New authentication system about cmpd-holiday-gift HOT 5 CLOSED

@AndrewNatoli i think that would be the most secure option but agree that's probably way more than we need.

from cmpd-holiday-gift.

@jonvin006 We're changing how authentication works in the app from the above description

from cmpd-holiday-gift.

Changes to workflow:

Auth

1. User enters phone no.
2. If exists, enter login flow
3. If does not exist, enter registration flow

Registration

1. User registers (mobile phone no. required)
2. Request for Approval email is dispatched to admin with Approval CTA
   1. Admin clicks CTA
3. Admin logs in, approves user.
   1. Can view which app user registered from.
   2. Can select apps user has access to and access level.
4. Admin should be able to see which app the user registered from, then select each app the user should be able to access as well as the access-level for each app.
5. Approval email is dispatched to user notifying them that they can login.

Login

1. User enters phone number from registration
2. User sent login pin from Firebase
3. User enters login pin, Firebase token forwarded to server
4. Resolve user access & access level from token.
   1. If allowed access & enabled, user is logged in.
   2. If not allowed or disabled, shown inactivity page

from cmpd-holiday-gift.

@AndrewNatoli the main pieces that I am concerned about are the email CTAs. Our conversation about how easy it is for our user base to lose emails has kind of stuck in my head. Not sure of what a good solution to that problem would be though.

SMS would probably be the easiest user experience, but that's not free.

Push notifications would force users to auth with a browser that supports them.

Thoughts?

from cmpd-holiday-gift.

@chimon2000 Registration by counselors is typically done at their desk I imagine meaning they should have access to their email at the time they register. Logging in however they may be on a mobile device that they don't have access to their email on so I think overall the flow is fine.

We can also build out the admin to support showing registered users that have registered and verified, as well as the ones that have not verified their account yet.

An even crazier idea would be doing verification by phone. We have the school's number in the affiliation table; we could have the counselor put their extension in. But I think that's where we'd be going down the road of over-engineering 😆

from cmpd-holiday-gift.