Understand /register/complete page for resending confirmation email

[husky]

Hi,

i've setup a nodeBB setup a few weeks ago - thanks for this great software!

For testing reasons I created two instances on two different hosts so I have two working instances right now.
I opened registration on the productive instance a few days ago but actually some of the confirmation-emails are classified as spam by some mailserver so the users didn't confirmed there email address in time.

I've had a look for possibilities to enable users to resend this confirmation email and noticed that the /register/complete page is nearly exactly what I need. On the testing instance it works like a charm. Users just need to click the message informing about the missing email and could enter the e-mail again and trigger a new token for confirmation.

Apparently that does not work reliable on the productive setup. I've had a user where it worked exactly like on the testing instance but for some other it didn't. When these users try to open /register/open they are redirected to their profile-page. As well there is no information shown that the e-mail is missing.

Could you tell me on what it depends if the register/complete page is accessible? I've compared the settings for users and email in the acp but didn't found any differences that sounds like they could have an impact on that.

The productive instance is running v4.8.1 the testing is still on v4.8.0

Thank you very much!

[baris]

If users try to open /register/complete page directly and they are logged in they will be redirected to their profile page. When users click the alert popup about their email being unconfirmed, they are redirected to /user/<userslug>/edit/email. Which executes the below code to setup the /register/complete page for updating the email.

editController.email = async function (req, res, next) {
	const targetUid = await user.getUidByUserslug(req.params.userslug);
	if (!targetUid || req.uid !== parseInt(targetUid, 10)) {
		return next();
	}

	req.session.returnTo = `/uid/${targetUid}`;
	req.session.registration = req.session.registration || {};
	req.session.registration.updateEmail = true;
	req.session.registration.uid = targetUid;
	helpers.redirect(res, '/register/complete');
};

So you should tell them to go to the url forum.com/me/edit/email and hopefully that triggers the correct flow.

[husky]

@baris said in Understand /register/complete page for resending confirmation email:

If users try to open /register/complete page directly and they are logged in they will be redirected to their profile page. When users click the alert popup about their email being unconfirmed, they are redirected to /user/<userslug>/edit/email. Which executes the below code to setup the /register/complete page for updating the email.

editController.email = async function (req, res, next) {
	const targetUid = await user.getUidByUserslug(req.params.userslug);
	if (!targetUid || req.uid !== parseInt(targetUid, 10)) {
		return next();
	}

	req.session.returnTo = `/uid/${targetUid}`;
	req.session.registration = req.session.registration || {};
	req.session.registration.updateEmail = true;
	req.session.registration.uid = targetUid;
	helpers.redirect(res, '/register/complete');
};

So you should tell them to go to the url forum.com/me/edit/email and hopefully that triggers the correct flow.

Thanks, that seems to work well.

There are just two things that seem to be a bit strange to me:

• If you open that page and cancel the process, you are logged out from your account
• You are not able to leave this page except the two buttons at the end of this page. Every other link will return you to exactly that page

Maybe there is a way to fix it? Or is this the wanted behavior?

[baris]

Those seem to happen because this page is used in the /register flow and clicking cancel calls /register/abort and destroys the session. The reason why the user is redirected to this page is because if they started the flow they have something saved in req.session.registration.

authenticationController.registerAbort = async (req, res) => {
	if (req.uid && req.session.registration) {
		// Email is the only cancelable interstitial
		delete req.session.registration.updateEmail;

		const { interstitials } = await user.interstitials.get(req, req.session.registration);
		if (!interstitials.length) {
			delete req.session.registration;
			return res.redirect(nconf.get('relative_path') + (req.session.returnTo || '/'));
		}
	}

	// End the session and redirect to home
	req.session.destroy(() => {
		res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());
		res.redirect(`${nconf.get('relative_path')}/`);
	});
};

The below middleware redirects to /register/complete.

middleware.registrationComplete = async function registrationComplete(req, res, next) {
	/**
	 * Redirect the user to complete registration if:
	 *   * user's session contains registration data
	 *   * email is required and they have no confirmed email (pending doesn't count, but admins are OK)
	 */
	const path = req.path.startsWith('/api/') ? req.path.replace('/api', '') : req.path;
	if (meta.config.requireEmailAddress && await requiresEmailConfirmation(req)) {
		req.session.registration = {
		...req.session.registration,
			uid: req.uid,
			updateEmail: true,
		};
	}

	if (!req.session.hasOwnProperty('registration')) {
		return setImmediate(next);
	}

	const { allowed } = await plugins.hooks.fire('filter:middleware.registrationComplete', {
		allowed: ['/register/complete', '/confirm/'],
	});
	if (allowed.includes(path) || allowed.some(p => path.startsWith(p))) {
		return setImmediate(next);
	}

	// Append user data if present
	req.session.registration.uid = req.session.registration.uid || req.uid;

	controllers.helpers.redirect(res, '/register/complete');
};

[husky]

Thanks for the explanation!

Is there any chance to learn about this things?
Is this /me/edit/email documented anywhere? The docs found at docs.nodebb.org seem to be kind a outdated and incomplete in a way. Are there any other documentations?

[baris]

The docs for it is linked from docs.nodebb.org, it is actually here https://docs.nodebb.org/api/read/#tag/users/paths/~1api~1user~1{userslug}~1edit~1email/get