Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Email verification #4268

Merged
merged 10 commits into from
Dec 6, 2023
Merged

Email verification #4268

merged 10 commits into from
Dec 6, 2023

Conversation

zwolf
Copy link
Member

@zwolf zwolf commented Nov 30, 2023

Adds the Confirmable module for Devise along with the requisite database attributes. A "please confirm your email address" email is now sent to the user on account creation. That email is using the default template (located here) and can be updated if desired.

When a user creates a new account, the front end should inform them that they will receive a confirmation email (this currently happens on Panoptes' own reg page, but no one uses it). The link in that email will point to Panoptes directly so that the API can process the user's confirmation token. That "thank you for confirming" event will likely have to be updated to redirect to wherever makes the most sense since that form currently just refreshes the panoptes API home page. Right now, successful I am redirecting successful confirmations to the zooniverse.org (production) home page. Is there a way to ensure the registration modal opens on PFE? I can include a query param that can trigger a "thank you for confirming your email address!" welcome flash message. Is that worth integrating into PFE, or should that wait until FEM is at the site root? This is a todo and should be figured out & updated before this deploys to production.

Also, when the user is confirmed they will then receive the standard Zooniverse welcome email. For reference, that template is located here and hasn't needed to be updated in a while.

Finally: there's a rake task to backfill all existing users with a confirmed_at value. This field is going to be used by Talk in order to prevent unconfirmed users from interacting with Talk beyond viewing public posts. This PR must be merged and this backfill run before the Talk PR merges.

This is gonna need a bit of hands on testing on staging, so once this and the Talk PR merge, that'll be the focus till production can be deployed safely.

Review checklist

  • First, the most important one: is this PR small enough that you can actually review it? Feel free to just reject a branch if the changes are hard to review due to the length of the diff.
  • If there are any migrations, will they the previous version of the app work correctly after they've been run (e.g. the don't remove columns still known about by ActiveRecord).
  • If anything changed with regards to the public API, are those changes also documented in the apiary.apib file?
  • Are all the changes covered by tests? Think about any possible edge cases that might be left untested.

app/controllers/confirmations_controller.rb Show resolved Hide resolved
app/models/user.rb Show resolved Hide resolved
config/routes.rb Show resolved Hide resolved
@@ -872,42 +883,42 @@ def dormant_user_ids(num_days_since_activity=5)
end
end

describe "#send_welcome_email after_create callback" do
let(:user) { build(:user) }
describe "#send_welcome_email on confirm" do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style/StringLiterals: Prefer single-quoted strings when you don't need string interpolation or special symbols.

let(:user) { build(:user, confirmed_at: nil, confirmation_sent_at: nil) }

it 'sends a confirmation email' do
expect_any_instance_of(User).to receive(:send_confirmation_instructions).once
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSpec/AnyInstance: Avoid stubbing using expect_any_instance_of.
RSpec/DescribedClass: Use described_class instead of User.

@@ -313,8 +313,8 @@
expect(User.where(login: user_attributes[:login])).to_not exist
end

it "should not queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to_not receive(:perform_async)
it "should not send a confirmation instructions email" do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style/StringLiterals: Prefer single-quoted strings when you don't need string interpolation or special symbols.
RSpec/ExampleWording: Do not use should when describing your tests.

it "should queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to receive(:perform_async)
it "should send a confirmation instructions email" do
expect_any_instance_of(User).to receive(:send_confirmation_instructions).once
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSpec/AnyInstance: Avoid stubbing using expect_any_instance_of.

@@ -279,8 +279,8 @@
post :create, params: { user: user_attributes }
end

it "should queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to receive(:perform_async)
it "should send a confirmation instructions email" do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style/StringLiterals: Prefer single-quoted strings when you don't need string interpolation or special symbols.
RSpec/ExampleWording: Do not use should when describing your tests.

it "should not queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to_not receive(:perform_async)
it "should not send a confirmation instructions email" do
expect_any_instance_of(User).to_not receive(:send_confirmation_instructions)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSpec/AnyInstance: Avoid stubbing using expect_any_instance_of.
RSpec/NotToNot: Prefer not_to over to_not.

@@ -212,8 +212,8 @@
end
end

it "should not queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to_not receive(:perform_async)
it "should not send a confirmation instructions email" do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style/StringLiterals: Prefer single-quoted strings when you don't need string interpolation or special symbols.
RSpec/ExampleWording: Do not use should when describing your tests.

it "should queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to receive(:perform_async)
it "should send a confirmation instructions email" do
expect_any_instance_of(User).to receive(:send_confirmation_instructions).once
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSpec/AnyInstance: Avoid stubbing using expect_any_instance_of.

@@ -149,8 +149,8 @@
post :create, params: { user: user_attributes }
end

it "should queue a welcome worker to send an email" do
expect(UserWelcomeMailerWorker).to receive(:perform_async)
it "should send a confirmation instructions email" do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style/StringLiterals: Prefer single-quoted strings when you don't need string interpolation or special symbols.
RSpec/ExampleWording: Do not use should when describing your tests.

@@ -72,8 +72,9 @@
expect(response.status).to eq(200)
end

it "should not send an email to the account email address" do
expect(ActionMailer::Base.deliveries).to be_empty
it 'should send confirmation instructions to the account email address' do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSpec/MultipleExpectations: Example has too many expectations [2/1].
RSpec/ExampleWording: Do not use should when describing your tests.

@zwolf zwolf requested a review from yuenmichelle1 December 5, 2023 21:36
@zwolf
Copy link
Member Author

zwolf commented Dec 5, 2023

I apologize for the Hound, but these are some deep pages that are written in the olde ways. Didn't wanna rock the boat too much and make this even more annoying to review. Most all of it is syntax or "probably don't write specs this way" when all the other specs are written that way. Please lmk if I missed anything significant, though.

Copy link
Collaborator

@yuenmichelle1 yuenmichelle1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine to me.
Some questions that you might know the answer to or answers come up through testing:

  • If a user loses their confirmation email, (eg. never confirmed after a long time and now cannot post to talk because they are unconfirmed or another eg. If a person changes their email because they an created account on an email address they lost access to), is there a way to resend confirmation email?
  • How long are confirmation_tokens good for? ^ related to above

@zwolf
Copy link
Member Author

zwolf commented Dec 6, 2023

If a user loses their confirmation email, (eg. never confirmed after a long time and now cannot post to talk because they are unconfirmed or another eg.

There's a form at panoptes.zooniverse.org/users/confirmation, but no one uses those. One of the front end UX things we might need is a form/button pointed at the appropriate devise route in the user settings area to resend the email.

If a person changes their email because they an created account on an email address they lost access to), is there a way to resend confirmation email?

If they confirmed with us once, that's good enough for me. No re-confirmation necessary.

How long are confirmation_tokens good for? ^ related to above

Forever, they don't appear to change or expire.

@zwolf zwolf merged commit f91d2eb into master Dec 6, 2023
8 checks passed
@zwolf zwolf deleted the email-verification branch December 6, 2023 19:09
@lcjohnso lcjohnso mentioned this pull request Mar 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants