Allow user authentication from email links #861
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Note: this PR replaces #858
As part of #829 I would like to authenticate users right from emails. This PR sets the foundations to do this.
So far we authenticated users using
matches
' tokens orslot_alerts
's tokens.Now we need
users
' tokens: we need communication unrelated to any of the above events.Details
No functional changes should be part of this PR.
It adds a concern for controllers
UserAuthenticationViaSignedId
that complements the usual devise/warden authentication using anauthentication_token
based on globalid.It creates a single partial to DRY those routes:
users#destroy
,matches/users#destroy
, andslot_alerts/users#destroy
.Also DRY those views:
slot_alerts/users#edit
, andmatches/users#edit
... into
users/_confirm_destroy_message
.The goal is to reuse
confirm_destroy_profile_path
from email and sign it with an authentication token.This
users#confirm_destroy
action looks like this:Poke @mininao as you authored the original issue.
The next steps are:
rake
task to identify the appropriate usersconfirm_destroy_profile_path
with an auth tokenmatches
's emails (andslot_alers
's ones) when offering the user the ability to remove themselves from the list