To avoid needing to store the credentials for students while we are waiting for them to register, we can switch from pre-generating the credentials when making the accounts to generating them on the fly when the student registers.
In order to represent the state of an account for a student that hasn't registered yet, we need to introduce the possibility of an account having a null password hash. Logic is added to the credential checking function to block access to such accounts until a password hash has been set.
The existing support for creating accounts with passwords is not affected, though the old registration table is removed, so it is no longer possible to create an account with specific credentials that can be retrieved using the registration page. Only a new randomly generated password for an account with no password hash and a given student ID can be obtained.
To avoid needing to store the credentials for students while we are waiting for them to register, we can switch from pre-generating the credentials when making the accounts to generating them on the fly when the student registers.
In order to represent the state of an account for a student that hasn't registered yet, we need to introduce the possibility of an account having a null password hash. Logic is added to the credential checking function to block access to such accounts until a password hash has been set.
The existing support for creating accounts with passwords is not affected, though the old registration table is removed, so it is no longer possible to create an account with specific credentials that can be retrieved using the registration page. Only a new randomly generated password for an account with no password hash and a given student ID can be obtained.