Masonic Reach Auth Baseline Test

Proof checklist

0. Sign up (+ cell collect) -

1. Login -

2. Refresh → still signed in -

3. Sign out -

4. Reset password -

4b. Change password (signed-in) -

4c. Roster match RPCs -

4d. Email confirm → ACTIVE -

4e. Thin admin -

4e2. Lost-email entitlement -

4f. Change email (signed-in) -

4g. Phone SMS OTP -

5. SUSPENDED blocked -

6. ACTIVE works -

Session

…

Sign in

Signup order: last/phone/email/password/lodge → Sign up → Phone SMS OTP → Match (GL ID + last + lodge) → email → ACTIVE. Missing GL → Secretary hold.

Cloudflare Turnstile — required for Sign up only (not Sign in).

Set new password

Opened from recovery link (PASSWORD_RECOVERY). Stock updateUser({ password }).

Signed in — Masonic gate

Change password

Phone SMS OTP (signed-in)

Order: click SEND SMS code first, then enter the newest 6-digit code from that send and VERIFY. Codes from Twilio Verified Caller ID setup (or any SMS before SEND) are not app codes. Sets phone_verified_at (Gate B). Required before Match auto-approve and before email→ACTIVE. Does not change account_status by itself.

Email confirmation (Masonic)

Shown when account_status is PENDING_EMAIL_CONFIRMATION. Calls Edge email-confirmation SEND / VERIFY (6-digit). Needs Resend configured on the function.

Change email (signed-in)

ACTIVE signed-in self-service. 1) Start via RPC start_email_change → 2) SEND code to new email → 3) VERIFY via Edge change-email.

Thin admin

Lost-email: …

Owner 2-click proof: Lookup email/GL → select row → reason + SUSPEND (or ACTIVE). Status flips: Owner only. Lookup also works for DA (lost-email later). Do not status-flip yourself.

Selected

Lost-email recovery

Checking entitlement…

Owner or District Admin. New email must differ from current. 1) Start → 2) SEND → 3) VERIFY (Edge lost-email-recovery).

Roster match (signed-in)

Gate B: finish Phone SMS OTP first. Match key = GL ID + last name typed here + lodge (uses this field, not signup profile name). No surname dropdown. Empty/wrong GL → Unmatched hold (SECRETARY_REVIEW) — contact lodge Secretary; no auto-ACTIVE. Good match → PENDING_EMAIL_CONFIRMATION → email → ACTIVE. Secretary email notify = not live yet (design only).