User Handling

[KrzysztofMadejski]

Needs

User: How I contributed to the cause?

• it drives motivation
• see stats for myself
• leave email to get summary of the campaign

User: Ease of participation

• less roadblocks (such as need to login) the better

Admin: Want to see statistics #13

• How many volunteers participated? #20
• How many volunteers are active?

Admin: Control

• Require authentication #60
• or allow anonymous contributions #59 #131
• mark entries from trolls as not counting for cross-checking

Admin: GDPR compliance

• show privacy policy
• ask user for confirmation when storing personal data (email)

• 139

System: Cross-checking

• Distinguish users in order for cross-check to behave ok
  • also when on the same IP (lan-party)

Cases

1. Allow anonymous contributions
2. Allow users to generate unique nicknames to see stats without the need to create account
3. Allow to create password-protected account

User identification

We need to identify and store separate users. Identification is done by

• IP (hashed)
• nickname (stored in cookie) - show warning if cookies are disabled
• login/pass information

Architecture

Extend Auth.User with additional fields as we will have quite custom auth mechanism.

Ref:

• https://docs.djangoproject.com/en/2.2/topics/auth/customizing/
• Custom user: https://www.fomfus.com/articles/how-to-use-email-as-username-for-django-authentication-removing-the-username
• Custom backend: https://stackoverflow.com/a/37332393/803174

Auth.User extra/changed fields:

• email is optional
• gdpr agreements
• password is optional (flag for when it is set)
• nickname (autogenerated)
• DisplayName (optional, use nickname if not set)

Tasks

• [x] Extend Auth.User to provide base for other mechanisms
• [x] Document configuration