aglinxinyuan commented on code in PR #7978:
URL: https://github.com/apache/texera/pull/7978#discussion_r3888074125
##########
common/config/src/main/resources/user-system.conf:
##########
@@ -45,6 +45,20 @@ user-sys {
invite-only = false
invite-only = ${?USER_SYS_INVITE_ONLY}
+ # Whether an address the user typed must be proved by a code mailed to it
before it is accepted —
+ # at registration, and when an account with no address on file supplies one.
An address a provider
+ # asserts as verified (Google's `email_verified`) is trusted and never
re-checked.
+ #
+ # On by default: an unproven address is the weaker position, so a deployment
opts out of checking
+ # rather than into it.
+ #
+ # This and google.smtp.gmail above have to agree. On with no sender
configured is a
+ # misconfiguration, not a degraded mode: the code cannot be sent, so
registration and the
+ # add-address prompt both refuse with a 503 naming the two settings. Turn
this off if you are not
+ # configuring SMTP — including for local development.
+ email-verification = true
Review Comment:
Make the value false here. The default value here is mainly used for local
developers. Production will override it with "USER_SYS_EMAIL_VERIFICATION".
##########
amber/src/main/scala/org/apache/texera/web/model/http/response/RegistrationResponse.scala:
##########
@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.texera.web.model.http.response
+
+/**
+ * What a registration attempt produced. A null `accessToken` *is* the "a
code was mailed, nothing
+ * created" signal, reported no other way so the two cannot drift apart.
Distinct from
+ * [[TokenIssueResponse]] only because that one promises a token.
+ */
+case class RegistrationResponse(accessToken: String)
Review Comment:
Is this the same code as the one in UserRegistrationRequest? If so, can we
use the same name?
##########
frontend/src/app/hub/component/login/texera-login.component.html:
##########
@@ -114,7 +114,21 @@
Password must be at least 6 characters. After registering, contact the
Texera administrator to activate your
account.
</p>
- }
+
+ <!-- Only where verification is on: the account is not created until this
code comes back. -->
+ @if (awaitingCode) {
Review Comment:
Don't need to check awaitingCode here. Just show this box in the first place
to give the user the right expectation.
##########
frontend/src/app/common/service/gui-config.service.mock.ts:
##########
@@ -34,6 +34,7 @@ export class MockGuiConfigService {
localLogin: true,
googleLogin: true,
inviteOnly: false,
+ emailVerification: true,
Review Comment:
Make this false
##########
frontend/src/app/hub/component/login/texera-login.component.ts:
##########
@@ -208,20 +232,51 @@ export class TexeraLoginComponent implements OnInit {
return;
}
+ // Second half of a verified signup: the account does not exist yet, so
send the same fields
+ // back with the code rather than registering again.
+ if (this.awaitingCode) {
+ const code = (this.form.get("code")?.value ?? "").trim();
+ if (!code) {
+ this.errorMessage = "Enter the code that was emailed to you.";
+ return;
+ }
+ this.userService
+ .registerVerify(username, email, password, code)
+ .pipe(
+ catchError((e: unknown) => {
+ this.errorMessage = reasonFor(e) || "That code is not valid or has
expired.";
+ return throwError(() => e);
+ }),
+ untilDestroyed(this)
+ )
+ .subscribe(() => {
+ this.awaitingCode = false;
+ this.notificationService.success(
+ "Your account has been created. Please contact the Texera
administrator to activate your account."
+ );
+ });
+ return;
+ }
+
this.userService
.register(username, email, password)
.pipe(
catchError((e: unknown) => {
- this.errorMessage = (e as Error)?.message || "Registration failed";
+ this.errorMessage = reasonFor(e) || "Registration failed";
return throwError(() => e);
}),
untilDestroyed(this)
)
- .subscribe(() =>
+ .subscribe(({ verificationRequired }) => {
+ if (verificationRequired) {
+ this.awaitingCode = true;
+ this.notificationService.success(`A verification code has been sent
to ${email}.`);
Review Comment:
Make the code input a separate field with a button next to it, such as “Get
Code.” Don’t merge the code-sending logic into the Sign Up button, since the
user may not have given us permission to send an email to their inbox. Having a
separate button makes it clear that clicking it will trigger a code to be sent
to them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
