liqd / adhocracy-plus

adhocracy+ is a SaaS platform to make digital democracy easy for everyone
https://adhocracy.plus/
GNU Affero General Public License v3.0
73 stars 20 forks source link

#8102 [Z:T] Enable more SSOs on a+: Issue with Duplicate Registration Email and Confirmation Handling #2606

Closed sblindow closed 1 month ago

sblindow commented 2 months ago

Expected Behavior: When a user attempts to register with an email address already associated with an existing account (either social or normal email account), they should:

  1. Receive an email reminding them of their existing account and providing instructions for password reset.
  2. See the standard "we have sent you a confirmation link" message on the website to prevent unauthorized users from determining if an email is registered.

Current Behavior: When registering with a social account, email confirmation is not mandatory. This can cause confusion if the user forgets they used social login and tries to register again using the same email, resulting in an error and preventing successful registration/ handling of the duplicate accounts.

Steps to Reproduce

  1. Register on the website using a social account (e.g., Google, Facebook) without confirming the email.
  2. Log out.
  3. Attempt to register again using the same email address (either through a social account or normal email registration).

Screenshots Error message after attempting to register with an e-mail adress that is already linked to a social account but hasn't been confirmed in that account.

Bildschirmfoto 2024-05-15 um 09 44 36
m4ra commented 1 month ago

@TeaJayyy I guess this should go to the release milestone too

TeaJayyy commented 1 month ago

@m4ra Yes, thx

m4ra commented 1 month ago

To clarify here, social accounts shouldn't include email verification, as they are verified by the social provider already, and if they had to verify again, it would defeat the purpose of registering with a social account. So we are removing the unique email constrain, as this is also not standard practice for django. And social accounts registration can be linked to existing accounts if emails are same. @TeaJayyy @sblindow