Summary
The repo contains a cohort-token model and docs describing QR/token-driven self-registration, but /auth/register is publicly reachable without any token validation and generate-qr produces a generic registration link.
Evidence
- Route: �pp/auth/routes.py exposes GET/POST /auth/register without token checks.
- �pp/models.py contains create_cohort_token() and get_cohort_token().
- Tests and docs are inconsistent about whether registration is public, tokenized, or removed.
Impact
- The security model for account creation is unclear.
- Intended cohort scoping and QR token controls are not enforced by the current implementation.
Expected outcome
Decide and enforce one registration model: token-gated QR registration or no public registration route. Align code, tests, and docs accordingly.
Summary
The repo contains a cohort-token model and docs describing QR/token-driven self-registration, but /auth/register is publicly reachable without any token validation and generate-qr produces a generic registration link.
Evidence
Impact
Expected outcome
Decide and enforce one registration model: token-gated QR registration or no public registration route. Align code, tests, and docs accordingly.