Feature Request: User accounts & session handling

[TemperGrace]

What are you wanting to be added?

I'm going to write this as if none of this is currently implemented as I'm unsure on the status.

Linked to backend issue https://github.com/leaderboardsgg/leaderboard-backend/issues/144

Goal: Create functionality for user registration, account verification, and session handling

Objectives:

• [x] A person must be able to create a user account via our account creation service.
  • Account creation must include key user identity details - a username, an email address, and a password. Constraints on key details should be presented/explained to the user on the form. We should explain to a user in this form what data we are storing, and the reasons behind it.
  • Validation: A username must be unique.
  • Validation: An email address must be unique.
  • Further details are not MVP.
  • A user's password must be properly secured immediately upon receipt.
  • https://github.com/leaderboardsgg/leaderboard-site/issues/563 This information must be validated immediately upon receipt; If it does not pass all requirements, the account creation must be rejected by sending the user back to the account creation form with all of their provided information pre-filled. The user must receive a negative feedback notice explaining what the specific validations issue(s) are/was.
  • Upon successful validation, a user account's details must be stored within the database. The user must be sent to the homepage and receive a positive feedback notice confirming successful account creation. The user should be informed that they've been sent a confirmation email.
• [x] #564
  • We do this by sending the user an email.
  • The email must contain a hyperlink that contains a URL token associated with their account by some method.
  • A confirmation email must be single use, so we need a way for it to be considered valid or invalid. (This is probably a backend task)
  • A confirmation email must only function for 1 hour, at which point it must become invalid.
  • If a hyperlink that is no longer valid is clicked, it must send the user to the homepage with a negative feedback notice explaining that the link has timed out and is no longer valid.
  • A valid hyperlink must send the user to a script page.
  • If the script page confirms that the email confirmation is valid, it must adjust their database entry's email confirmation status value to recognize confirmation.
  • The user must be sent to the homepage upon completion of the confirmation script, and receive a positive feedback notice confirming that their email has been successfully confirmed.
  • Email confirmation must be entirely decoupled from user session handling. This script should not log a user in immediately.
• [x] A user must be able to login by providing their account credentials
  • This option must be available on any page on the application
  • For MVP, it does not matter if they have extensive ways of logging in through Google etc. So long as they can, that is what matters.
  • Account credentials must include either username or email address, and password.
  • Passwords as received from the database will be secured, so the user's password value must be secured using the same method and the two secured passwords must be compared to verify the correct password. We do not de-encrypt the stored password.
  • If the user provides valid credentials, we must create a session for the user
• [x] #565
  • This must only be accessible if no session exists. A logged in user must not be able to access account recovery.
  • This script must require the user to input both their username and their email address.
  • We must verify and validate both username and email address before firing the account recovery email off
  • Upon successful verification, we must email the user with a hyperlink to a password reset script. This link must contain a URL token associated with their account by some method. We do not handle the actual recovery via the email.
  • An account recovery email needs to have a way to be considered valid or invalid.
  • An account recovery email must be single use. Upon successful use, it must become invalid.
  • An account recovery email needs to be valid for 1 hour, at which point it becomes invalid.
  • Sending an account recovery email must make any existing account recovery emails for the user invalid.
  • If a hyperlink that is no longer valid is clicked, it must send the user to the homepage with a negative feedback notice explaining that the link has timed out and is no longer valid.
  • A valid hyperlink must send the user to a form which allows them to input a new password.
  • The submitted password must be properly validated & secured immediately upon receipt.
  • Once validated and secured, their password must be adjusted in the database.
  • A successful password reset via account recovery must destroy a user's session if one exists as an additional protection.
• [x] A user with an active session must be able to logout
  • This option must be available on any page on the application; and replace the login button
  • We do not need to do any validation upon this script being actioned by the user, we can simply destroy the session.

What might break?

N/A

Relevant Issues

No response

[TemperGrace]

I've removed email confirmation as part of this flow as we're pivoting to a different implementation. Just for reference, this is the text that was removed:

• Even if a user's email address has not been validated, login will still be accepted. We will be presenting a limited session for users without an email confirmation.
  • If a user's email address has been validated, we must create a session for the user
  • [ ] If a user's login fails because the user's email address was not validated, they must not be logged in.
  • The person must be returned to the login form, and receive an error message explaining why their login was refused (below the submission button). Their provided username or email address should be retained and pre-filled in the form.
  • If login fails in this way, the person must be given the option to send an additional email confirmation to their email address. This should take the form of a hyperlink provided in the error message.
  • This email must only be sent if the user has an unconfirmed email address. If a user somehow else stumbles upon this script whilst having a confirmed email address, it must not be sent, and they must receive a positive feedback notice confirming that they have already confirmed their email address.
  • Successful deployment of this email must make any existing confirmation emails for the user invalid.

[TemperGrace]

erunks has created a test user on netlify;

Username is test@lb.gg and password is Pass1234