authgear / authgear/authgear-server

Rethink handling of login in promote user flow

Open
#3,768 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Problem

### Login was removed from the promote function

- In the old Authgear interactions, the "Promote User" feature allows for "Signup" and "Login". When the app trigger promotion on an anonymous user, the user will see either signup or login.
- Sign up: Identities and authenticators will be added to the current user, linked to the current user id. The user will keep their progress in the client system without any migration
- Log in: the user will be logged into an existing user. The original user ID will became orphan.
- However in new **Authflow**, the "Log in" function is removed from "promote user".
- Meaning the app must trigger "Promote" in the SDK for signup as new user, and trigger "Login" in the SDK for login as new user

### Potential problem

The new approach is not in parity with the "start authentication" function, which we designed to only have 1 function for both signup and login, the enduser can switch inside the AuthUI.

Moreover this is a breaking change for existing developers who are using the promote function. They may need to change their UI to accomodate 2 separate buttons for the 2 cases.

## Solution

We came up with some ideas during our offline discussion:

- Keep the promote function the same as the old design, allow for login to an existing user
- To help the developer knowing the user came from the promotion and the old user ID became orphan, include the old user id and the logged in user id in a hook event. So they can handle the merge in their backend.
- Rabbit hole: Should it be "user.anonymous.promoted", "user.authenticated" or a new event?
- Reconsider the restriction of account linking in promote flow: actions such as `login_and_link` could be supported if login in promote flow is allowed.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the promote-user and start-authentication flows described in the issue, then trace how Authflow handles signup and login. The issue presents several competing solutions but names no files or tests; done requires an agreed design for login during promotion and its account-linking or hook behavior.

Written by the indexing model from the issue text.

Assessment

Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.