Why

The iPhone app could only sign in: a new reader had to create an account on the web first. This adds sign-up in the app, with the same invite rules as the web.

What changes

• "New to Klipstack? Create an account" under the app's sign-in opens a sign-up screen.
  • The invite code comes first. The field is hidden when sign-up is open; a waitlist server shows a "Request one" link to its request page.
  • Then Apple, Google or GitHub, or name, email and password.
• Email sign-up sends a 6-digit code. The account is created only when the code checks out, already verified.
  • The code is hashed, allows 3 tries and lasts 10 minutes, and works only for its own address.
  • An address that already has an account gets an email telling it to sign in, and the app gets the same answer.
• An invite is used only when an account is created. An Apple ID that already has an account just signs in, whatever the invite.
• A sign-up refused for lack of a usable invite revokes the Apple authorization it just made.
• The sign-in still never creates accounts. Only /app/sign-up and the provider sheet started with sign_up=1 can, through the same user-create hook as the web.
• A new account takes the phone's language, sent as Accept-Language.
• Limits: 10 sign-up codes a day per address (100 per IP), and 10 sign-ups per address and 20 per IP an hour, as on the web.
• The code field now spaces only the digits typed, not its placeholder.

Verification

• In the simulator against the dev server: invite → name, email and password → code → Home. The database showed the account verified, with its password, the invite used and the app's consent.
• New tests cover email, Apple and GitHub sign-up, wrong and cross-address codes, the try limit, bad invites, existing accounts and Spanish. Breaking each key rule makes a test fail.
• pnpm verify and pnpm ci:local (static, unit, build) pass. In e2e, 304 passed. "Getting started card" failed all retries under load, as it flaked before; run alone it passed 3 of 3. It is unrelated to sign-up.
• Two fresh reviews ran. Fixed from them:
  • An Apple user with an account, coming through sign-up with a used invite, was refused and revoked.
  • The app's sign-up was looser per IP than the web's.
  • No test covered a code being used for another address.
• Dismissed from the reviews:
  • A code is used up when two sign-ups race for one invite. The loser asks for a new one.
  • An invite used up mid-sheet comes back as "no account".
• Not verified: real Apple, Google and GitHub sign-ups (they need TestFlight), and whether iOS reports Spanish to this English-only app for the account's language.

Risk and follow-ups

• New security row in docs/security.md: "The app's sign-up".
• The mobile app ships through TestFlight after this deploys.