We are deprecating webapp based signup. It leads to an inconsistent state for mail providers and offers no useful interactions for vpn providers either. Instead of trying to deal with the halve way signup through the webapp we require signup through bitmask app which can also create the pgp keys for email and download and use the cert for vpn. In addition this reduces the attack surface for js injection, phishing and other browser based attacks. For now we still keep the signup form in case providers link to it directly. We also keep all the tests based on it. Cleanup will happen right after 0.10.0 release.
We now use the hash of the token for comparison and as the id. In order to use it you need the original token though. So forms and thus the session should have token.to_s rather than token.id.
* reran the simple form initializer. * wrapped submit buttons are now broken and need a fix. * disabled confirmation validation in client side validations as the error message always is attached to the wrong field.
There was a lot of special case handling going on in the users_controller for this. Lot simpler this way.
AccountLivecycleTest -> CRUD accounts SecurityTest -> security specific tests AdminTest -> admin specific tests
Through the config param 'invite_required', providers can decide whether users need to provide an invite code upon signup. The default setting is false.