Open concept lab/ocl issues#220: Detangle user account management from ocl_web and depend on ocl_api entirely

[karuhanga]

Done:

• Signup uses API entirely
• Login uses API entirely

To do:

• User profile page
• e2e tests
• Audit other uses of the User Model

Unknowns

• Email verification
• Password reset?

cc. @rkorytkowski

[rkorytkowski]

It looks good so far.

Could we configure oclapi to send verification e-mail upon user creation and provide a confirmation link to oclapi itself, which upon activating the account would simply redirect to oclweb? Oclweb would only show a static page with a message that the e-mail has been confirmed or that the activation link is not valid. The redirect link to oclweb can be hardcoded in oclapi (redirecting to the correct environment of course).

[karuhanga]

It looks good so far.

Could we configure oclapi to send verification e-mail upon user creation and provide a confirmation link to oclapi itself, which upon activating the account would simply redirect to oclweb? Oclweb would only show a static page with a message that the e-mail has been confirmed or that the activation link is not valid. The redirect link to oclweb can be hardcoded in oclapi (redirecting to the correct environment of course).

I'd shot you a quick email on this;

• The approach I was taking here was to create the user but keep them inactive until they activate the email. Do you think it would be better to keep this functionality in the API instead of this side?
• Throwing this out there as well: I could also see us encrypting the signup info and sending it as part of the activation email, that way we don't have to create the user until they've confirmed the email

As a side note, I am dropping this approach because the work that will go into making all-auth work with the custom email confirmation is greater than just rolling our own.

[rkorytkowski]

Yes, I think all logic including activation should be done by oclapi.

I would follow the usual process of creating an inactive account and confirming via e-mail.