Recover accounts stuck behind an expired activation link - #826
Merged
Merged
Conversation
An activation link older than a day was a dead end: the account stayed inactive, registering again answered success and sent nothing, and the password reset could not reach an account that never activated (#810). Re-registration now reads the address's own state and answers only in the mailbox: a pending registration gets a fresh activation link, and an active account gets a notice -- the same success body either way, so the browser still cannot tell who exists -- carrying a reset link, the way in that never assumes the password still works. The page behind an activation link no longer activates on visit either: a mail preview or link scanner following the URL found the token spent by the on-mount POST. Activation now happens on the button, and the reset page was already submit-driven. Token digesting moves to a shared helper, since registration now stores reset digests too.
…tivation-recovery
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #810.
The dead end. An expired activation link left the account inactive forever: re-registering the address hit the silent
{success: true}no-op, and password reset requires an active account.Registration as the recovery path.
POST /api/registerfor an existing address now answers success as always, and lets the mailbox say what actually happened (only when outgoing mail is configured):refreshActivationToken, status-gated), resend the activation mail;Both branches sit behind the register throttle, which moved ahead of them now that the route can send more than one kind of mail (ADR 0004's request-counter pattern).
Links survive being looked at. The SPA activation page no longer POSTs on mount — a scanner or mail preview executing the page used to consume the token. It now shows a confirmation with an Activate account button; the reset page was already submit-only, and opening either link changes nothing.
Tests. Route tests pin the fresh-activation and account-exists branches (and the no-mutation guarantee without mail), the mail-sender spec pins the notice's exact payload, and a browser spec proves a visit sends nothing while the button sends exactly one POST. Token digesting is shared via
#shared/util/token-digest.tsnow that two routes store digests.