speezepearson
commented
3 years ago This will require some amount of work revamping the registration/login flow. Desiderata:
- There must be a 1:1:1 correspondence between accounts, usernames and email addresses.
- An account should never be in a weird semi-registered state: it should either exist and be fully formed and verified; or not exist.
- It should retain the possibility of letting a users log in via magic link.
Tentative idea:
- Have a signup form, with two fields: "username" and "email address." On submission, if the username/email are both free, send the email address a magic link that contains: the username; the email address; the URL that the user should be redirected to after registration; and a signature, of course.
- When that link gets clicked, if the username/email are both still free, then create the account and redirect the user to the desired destination.
There are getting to be a lot of situations where I might want to send you, a user, a notification:
It would simplify my life somewhat if I could assume that every user had an email address, so that I didn't have to have code scattered across the whole UI layer that checks whether the current user has one or not, and if not, shows them an email verification widget.