AOSSIE-Org / AOSSIE-Org/Ell-ena

REFACTOR: Secure Server-Side User Validation & Centralized Error UI

Offen
#192 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Dart
Sterne
54
Forks
110
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

## What needs fixing?
While working on the signup screens, I noticed two main issues with how we handle logins and signups:

1. **Security Risk (Checking on the phone):** Right now, the app tries to guess if an email is already registered by checking directly from the user's phone. This isn't safe and clashes with our database security rules (Row-Level Security).
2. **Messy Error Messages:** If the internet drops or something goes wrong, the app shows different types of error messages depending on which screen you are on. It makes the code messy and the app feel inconsistent.

## How I plan to fix it
I want to clean this up to make the app much safer and more professional:

1. **Check users safely in the database:** Instead of the phone doing the work, I'll write a secure function (RPC) in our Supabase database. The app will just ask, "Hey, is this email taken?" and the database will safely answer "Yes" or "No." No private data gets leaked to the phone.
2. **One central error system:** Instead of scattered code, I'll set up a clean system using two dedicated files (app_error.dart to define the types of errors, and app_error_handler.dart to actually manage them). Together, they will catch all problems—like bad internet or wrong passwords—and turn them into friendly, easy-to-read messages.
3. **Better-looking alerts:** I'll make sure all error popups look the same across the app. They will be modern, floating message bars with clear icons.

### The database code (SQL) to make this work:
```sql
-- This function allows the app to check if an email exists without being blocked by RLS.
CREATE OR REPLACE FUNCTION public.check_user_exists(email_to_check TEXT)
RETURNS BOOLEAN AS $$
BEGIN
RETURN EXISTS (
SELECT 1 FROM public.users WHERE email = email_to_check
);
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;
```

## Why this helps the project
This makes our app totally secure against data leaks and respects our database rules. Best of all, it makes the code much cleaner. If another developer wants to show an error message in the future, it will only take them a single line of code!

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.