feat(api): registration auth, account creation, check-email & email notifications

- Add POST /public/check-email endpoint with rate limiting (10/min)
- Create user accounts during volunteer registration (new or returning)
- Returning volunteers authenticate with existing password
- Add password validation to VolunteerRegistrationRequest
- Normalize emails to lowercase throughout registration flow
- Handle race condition on duplicate accounts gracefully
- Create RegistrationConfirmationMail, RegistrationApprovedMail, RegistrationRejectedMail
- Wire approval/rejection emails into PersonController
- Add POST persons/{person}/reject endpoint
- Trigger TagSyncService on registration and approval
- Add CheckEmailTest, PersonApprovalEmailTest, extend VolunteerRegistrationTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Http/Controllers/Api/V1/CheckEmailController.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\CheckEmailRequest;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+
+final class CheckEmailController extends Controller
+{
+    public function __invoke(CheckEmailRequest $request): JsonResponse
+    {
+        $exists = User::where('email', strtolower($request->validated('email')))->exists();
+
+        return response()->json(['exists' => $exists]);
+    }
+}

api/app/Http/Controllers/Api/V1/PersonController.php

@@ -9,17 +9,22 @@ use App\Http\Requests\Api\V1\StorePersonRequest;
 use App\Http\Requests\Api\V1\UpdatePersonRequest;
 use App\Http\Resources\Api\V1\PersonCollection;
 use App\Http\Resources\Api\V1\PersonResource;
+use App\Mail\RegistrationApprovedMail;
+use App\Mail\RegistrationRejectedMail;
 use App\Models\Event;
 use App\Models\Person;
 use App\Services\PersonIdentityService;
+use App\Services\TagSyncService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Mail;
 
 final class PersonController extends Controller
 {
     public function __construct(
         private readonly PersonIdentityService $identityService,
+        private readonly TagSyncService $tagSyncService,
     ) {}
 
     public function index(Request $request, Event $event): PersonCollection
@@ -107,6 +112,27 @@ final class PersonController extends Controller
 
         $person->update(['status' => 'approved']);
 
+        $this->tagSyncService->syncFromRegistration($person);
+
+        if ($person->email) {
+            Mail::to($person->email)->queue(new RegistrationApprovedMail($person, $event));
+        }
+
+        return $this->success(new PersonResource($person->fresh()->load('crowdType')));
+    }
+
+    public function reject(Request $request, Event $event, Person $person): JsonResponse
+    {
+        Gate::authorize('approve', [$person, $event]);
+
+        $person->update(['status' => 'rejected']);
+
+        $reason = $request->input('reason');
+
+        if ($person->email) {
+            Mail::to($person->email)->queue(new RegistrationRejectedMail($person, $event, $reason));
+        }
+
         return $this->success(new PersonResource($person->fresh()->load('crowdType')));
     }
 }

api/app/Http/Requests/Api/V1/CheckEmailRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class CheckEmailRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'email'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/VolunteerRegistrationRequest.php

@@ -30,7 +30,9 @@ final class VolunteerRegistrationRequest extends FormRequest
     /** @return array<string, mixed> */
     public function rules(): array
     {
-        return [
+        $user = auth('sanctum')->user();
+
+        $rules = [
             'first_name' => ['required_without:_authenticated', 'string', 'max:255'],
             'last_name' => ['required_without:_authenticated', 'string', 'max:255'],
             'email' => ['required_without:_authenticated', 'email', 'max:255'],
@@ -55,5 +57,13 @@ final class VolunteerRegistrationRequest extends FormRequest
 
             'field_values' => ['nullable', 'array'],
         ];
+
+        // Password required for unauthenticated registrations
+        if ($user === null) {
+            $rules['password'] = ['required', 'string', 'min:8'];
+            $rules['password_confirmation'] = ['nullable', 'same:password'];
+        }
+
+        return $rules;
     }
 }

api/app/Mail/RegistrationApprovedMail.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mail;
+
+use App\Models\Event;
+use App\Models\Person;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+final class RegistrationApprovedMail extends Mailable implements ShouldQueue
+{
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public readonly Person $person,
+        public readonly Event $event,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            subject: "Je bent goedgekeurd! — {$this->event->name}",
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            markdown: 'emails.registration-approved',
+            with: [
+                'personName' => $this->person->first_name,
+                'eventName' => $this->event->name,
+                'portalUrl' => config('app.frontend_portal_url'),
+            ],
+        );
+    }
+}

api/app/Mail/RegistrationConfirmationMail.php

@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mail;
+
+use App\Models\Event;
+use App\Models\Person;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+final class RegistrationConfirmationMail extends Mailable implements ShouldQueue
+{
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public readonly Person $person,
+        public readonly Event $event,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            subject: "Bevestiging aanmelding {$this->event->name}",
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            markdown: 'emails.registration-confirmation',
+            with: [
+                'personName' => $this->person->first_name,
+                'eventName' => $this->event->name,
+                'startDate' => $this->event->start_date->format('d-m-Y'),
+                'endDate' => $this->event->end_date->format('d-m-Y'),
+                'portalUrl' => config('app.frontend_portal_url'),
+            ],
+        );
+    }
+}

api/app/Mail/RegistrationRejectedMail.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mail;
+
+use App\Models\Event;
+use App\Models\Person;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+final class RegistrationRejectedMail extends Mailable implements ShouldQueue
+{
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public readonly Person $person,
+        public readonly Event $event,
+        public readonly ?string $reason = null,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            subject: "Update over je aanmelding — {$this->event->name}",
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            markdown: 'emails.registration-rejected',
+            with: [
+                'personName' => $this->person->first_name,
+                'eventName' => $this->event->name,
+                'reason' => $this->reason,
+            ],
+        );
+    }
+}

api/app/Services/VolunteerRegistrationService.php

@@ -5,22 +5,24 @@ declare(strict_types=1);
 namespace App\Services;
 
 use App\Enums\PersonStatus;
+use App\Mail\RegistrationConfirmationMail;
 use App\Models\CrowdType;
 use App\Models\Event;
 use App\Models\Person;
 use App\Models\User;
 use App\Models\VolunteerAvailability;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
-use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Mail;
 use Illuminate\Validation\ValidationException;
 
 final class VolunteerRegistrationService
 {
     public function __construct(
-        private readonly PersonIdentityService $identityService,
         private readonly RegistrationFormFieldService $registrationFormFieldService,
         private readonly PersonSectionPreferenceService $personSectionPreferenceService,
+        private readonly TagSyncService $tagSyncService,
     ) {}
 
     /**
@@ -37,23 +39,28 @@ final class VolunteerRegistrationService
         }
 
         $festivalEvent = $this->resolveFestivalEvent($event);
-        $email = $user?->email ?? $validated['email'];
+        $email = strtolower($user?->email ?? $validated['email']);
 
         $this->checkDuplicateRegistration($festivalEvent, $email);
 
+        // Resolve or create user account for unauthenticated registrations
+        if ($user === null) {
+            $user = $this->resolveUserAccount($email, $validated);
+        }
+
         $volunteerCrowdType = $this->resolveVolunteerCrowdType($event);
 
-        return DB::transaction(function () use ($festivalEvent, $validated, $user, $email, $volunteerCrowdType): Person {
+        $person = DB::transaction(function () use ($festivalEvent, $validated, $user, $email, $volunteerCrowdType): Person {
             $person = Person::updateOrCreate(
                 [
                     'event_id' => $festivalEvent->id,
                     'email' => $email,
                 ],
                 [
-                    'user_id' => $user?->id,
+                    'user_id' => $user->id,
                     'crowd_type_id' => $volunteerCrowdType->id,
-                    'first_name' => $user?->first_name ?? $validated['first_name'],
-                    'last_name' => $user?->last_name ?? $validated['last_name'],
+                    'first_name' => $validated['first_name'] ?? $user->first_name,
+                    'last_name' => $validated['last_name'] ?? $user->last_name,
                     'phone' => $validated['phone'] ?? null,
                     'date_of_birth' => $validated['date_of_birth'] ?? null,
                     'status' => PersonStatus::PENDING,
@@ -84,11 +91,10 @@ final class VolunteerRegistrationService
                 );
             }
 
-            if ($user === null) {
-                $this->detectIdentityMatch($person);
-            }
+            // Trigger tag sync — user_id is always known now
+            $this->tagSyncService->syncFromRegistration($person);
 
-            $source = $user !== null ? 'authenticated_form' : 'public_form';
+            $source = auth('sanctum')->check() ? 'authenticated_form' : 'public_form';
 
             $activityLogger = activity('volunteer_registration')
                 ->performedOn($person)
@@ -97,16 +103,55 @@ final class VolunteerRegistrationService
                     'event_id' => $festivalEvent->id,
                     'person_id' => $person->id,
                     'email' => $email,
-                ]);
-
-            if ($user !== null) {
-                $activityLogger->causedBy($user);
-            }
+                ])
+                ->causedBy($user);
 
             $activityLogger->log('person.registered');
 
             return $person;
         });
+
+        // Send confirmation email (queued, outside transaction)
+        Mail::to($person->email)->queue(new RegistrationConfirmationMail($person, $festivalEvent));
+
+        return $person;
+    }
+
+    /**
+     * Resolve or create user account for the registering email.
+     *
+     * @param  array<string, mixed>  $validated
+     *
+     * @throws ValidationException
+     */
+    private function resolveUserAccount(string $email, array $validated): User
+    {
+        $existingUser = User::where('email', $email)->first();
+
+        if ($existingUser !== null) {
+            // Returning volunteer: authenticate with provided password
+            if (!Hash::check($validated['password'], $existingUser->password)) {
+                throw ValidationException::withMessages([
+                    'password' => ['Wachtwoord onjuist.'],
+                ]);
+            }
+
+            return $existingUser;
+        }
+
+        // New volunteer: create user account
+        try {
+            return User::create([
+                'first_name' => $validated['first_name'],
+                'last_name' => $validated['last_name'],
+                'email' => $email,
+                'password' => Hash::make($validated['password']),
+            ]);
+        } catch (\Illuminate\Database\UniqueConstraintViolationException) {
+            throw ValidationException::withMessages([
+                'email' => ['Dit emailadres heeft al een account. Gebruik je bestaande wachtwoord.'],
+            ]);
+        }
     }
 
     private function resolveFestivalEvent(Event $event): Event
@@ -188,18 +233,4 @@ final class VolunteerRegistrationService
             ]);
         }
     }
-
-    private function detectIdentityMatch(Person $person): void
-    {
-        if (! Schema::hasTable('person_identity_matches')) {
-            activity('volunteer_registration')
-                ->performedOn($person)
-                ->withProperties(['email' => $person->email])
-                ->log('person.identity_match_skipped_table_missing');
-
-            return;
-        }
-
-        $this->identityService->detectMatchForPerson($person);
-    }
 }