stadust / pointercrate

Rewrite of the https://pointercrate.com backend in Rust
MIT License
78 stars 50 forks source link

Consider adding email verification for password resets #65

Closed ZeroIntensity closed 1 month ago

ZeroIntensity commented 2 years ago

i saw this conversation in the pointercrate discord earlier:

image

its not exactly great that pointercrate doesn't have this, and shouldnt be super hard to implement.

you can set up a mail server with docker and use some rust mail library (such as lettre) for email sending.

qimiko commented 2 years ago

it's worth noting that the code currently "supports" associating emails with profiles for the purpose of resetting passwords, although i'm pretty sure this code is incomplete and doesn't support sending emails just yet (or even has a button for password reset). also a mail server is kinda overkill for just sending emails imo, but that's a story for another day

judging by the message in commit 09ab828b1f558c88467b4435322d44cdcb446a45, the account system may be scrapped in favor of using google accounts for auth, which would eliminate this problem anyways.

stadust commented 2 years ago

Yes, as @qimiko says, I do plan to replace the current log-in system with google oauth logins, as that will also allow me to automate more parts of the verification process. I just haven't had the time to look into it yet :(

stadust commented 1 month ago

We won't be adding e-mail verification for native pointercrate account, instead focusing on adding google oauth integration and encouraging people to migrate (also by disabling legacy account creation). See also #127 and #135