search

lichess-org / lila

♞ lichess.org: the forever free, adless and open source chess server ♞
https://lichess.org
GNU Affero General Public License v3.0
14.88k stars 2.21k forks source link

Allow signing up a bot with duplicate email #14878

Open greg-finley opened 4 months ago

greg-finley commented 4 months ago

If I have just a single email address, it's hard to sign up for a bot account if I already have a personal account. Lichess will stop myemail+botname@gmail.com as a duplicate on signup before I can register and make the account into a bot.

What about https://lichess.org/signup-bot or something that isn't as strict with duplicate emails and automatically makes it a bot account?

Also, I'm assuming it's ok to make several distinct bots?

ornicar commented 4 months ago

It's possible to log in with your email address instead of your username, so it's not possible to have several active username for one email address.

greg-finley commented 4 months ago

Gotcha. Maybe the best workaround is for the user to find a different email.

But I could also see a “create bot account” endpoint you call from a non-bot account. You could give name and password and it returns an auth token.

ornicar commented 4 months ago

Yes... but it's also quite useful for a bot account to be able to browse the site normally. Some bot owners rely on the UI for sending/accepting challenges for example.

ornicar commented 4 months ago

Class students are already alike what you're wishing for, I think. But they're also a flood target. That's because any way to create user accounts without the third party verification of a trusted provider is a target for attackers.

greg-finley commented 4 months ago

Yeah agree on the risk factor. Not sure the right answer. "Create bot account" endpoint could require user+password and you can use those to log into the UI.