search

notmarkmiranda / dozen

3 stars 0 forks source link

SPIKE: Memberships #129

Open notmarkmiranda opened 4 years ago

notmarkmiranda commented 4 years ago

Thoughts:

mcassano commented 4 years ago

User should be able to be tied to a league but not emailed AND that person should later be able to join the site.

notmarkmiranda commented 4 years ago

How would that work? Not validating on email address? And how would you prevent someone from just stealing accounts by signing up with already used emails?

I could see a situation where an account is "unconfirmed" and attempting to sign up would fire off an email that would allow the user to sign up and see all the leagues they are already a part of.

mcassano commented 4 years ago

I'm not concerned with someone stealing registrations from other people: bots won't know valid email addresses (and they have to click confirmation emails after registration even if they did) and someone who does know a valid email address won't be maliciously stealing registrations. And if they did you could yell at them and clean up the mess.

In regards to how to do it, yea it won't be trivial but shouldn't be too complex. Something along the lines of: 1) A email is used in a league without the person knowing 2) That person now wants an account so they attempt to register 3) The registration system looks up whether the email is used and tries to re-use it instead of making a new user.