search

commitsto / commits.to

Real-time commitment tracking
http://commits.to
MIT License
40 stars 20 forks source link

Can't create promises (for new username?) #313

Open artemiswkearney opened 5 years ago

artemiswkearney commented 5 years ago

I've tried to load http://arti.commits.to/test_promise from many browsers, both desktop and mobile. The "Creating your promise..." progress bar consistently stops at 80%.

artemiswkearney commented 5 years ago

Update: does seem to be related to the user being new! Manually POSTing commits.to/api/v1/user/create with body { "username":"arti" } made promise creation via arti.commits.to work.

dreeves commented 5 years ago

Hi Arti! Nice work figuring this out and filing a gissue! That alone probably means you can go to the front of the list for a beta account, but we are still manually approving those! So let's chat by email and I can give you the spiel. (Roughly, having a beta account and reserving a username means committing (!) to help with development of commits.to!)

ghost commented 3 years ago

I think that this account creation policy/process/etc should be documented on the main README of this repo and/or on the webiste home page.

also, is there authentication to make sure that someone does not create commitments on another user's account?

kingdonb commented 1 year ago

There is no authentication at all. And it has occasionally been a problem, but not one that we can solve easily without making compromises. It might be time to add authentication.

The understanding I got from reading the spec (a long time ago) was that you should be able to fire-and-forget promises in an e-mail, and when the person you promised it to "clicks through" then it triggers the javascript person-detector and lets the promise be created, on GET. So if that person is never interested enough in the thing you said you'd do to check if you did it, you are never placed "on the hook" for making that promise and it doesn't count against you.

It's not part of the spec that others should be able to spam promises into your queue without your permission. I'm not sure how to reconcile those goals.