The owner changes entry from CookieValid to ConfirmedOnly.
Fill the last column before opening the discussion. Every session below is active and unexpired.
| Visit | CookieValid | ConfirmedOnly |
|---|---|---|
| Immediately after registration | Allowed | ? |
| Return before confirming | Allowed | ? |
| Return after confirming | Allowed | ? |
A separate change removes password collection during registration. Decide whether that also changes the separately owned login story.
Engineering Depth
pub type OpenWorkshop<P> = Workshop<Google<P>, WithoutPassword, CookieValid>;
pub type ConfirmedWorkshop<P> = Workshop<Google<P>, WithoutPassword, ConfirmedOnly>;
The selected policy reaches the current entry check:
if !account.active {
return Err(EntryFailure::Revoked);
}
if self.workshop.now >= account.expires {
return Err(EntryFailure::Expired);
}
if !E::permits(account.confirmed) {
return Err(EntryFailure::ConfirmationRequired);
}
Initial and later visits use this same handler. Delivery remains independently available. CS-04, CS-08.
Your Reflection
Fill the table. Which rule governs later password login?
Notes are browser-local. Export a copy to keep them; they are not submitted or judged.
Worked Discussion
ConfirmedOnly yields refused, refused, allowed. An expired or revoked session is still refused after confirmation.
Removing registration password collection does not decide later login. Follow that story's own contract and owner.