Understanding email_auth

[gczh]

Hey there!

I'm trying to implement email_auth and I have the views and migration setup.

However, the default flow seems a little counter-intuitive to me and I'm a little stuck trying to figure out how to improve it.

Problem to solve

Right now, it seems that to login using email_auth, I did the following.

Provide an email field and point the form to rodauth.email_auth_request_path

<%= form_with url: rodauth.email_auth_request_path, method: :post, data: { turbo: false }, class: "w-full max-w-sm" do |form| %>
  <%= form.email_field rodauth.login_param, value: params[rodauth.login_param] %>

  <%= form.submit rodauth.email_auth_request_button, class: "w-full px-8 py-3 cursor-pointer font-semibold text-sm rounded-md text-white bg-blue-600 hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-600 dark:bg-emerald-400 dark:hover:bg-emerald-500 dark:text-gray-900 dark:focus:ring-emerald-400 dark:focus:ring-offset-current" %>
<% end %>

Once the user inputs the email and clicks the button, it redirects them to root_path and the following email is sent:

The user is then redirected to http:https://localhost:3000/email-auth after clicking on the login link. The page only shows the following login button.

What i'd like to change here however is to just login the user right away and display a flash message on root_path. Or, maybe later on, redirect them to a success page instead.

What I've tried

• I've looked around the docs but am not sure if I should be overriding the Rodauth controller to do this
• Should I do something in the email_auth.html.erb instead? I did a binding.pry here and can't seem to see where the login token is. Was thinking of using it to just log the user in and redirect them right away.

Appreciate any help here! 🙏

[janko]

Rodauth doesn't perform resource modifications in GET requests, to respect HTTP conventions. This applies to email auth, account verification and email change verification, all of which require the form to be submitted. In addition to being correct, it's also more flexible, e.g. Rodauth allows setting password or registering a passkey on account verification, which wouldn't be possible without the additional step.

I recommend simply autosubmitting the form with JavaScript when the page gets loaded, and making the form hidden in the meanwhile. Here is a Stimulus example – https://github.com/janko/rodauth-rails/wiki/Autosubmit-Forms.

[gczh]

@janko ooo, got it! That makes sense, and I learnt something new from this – great idea to respect HTTP conventions. Thank you for that!

Never thought about it from that angle where it would be more flexible with the additional step. Again, that makes sense now haha!

I'll try your recommended approach of using stimulus to autosubmit the form instead!

PS: Thanks once again for making rodauth-rails! It's working all great now at aitoolsfor.com and I'll definitely use this for most of my rails projects! 🙏