ETQ Usager se connectant par FC, je dois confirmer mon mail

[kara22]

10425

Etape 1 :

Etape 2 :

Étape 3 (en cas de changement de mail) :

Etape 4 :

Etape 5 : confirmer le mail

Etape 6 : le mail est confirmé

[what-the-diff[bot]]

PR Summary

• Introduction of Email Selection Method The ParticulierController has been updated with a new method named choose_email. This method aims to set the @france_connect_email variable.

• User Association Process Enhancement A new associate_user method has been added to ParticulierController. This enhancement will obtain the 'fci' object from the session and link it with a user using the provided email.

• Added Support for Rendering Partials An email_field method, which allows for the rendering of a partial, has been integrated into the ParticulierController.

• Incorporation of FranceConnectController TypeScript Class A new TypeScript class, FranceConnectController, has been added, introducing toggleEmailField and connect methods to the project.

• Installation of Additional View Files Two new view files have been included; choose_email.html.haml and confirmation_sent.html.haml to enhance user experience and functionality.

• Language Localization Support New translations strings were added to the en.yml and fr.yml locale files, providing English and French language support for the new views.

• Improvements to User Confirmation Process The associate_user! method in the FranceConnectInformation model has been altered. The confirmed_at variable assignment has been dropped in favor of employing send_confirmation_instructions on the created user.

• Update to Application Routes The application routes have been updated to incorporate the new methods added in the ParticulierController and FranceConnectController.

[codecov[bot]]

Codecov Report

Attention: Patch coverage is 97.89474% with 2 lines in your changes missing coverage. Please review.

Project coverage is 84.61%. Comparing base (0b8212f) to head (5e2cc74).

Files with missing lines	Patch %	Lines
...ntrollers/france_connect/particulier_controller.rb	97.26%	2 Missing :warning:

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #10570 +/- ## ========================================== - Coverage 84.64% 84.61% -0.04% ========================================== Files 1121 1121 Lines 24816 24837 +21 Branches 4615 4622 +7 ========================================== + Hits 21005 21015 +10 - Misses 3811 3822 +11 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[mfo]

amélioration pour la saisie du mail alternatif (on a un 'helper' pour detecter les typos, autant s'en servir ici pour se faciliter la vie au support) :

0001-feat-france_connect-choose_email-prevent-bad-email.patch

[mfo]

🔴 ETQ usager me connectant avec FC, lorsque je demande a être notifié sur un mail spécifique, si j'utilise un email existant => 500 🟢 ETQ usager me connectant avec FC, lorsque je demande a être notifié sur un mail spécifique, si j'utilise un email existant => je suis encouragé a faire une demande de reset password

0001-feat-particulier-associate_user-catch-email-already-.patch

[mfo]

J'ai l'impression que l'écran pour choisir son email via une connection FC n'est pas clair :

En substance, après une création de compte par email, qui lui est clair :

@kara22 , moyen que tu clarifies le truc ?

[mfo]

L'écran de demande de confirmation d'email etait un peu brut :

Maintenant il brille

0001-feat-particulier-confirm_email-nicer.patch

[mfo]

C'est un premier bout de revue fonctionnelle (ac un peu de code ou Sim ne s'etait pas trop exprimé). Cependant pas facile de relire la ou il y a encore pas mal de suggestion de Sim : j'attends que vous vous accordiez/mergiez les suggestions déjà ouverte avant de venir en rajouter.

Donc je m'arrete la pour le moment. @kara22, souhaites tu merger les patchs toi même ou je push ? dis moi ce que tu préfère

[gitguardian[bot]]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

| GitGuardian id | GitGuardian status | Secret | Commit | Filename | | | -------------- | ------------------ | ------------------------------ | ---------------- | --------------- | -------------------- | | [6306805](https://dashboard.gitguardian.com/workspace/385435/incidents/6306805?occurrence=164652935) | Triggered | Generic Password | eaef5c7e39f71707dd7be60d09bdd1df08375be9 | spec/controllers/france_connect/particulier_controller_spec.rb | [View secret](https://github.com/demarches-simplifiees/demarches-simplifiees.fr/commit/eaef5c7e39f71707dd7be60d09bdd1df08375be9#diff-bfc7f768a8a7787ee7ecdec308bf66557da31535236f923daab41e83085a764dR397) | | [6306805](https://dashboard.gitguardian.com/workspace/385435/incidents/6306805?occurrence=164652936) | Triggered | Generic Password | eaef5c7e39f71707dd7be60d09bdd1df08375be9 | spec/controllers/france_connect/particulier_controller_spec.rb | [View secret](https://github.com/demarches-simplifiees/demarches-simplifiees.fr/commit/eaef5c7e39f71707dd7be60d09bdd1df08375be9#diff-bfc7f768a8a7787ee7ecdec308bf66557da31535236f923daab41e83085a764dL582) |

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code. 2. Replace and store your secrets safely. [Learn here](https://blog.gitguardian.com/secrets-api-management?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) the best practices. 3. Revoke and [rotate these secrets](https://docs.gitguardian.com/secrets-detection/secrets-detection-engine/detectors/generics/generic_password#revoke-the-secret?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). 4. If possible, [rewrite git history](https://blog.gitguardian.com/rewriting-git-history-cheatsheet?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data. To avoid such incidents in the future consider - following these [best practices](https://blog.gitguardian.com/secrets-api-management/?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) for managing and storing secrets including API keys and other credentials - install [secret detection on pre-commit](https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[marleneklok]

Quelques recos ergo/UX (le dernier écran "Confirmez votre adresse / connexion par mail" reste à rediscuter) : UX_Connexion avec FranceConnect.pdf