Consider email colisions on omniauth-idmty

[basicavisual]

As a user, if my email was already registered on Decidimos Monterrey, and I create an account with IDMty that has the same email, I get a flash alert but it allows me to continue.

In this case I should either:

• be able to merge the accounts (preferable, since Decidim native login will eventually be phased-out) or
• instruct the user that they already have an account with this email and to login via username / password

[ghost]

Let's try to merge the accounts. 🙂

[ghost]

@basicavisual , the patch introduced on #148 fixed the "duplicated account" problem.

Now the transaction has enough information (i.e. email) to find the user instead of creating it. ¹

transaction do
  create_or_find_user
  @identity = create_identity
end

And just creating an identity for the user (associated with the OAuth provider).

This will enable the transition from Decidim's registration to IDMty.

The only problem is that the controller doesn't recognize that the user already had an account, so it asks again for the name and the alias (this is a bad).

I'm thinking to patch the following method ²:

def user_params_from_oauth_hash
  return nil if oauth_data.empty?

  {
    provider: oauth_data[:provider],
    uid: oauth_data[:uid],
    name: oauth_data[:info][:name],
    nickname: oauth_data[:info][:nickname],
    oauth_signature: OmniauthRegistrationForm.create_signature(oauth_data[:provider], oauth_data[:uid]),
    avatar_url: oauth_data[:info][:image],
    raw_data: oauth_hash
  }
end

To search for a user and plug the name and nickname.

def user_params_from_oauth_hash
  return nil if oauth_data.empty?

+  email = oauth_data.dig(:info, :email)
+  user = Decidim::User.find_by(email: email, organization: current_organization)

  {
    provider: oauth_data[:provider],
    uid: oauth_data[:uid],
+    name: oauth_data[:info][:name] || user&.name,
+    nickname: oauth_data[:info][:nickname] || user&.nickname,
    oauth_signature: Decidim::OmniauthRegistrationForm.create_signature(oauth_data[:provider], oauth_data[:uid]),
    avatar_url: oauth_data[:info][:image],
    raw_data: oauth_hash
  }
end

Now, this works. 🙂

Footnotes

1. https://github.com/decidim/decidim/blob/release/0.26-stable/decidim-core/app/commands/decidim/create_omniauth_registration.rb#L32-L34 ↩

2. https://github.com/decidim/decidim/blob/release/0.26-stable/decidim-core/app/controllers/decidim/devise/omniauth_registrations_controller.rb#L84-L96 ↩

[basicavisual]

Thank you @samanera ! very clean solution. this works as expected :)