Signup by invitation feature

[jwald1]

I wonder how we can implement signup by invitation similar to devise invitable.

Any suggestions are appreciated.

[janko]

Hi, I'm not sure, I haven't used devise-invitable, so I don't know how it works. If you have some knowledge about it, maybe could describe its flow, and we could come up with some Rodauth configuration that would support this.

[jwald1]

Thanks, @janko!

I haven't used devise invitable either, but the flow should go like so:
The admin sends an invite to an email, and the recipient clicks on the link to complete the sign-up. The link expires if the recipient doesn't accept the invitation for a while. My use case is for an admin-controlled sign-up.

I hope it makes sense.

[snacks02]

Interested in this as well!

It doesn't seem too different from the verify account feature, especially with verify_account_set_password? enabled (which is the default).

Happy to help with implementing this if needed.

[janko]

It's best that whoever needs this functionality releases this as an external gem (e.g. rodauth-invite). I didn't need to implement invitations so far, so I don't have availability for this. I think this is the last thing Rodauth is missing from the Devise ecosystem 🙂

[Samuelodan]

Hi @janko ,
I haven't built a gem before, but I'm interested in this feature. Could you help with a basic list of things I need to be familiar with? Also, will this gem make it so that we can enable the feature in the Auth class alongside the built in Rodauth features?

Thanks.

[snacks02]

This is what I ended up adding to accounts_controller.rb:

def send_invitation
  account = Account.create(
    email: params["email"],
    name: params["name"]
  )

  rodauth.account_from_login(account.email)
  rodauth.setup_account_verification
end

Don't forget to configure this in rodauth_main.rb:

# Set password when verifying account instead of when creating.
verify_account_set_password? true

[Samuelodan]

Hi,
I'd like to ask a few things about your implementation.

• What else does your AccountsController do?
• What actions does it have? (also, what action is send_invitation used in?)
• what action is send_invitation used in and how do you call it?

I need an invite feature too, but I'm not sure what a good implementation is. Also, passwords are currently set on create instead of during verify.

Thanks.

[snacks02]

Hey,

My AccountsController doesn't have anything special. The implementation of send_invitation (it is an action btw) evolved over time, so nowadays it looks like this:

def send_invitation
  email = params["email"]
  name = params["name"]

  account = Account.where(email: email)&.first
  account ||= Account.create(
    email: email,
    name: name,
  )

  if account.status == :unverified
    rodauth.account_from_login(account.email)
    rodauth.setup_account_verification

    render json: { msg: "Successfully sent the invitation email.", type: "notice" }
  else
    render json: { msg: "A verified account with this email already exists.", type: "alert" }
  end
end

I'm not sure if that's the perfect implementation, but it seems to do the job.

[Samuelodan]

Thank you so much for the swift and detailed response.
It's good to see you're building an API app too.

It is an action btw

Ah, I see. I guess my only problem now would be how to have a separate verify_account_set_password? value for invited users.
I'm thinking I could create a separate auth class (inheriting from RodauthMain) and use that to call the account_from_login and setup_account_verification methods.
OR
find a way to change that config on the fly. Prolly use the auth_class_eval method for that?

What do you think?

I like your implementation, btw. It's much simpler than say creating a gem to implement the feature (tho, that one might be more robust and feature rich, I guess. It could prolly use a table to keep track of invite_tokens kinda like DeviseInvitable).

[snacks02]

If setting verify_account_set_password? to true globally is not an option, it might be worth considering a more nuanced solution, for sure. At this point, it is probably better to implement the feature in an external gem, but in my case it was so simple that I decided not to bother (considering that there is not much documentation on how to write Rodauth features).

[Samuelodan]

Hmm, that makes sense.

there is not much documentation on how to write Rodauth features

Yeah, there prolly isn't any at all, and I haven't created a gem before. Tho, the gist Janko linked to about an hour ago looks like a good starting point.

Thanks for your time. I appreciate it.

[janko]

FWIW, here is the WIP implementation of an invite feature that I had started some time ago but never finished (and haven't tried running the code). Maybe it can serve as a starting point for whoever wants to work on the feature.

[Samuelodan]

Thank you so much for making and sharing this. It feels like I have a lot to learn before I can pick this up, but it'll be so much easier than starting from scratch.