# SELF_SERVICE_REGISTER_CLOSURE_20260327-000848

## Scope

- PRD `1.1 多种注册方式`
- frontend self-service registration entry, page, route, and public workflow
- SMS register-code request contract normalization
- normal-user first-login redirect away from admin-only dashboard

## Implemented Closure

- Backend:
  - retained the existing `POST /api/v1/auth/register` product API and closed the remaining client contract gap.
  - `POST /api/v1/auth/send-code` now accepts both `purpose` and the legacy `scene` field, normalizing both onto the same SMS-purpose path for backward compatibility.
- Frontend:
  - added `/register` as a real public route with username/password registration, optional nickname/email, and capability-gated phone registration.
  - added a login-to-register product entry on `/login`.
  - fixed SMS register/login send-code requests to use `purpose` instead of the mismatched `scene` payload.
  - after registration, normal users are no longer dropped onto an admin-only dashboard path; `/dashboard` is now admin-guarded and non-admin first login lands on `/profile`.
  - `/register` was added to the public-session whitelist so expired refresh-token cleanup does not incorrectly force-register users back to `/login`.

## Validation

- `go test ./... -count=1`
- `go build ./cmd/server`
- `cd D:\project\frontend\admin && npm.cmd run lint`
- `cd D:\project\frontend\admin && npm.cmd run test:run`
- `cd D:\project\frontend\admin && npm.cmd run build`
- `cd D:\project\frontend\admin && powershell -ExecutionPolicy Bypass -File .\scripts\run-playwright-auth-e2e.ps1`

## Real Browser Result

- `public-registration` now passes in the supported raw-CDP browser path.
- verified path:
  - `/login` -> `创建账号`
  - `/register` -> submit self-service registration
  - success page -> `返回登录`
  - login with newly registered normal user
  - redirect settles on `/profile` instead of an admin-only dashboard error path

## Boundary

- phone registration remains capability-gated by configured Aliyun/Tencent SMS delivery.
- email activation still depends on SMTP-backed activation capability; the frontend supports the loop, but live SMTP delivery proof remains environment-dependent.
- this closes the product loop and supported-browser regression path; it does not change the separate boundary around live third-party OAuth provider evidence or external production delivery governance evidence.
