User creation and password handling

[adamspd]

Describe the bug

Email Verification: Automatically creating a user and setting their password might pose a security risk, especially if the user is unaware that an account has been created for them.

Password Handling: Setting a predictable password (like combining website name and current year) is not secure.

The faulty code

def create_new_user(client_data: dict):
    CLIENT_MODEL = get_user_model()

    # Check if client_data has first_name and last_name
    if 'first_name' not in client_data or 'last_name' not in client_data:
        # Assuming 'name' contains a single space between first and last name.
        client_data['first_name'], client_data['last_name'] = parse_name(client_data['name'])

    try:
        # Check if the 'username' field exists in the User model
        CLIENT_MODEL._meta.get_field('username')
        user = create_user_with_username(client_data)
    except FieldDoesNotExist:
        user = create_user_with_email(client_data)

    password = f"{get_website_name()}{get_current_year()}"
    user.set_password(password)  # Use set_password to ensure the password is hashed
    user.save()

    return user

Expected behavior

• It's a good practice to send an email verification link to the user's email address, allowing them to set or reset their password.
• Generate a random password and send a password reset or account activation link to the user's email. This ensures the user can set their password securely.

Possible Solution See above