623982 - Notifications: Implement email confirmation of anonymous watches

Status: VERIFIED FIXED

(support.mozilla.org :: General, defect, P1)

Description

[Erik Rose [:erik][:erikrose]]

Consider the workflow of the current system. A strawman: stick a random secret on anonymous watches, send a confirmation mail (with a link containing watch ID and secret) automatically upon the creation of an anonymous watch, and write a view that activates the watch and clears the secret when a correct confirmation is received. Make the system ignore watches with non-blank secrets.

Comment 1

[Erik Rose [:erik][:erikrose]]

Something like random.choice(string.letters + string.digits) (with less concatenation) might come in handy.

Comment 2

[Erik Rose [:erik][:erikrose]]

WatchFilter.secret is the secret field. Go crazy.

Comment 3

[Erik Rose [:erik][:erikrose]]

And when I say "WatchFilter", I of course mean "Watch". :-)

Comment 4

[James Socol [:jsocol, :james]]

Only need to confirm an email address once: better or worse?

Comment 5

[Paul Craciunoiu [:paulc]]

(In reply to comment #4)
> Only need to confirm an email address once: better or worse?
For the user it would certainly be better, right?
We'd check the notifications and auth_user tables for that email and if it's been already confirmed. I'm not sure if it's worth having a separate table just for anonymous emails.

Comment 6

[Erik Rose [:erik][:erikrose]]

Devil's advocate: if you confirm your email address, I can then go in anonymously and watch 10,000 things with your email.

Comment 7

[James Socol [:jsocol, :james]]

Alternate position: If I try to watch two questions I have to confirm twice?

I have no strong opinion here, I just want to do what's best for users. Is comment 6 a more realistic concern than this? It's certainly possible but it seems like there'd be easier ways to troll someone.

Comment 8

[Paul Craciunoiu [:paulc]]

We could always switch from confirm-once to confirm-always if it becomes a problem, right?

Comment 9

[[:Cww]]

I think #6 is an edge case so I'd favor confirm once. Although, having the confirm-always case be just a push away seems like not-a-bad-thing in case we do get abuse.  Plus a user can always unsubscribe from all emails, right?

More pertinent question: what if someone is setting up an anon watch with an email address that belongs to a registered user?

Comment 10

[Erik Rose [:erik][:erikrose]]

An anon setting up a watch with an email of a registered user is a pretty important use case for me: I often end up on some computer or browser that doesn't know my passwords, and I shouldn't be barred from subscribing to something.

Comment 11

[[:Cww]]

Sure, but should we treat it like every other anon or should we add it to the list of subscribed watches in a user's profile (essentially treating it like the user was logged in)

Comment 12

[Paul Craciunoiu [:paulc]]

OK. Step 1: confirmation scenarios:
1. Anonymous user, we have no record of that email.
2. Anonymous user, email is registered.
3. Logged-in user.

Confirmation behavior per scenario (suggested):
1. Confirm once.
Anonymous emails are not shown anywhere, are they? So it should be ok to confirm them just once.
2. Always confirm.
Users may publicly display their email, I could see this being a frequent problem.
3. Never confirm, if active. Reminder to confirm account, if inactive.

Objections?

Comment 13

[[:Cww]]

If there's a view to see all the things you're subscribed to (which is probably a good idea for future), we should make sure that things set up via (2) still show up even if you're logged out when you set them.

Comment 14

[Paul Craciunoiu [:paulc]]

(In reply to comment #13)
> If there's a view to see all the things you're subscribed to (which is probably
> a good idea for future), we should make sure that things set up via (2) still
> show up even if you're logged out when you set them.
For (2), subscribing would check if that email is already registered (without informing the anonymous user whether that is the case), and attach the watch to the registered user. So yes, as you say.

Comment 15

[Paul Craciunoiu [:paulc]]

Done. Anonymous users need to confirm each watch every single time.
https://github.com/pcraciunoiu/kitsune/commit/24a13e54fdc0efe7c786ecf1e7b6312132faadf2

There is also a message when the email-sending fails, but only for AJAX requests. Bug 629518 is left to polish that UX.

Read commit message for details, but basic testing involves watching as anonymous (entering email) and then confirming that action. You should only receive emails for confirmed watches.

Comment 16

[Rebecca Billings [:rbillings]]

Verified anonymous users must always confirm, and registered users don't