached session users
+// even if they're within the staleness window below
+const sessionStaleThreshold = 5 * 60 * 1000;
+
+function isSessionStale(sessionUser) {
+	return !!sessionUser && (sessionUser.runtimeId !== runtimeId || Date.now() - sessionUser.refreshedAt > sessionStaleThreshold);
+}
+
 export async function setUserApi(req, res, next) {
 	const ip = getIp(req);
 
 	req.userIp = ip;
 
-	if (req.session.user) {
-		if (isSessionStale(req.session.user)) {
-			req.session.user = await refreshSessionUser(req.session.user);
-		}
+	if (isSessionStale(req.session.user)) {
+		req.session.user = await refreshSessionUser(req.session.user);
+	}
 
+	if (req.session.user) {
 		req.user = req.session.user;
 		req.user.ip = ip;
 	}
@@ -110,10 +114,12 @@ export async function setUserApi(req, res, next) {
 export async function updateSessionUser(req) {
 	const user = toSession(await fetchUser(req.session.user.id, {}, req.session.user));
 
-	req.session.user = user;
+	if (user) {
+		req.session.user = user;
 
-	req.user = user;
-	req.user.ip = req.userIp;
+		req.user = user;
+		req.user.ip = req.userIp;
+	}
 }
 
 export async function loginApi(req, res) {
@@ -133,6 +139,12 @@ export async function logoutApi(req, res) {
 	});
 }
 
+async function sendSignupApi(req, res) {
+	await sendSignup(req.body.email, req.userIp);
+
+	res.status(204).send();
+}
+
 export async function signupApi(req, res) {
 	const user = await signup(req.body, req.userIp);
 
@@ -241,6 +253,7 @@ authRouter.post('/api/session', loginApi);
 authRouter.delete('/api/session', logoutApi);
 
 // USERS
+authRouter.post('/api/signups', sendSignupApi);
 authRouter.post('/api/users', signupApi);
 
 // SETTINGS
