Implement server invite codes #37
Conversation
This introduces the ability for a YeetFile instance admin to send out invites to a list of emails with unique signup codes. These signup codes are tied to the email they're sent to, and are removed after a user completes registration using that email and signup code. The invite codes are not stored in plaintext anywhere. They are hashed with bcrypt before storing in the database, and are only included in plaintext in the outbound email. Enabling invite codes requires the following conditions: - YEETFILE_ALLOW_INVITES set to 1 - YEETFILE_SERVER_PASSWORD set to a non-empty string - YEETFILE_EMAIL_* variables set
| var inviteBodyTemplate = template.Must(template.New("").Parse( | ||
| "Hello,\n\nYou have been invited to join a YeetFile instance at this " + | ||
| "domain: {{.Domain}}\n\n" + | ||
| "YeetFile is an open source platform that allows encrypted file " + | ||
| "sharing and storage.\n\n" + | ||
| "To create an account, you can use the following link:\n\n" + | ||
| "{{.Domain}}{{.Endpoint}}?email={{.Email}}&code={{.Code}}")) |
There was a problem hiding this comment.
@NaLiJa is this invite email template good enough for now? I'm thinking we can modify this as needed during the localization efforts.
|
@NaLiJa let me know if the process I described in the PR description sounds good to you, and if you want to pull the branch ( |
|
Yes, this sounds exactly as needed! Fantastic! My quick tests with the invite-codes branch were successful! |
|
Nice, thanks for reviewing! I'll add the systemd config to the readme after I merge this |
This introduces the ability for a YeetFile instance admin to send out invites to a list of emails with unique signup codes. These signup codes are tied to the email they're sent to, and are removed after a user completes registration using that email and signup code. The code a user receives cannot be used to sign up for an ID-only account, and cannot be used to sign up with a different email address.
The invite codes are not stored in plaintext anywhere. They are hashed with bcrypt before storing in the database, and are only included in plaintext in the outbound email. When a user clicks the signup link in the email they received, the code is used to autofill the server password field, and does not require any further interaction from the user.
Enabling invite codes requires the following conditions:
YEETFILE_ALLOW_INVITESset to1YEETFILE_SERVER_PASSWORDset to a non-empty stringYEETFILE_EMAIL_*variables setYEETFILE_INSTANCE_ADMINset to the email address or account ID for the preferred admin userCloses #36