# Auth and accounts

## Registration paths

| Path | UI | API | Result |
|------|----|-----|--------|
| Learner | `/auth/register` | `POST /auth/register` | `STUDENT`; email verify |
| Coach | `/become-instructor` | `POST /auth/register-instructor` | Pending → `/account/pending-approval` → coach setup |
| Employer | `/auth/register/employer` | `POST /auth/register-employer` | `EMPLOYER` → `/dashboard/talent` |

## Session & email

| Route | Purpose |
|-------|---------|
| `/auth/login` | Sign in |
| `/auth/verify-email` | Confirm token |
| `/auth/verify-email/pending` | Waiting state |
| `/auth/resend-verification` | Resend |
| `/auth/forgot-password` / `/auth/reset-password` | Reset flow |

Base API: `/api/v1/auth`. Frontend details: monorepo `frontend/docs/AUTHENTICATION.md`.

## Account gates

| Route | When |
|-------|------|
| `/account/pending-approval` | Instructor not yet approved |
| `/account/accept-invite` | Team invite token |
| `/account/inactive` | Inactive |
| `/account/suspended` | Suspended |
| `/account/banned` | Banned |
| `/account/deleted` | Deleted |
| `/unauthorized` | Missing permission / wrong role |

## Permissions

- Dashboard **nav** filters by **role** (`nav.types.ts` + sidebar).
- Admin **sidebar** filters by **permission strings** (`users:read`, `career_tracks:manage`, …) — see `frontend/src/lib/permissions.ts` and `backend/src/config/permissions.ts`.
- Employer CMH perms include `talent:search`, `jobs:manage`, `placements:manage`.