It's not possible to update your email address

[Nautman]

There is no such field in updateUser.

digitalungdom-api/src/api/validators/user.ts

Lines 66 to 95 in 5725e49

	const updateUser = [
	body("username")
	.optional({ nullable: false, checkFalsy: true })
	.isString()
	.isLength({ min: 3, max: 24 })
	.matches(/^(\w+)$/)
	.custom(async function (username: string, meta) {
	const req = meta.req as Request;
	const user = await req.services.User.getUserByUsername(username);
	if (user) {
	throw new Error();
	}
	return true;
	}),
	body("firstName").optional({ nullable: false, checkFalsy: true }).isString().isLength({ min: 1, max: 512 }),
	body("lastName").optional({ nullable: false, checkFalsy: true }).isString().isLength({ min: 1, max: 512 }),
	body("birthdate").optional({ nullable: false, checkFalsy: true }).isISO8601({ strict: true }).isBefore().toDate(),
	body("gender").optional({ nullable: false, checkFalsy: true }).isString().isIn(["MALE", "FEMALE", "OTHER", "UNDISCLOSED"]),
	body("profileColour").optional({ nullable: false, checkFalsy: true }).isString().isHexColor(),
	body("profileStatus").optional({ nullable: false, checkFalsy: true }).isString().isLength({ min: 0, max: 32 }),
	body("profileBio").optional({ nullable: false, checkFalsy: true }).isString().isLength({ min: 0, max: 1000 }),
	body("profileURL")
	.optional({ nullable: false, checkFalsy: true })
	.isString()
	.isURL({ protocols: ["http", "https"] }),
	];

[kelszo]

This is a problem since I don't know how to handle it. Should we just accept if they want to update their email or require some confirmation?

[Nautman]

Hrm. I think it would be good to require them confirming through a token / link sent to their email.

[Nautman]

Perhaps a similar functionality to confirm your email could be used when deleting your account? Although, it might be unnecessary since the user has logged in with that email. But it reduces the risk that someone deletes the account maliciously.

[Nautman]

I believe this should be included in the minimum viable product. At the very least, there should be a confirmation front-end wise where you have to type in the email address twice and that you acknowledge that it is impossible to regain control of your account if you no longer have access to that email (unless you reach out to us).

[Nautman]

The board decided this isn't necessary for MVP.