AOSSIE-Org / AOSSIE-Org/Ell-ena

REFACTOR: Secure Server-Side User Validation & Centralized Error UI

Open
#192 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Dart
Stars
54
Forks
110
PR merge metrics
No merged PRs in 30d

Description

## What needs fixing?
While working on the signup screens, I noticed two main issues with how we handle logins and signups:

1. **Security Risk (Checking on the phone):** Right now, the app tries to guess if an email is already registered by checking directly from the user's phone. This isn't safe and clashes with our database security rules (Row-Level Security).
2. **Messy Error Messages:** If the internet drops or something goes wrong, the app shows different types of error messages depending on which screen you are on. It makes the code messy and the app feel inconsistent.

## How I plan to fix it
I want to clean this up to make the app much safer and more professional:

1. **Check users safely in the database:** Instead of the phone doing the work, I'll write a secure function (RPC) in our Supabase database. The app will just ask, "Hey, is this email taken?" and the database will safely answer "Yes" or "No." No private data gets leaked to the phone.
2. **One central error system:** Instead of scattered code, I'll set up a clean system using two dedicated files (app_error.dart to define the types of errors, and app_error_handler.dart to actually manage them). Together, they will catch all problems—like bad internet or wrong passwords—and turn them into friendly, easy-to-read messages.
3. **Better-looking alerts:** I'll make sure all error popups look the same across the app. They will be modern, floating message bars with clear icons.

### The database code (SQL) to make this work:
```sql
-- This function allows the app to check if an email exists without being blocked by RLS.
CREATE OR REPLACE FUNCTION public.check_user_exists(email_to_check TEXT)
RETURNS BOOLEAN AS $$
BEGIN
RETURN EXISTS (
SELECT 1 FROM public.users WHERE email = email_to_check
);
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;
```

## Why this helps the project
This makes our app totally secure against data leaks and respects our database rules. Best of all, it makes the code much cleaner. If another developer wants to show an error message in the future, it will only take them a single line of code!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.