Sylius: [UserBundle] Improve register with email confirmation

[gperdomor]

Hi everyone!.

I wanna know your opinion about implementing email confirmation considering this:

• On customer.pre_create event, the user must be disabled and a confirmation token should be generated (use the same field used in password request).
• The confirmation email must contains a link to a new confirmAction which use the confirmation token as parameter, the action validate the token and enable the user and set the confirmationToken to null.
• The ConfirmAction should redirect to login if the token is valid and dispatch pre_confirm and post_confirm events.
• As the user is created with disabled state, the AutoLoginListener is no longer works, so should be deleted.
• The prepareResetPasswordRequest method on the UserController must verify the status of the user for prevent the execution when the user is disabled (show the flash message sylius.user.email.not_exist for example)

[pjedrzejewski]

Actually, I'd like to have this toggleable. So basically being able to easily enable/disable the listeners responsible for autologin and confirmation token generation/email + disabling user. Just like FOSUserBundle is doing it, IIRC. Thoughts?

[gperdomor]

Any progress here? or defined workflow for this?

[michalmarcinkowski]

Currently we're implementing email verification. The workflow is the following:

1. Register and autologin - the user is able to login but his email is not verified
2. Send email with email confirmation link
3. Visit confirmation link (your email will be verified)

And also a possibility to resend confirmation email.

1. [Logged in user] Go to my account profile -> click "resend confirmation email" link
2. [Not logged in user] Go to resend confirmation email page -> fill in your email -> press "Resend" button (same as request password reset)

I would suggest to wait for this functionality and then we can add configurable option to disable user account at default and enable it after verification. It will only require to disable autologin listener, disable UserRegistrationFormSubscriber which enables user on registration form submit and enable user after the verification.

[gperdomor]

@michalmarcinkowski 👍 ... I will wait then :D

[krafas]

@michalmarcinkowski do you have any news about this feature? At what stage it is now?

[michalmarcinkowski]

The email verification feature is already merged (see #5029), so now this feature should be easy to add.

We don't plan to implement this feature soon, but if anyone from community is willing to work on it, we will be happy to help 😉