> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.ruoomsoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Email OTP authentication lifecycle and integration

## Core integration

The wheel installs `plugins.email_otp`. Its metadata mounts the URL namespace at `/otp/`, marks the sign-in route public, and contributes **Email me a sign-in code** to Core's generic sign-in options.

## Model and lifecycle

`EmailOTP` stores the normalized email, business ID, hashed code, creation/expiration times, used state, and verification-attempt count.

1. `/otp/signin/` validates an email and enforces the cooldown.
2. Existing active codes for that email/business are invalidated.
3. A hashed six-digit code is saved and the plaintext code is sent by email.
4. `/otp/signin/verify/` validates expiry, use state, attempt count, and the hash.
5. A matching active profile is authenticated; otherwise the verified email is carried into signup.

## Routes

* `/otp/signin/`: request a code (`email_otp:request`).
* `/otp/signin/verify/`: submit and verify a code (`email_otp:verify`).