search

code4romania / de-urgenta-android

De Urgență mobile app (Android)
Mozilla Public License 2.0
4 stars 16 forks source link

Clarification for password reset #75

Open lukstbit opened 3 years ago

lukstbit commented 3 years ago

@aniri Is the backend completely implemented for resetting the password?

I see the endpoint /auth/request-reset-password which has a correspondence to a screen in the application (02.2) , but this endpoint seem to just send a reset email.

For screen 02.3 I'm assuming that we should hit endpoint /auth/reset-password, but what should we use for userId and resetToken if the previous endpoint doesn't return anything?

Any thoughts on this?

aniri commented 3 years ago

@lukstbit It seems the reset email has a reset link in it that has the userId and resetToken as query params. We should check if we can use it as a deep link to the 02.3 screen. Or adjust it accordingly from the backend app :D

What do you think?

lukstbit commented 3 years ago

Yes, we could use that url as a deep link if it has those parameters. The problem with this approach is that we will be competing with other apps handling urls(like web browsers) so the user should be informed in that email that he is to handle the reset link with our app in order to reset his password.

aniri commented 3 years ago

good point! @lukstbit thanks for the suggestion!

lukstbit commented 2 years ago

@aniri I looked at this and a deep link would work. However, I don't think it is a good experience for the user, it's kind of weird. I think it would be better to have the password reset implemented on the client side. This way the password reset will be similar to most applications/websites and it should be really easy to implement in the web vs complicating the app logic(and duplicating it on the two platforms).

Let me know what you think. If you want to have the password reset in the app I'll make a PR tomorrow or saturday.

aniri commented 2 years ago

@lukstbit fair enough :D let's not overcomplicate things. we'll postpone this until after we finish the client part and see if it would be enough :)