janko / rodauth-rails

Rails integration for Rodauth authentication framework
https://github.com/jeremyevans/rodauth
MIT License
571 stars 40 forks source link

Reuse Rodauth config in custom Mailer #141

Closed benoror closed 2 years ago

benoror commented 2 years ago

Follow up to: https://github.com/jeremyevans/rodauth/issues/251

To avoid that divergence, wondering if it would be good idea to keep default Mailers behaviors as close as possible to Rodauth's, for example:

to: field and body: via a proxy instance var:

-    @email_link = email_link(name, :verify_account, account_id, key)
+    @email_link = rodauth(name).verify_account_email_link
+    @body = rodauth(name).verify_account_email_body
+
-    mail to: @account.email, subject: rodauth(name).verify_account_email_subject
+    mail to: rodauth(name).email_to, subject: rodauth(name).verify_account_email_subject

https://github.com/janko/rodauth-rails/blob/main/lib/generators/rodauth/templates/app/mailers/rodauth_mailer.rb#L6

- Someone has created an account with this email address.  If you did not create
- this account, please ignore this message.  If you created this account, please go to
- <%= @email_link %>
+ <%= @body %>
- to verify the account.

https://github.com/janko/rodauth-rails/blob/main/lib/generators/rodauth/templates/app/views/rodauth_mailer/verify_account.text.erb

janko commented 2 years ago

Initially, rodauth:install didn't generate the mailer, so all email headers were set from Rodauth config, and you could run a separate rodauth:mailer generator. However, I had decided to merge it into rodauth:install, because when someone wants to change the default body, it's much easier to do so via mailer templates.

Initially, the mailer received all parameters needed for the email body in arguments, but that meant potentially exposing secrets such as tokens and emaila via logs, and it didn't work with API + SPA that live on different domains. So, the mailer arguments now only receive raw tokens and no email addresses, so the mailer needs to do more work.

Note that the code changes to do what you want would have to be more complicated than what you've shown, as certain instance variables need to be set. I found it to require less code to reimplement part of the logic, and I'm relying on developers looking at the generated mailer, which should make it clear to them that Rodauth config such as *_body or email_to won't apply.

Since this is not a bug, I'm moving it to discussions.