authgear / authgear/authgear-server
Rethink handling of login in promote user flow
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Problem
### Login was removed from the promote function
- In the old Authgear interactions, the "Promote User" feature allows for "Signup" and "Login". When the app trigger promotion on an anonymous user, the user will see either signup or login.
- Sign up: Identities and authenticators will be added to the current user, linked to the current user id. The user will keep their progress in the client system without any migration
- Log in: the user will be logged into an existing user. The original user ID will became orphan.
- However in new **Authflow**, the "Log in" function is removed from "promote user".
- Meaning the app must trigger "Promote" in the SDK for signup as new user, and trigger "Login" in the SDK for login as new user
### Potential problem
The new approach is not in parity with the "start authentication" function, which we designed to only have 1 function for both signup and login, the enduser can switch inside the AuthUI.
Moreover this is a breaking change for existing developers who are using the promote function. They may need to change their UI to accomodate 2 separate buttons for the 2 cases.
## Solution
We came up with some ideas during our offline discussion:
- Keep the promote function the same as the old design, allow for login to an existing user
- To help the developer knowing the user came from the promotion and the old user ID became orphan, include the old user id and the logged in user id in a hook event. So they can handle the merge in their backend.
- Rabbit hole: Should it be "user.anonymous.promoted", "user.authenticated" or a new event?
- Reconsider the restriction of account linking in promote flow: actions such as `login_and_link` could be supported if login in promote flow is allowed.
Contributor guide
Research direction
Start by reviewing the promote-user and start-authentication flows described in the issue, then trace how Authflow handles signup and login. The issue presents several competing solutions but names no files or tests; done requires an agreed design for login during promotion and its account-linking or hook behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100