How to use verify-account?

[pboling]

I can't get verify-account to work.

[pboling]

Update & Solution

You can't use the account.verification_key.key directly. In the email that is sent (which I have had trouble actually seeing, or it might have been obvious) it uses the following to generate the "key".

    def token_link(route, param, key)
      route_url(route, param => token_param_value(key))
    end

    def token_param_value(key)
      "#{account_id}#{token_separator}#{convert_email_token_key(key)}"
    end
    
    def convert_email_token_key(key)
      convert_token_key(key)
    end
    
    def convert_token_key(key)
      if key && hmac_secret
        compute_hmac(key)
      else
        key
      end
    end
    
    def compute_hmac(data)
      _process_raw_hmac(compute_raw_hmac(data))
    end

Where, by default, the token_separator is _.

Investigation

Debugging, and I can't understand how this could work, though I do assume it does work for others, and I've done something wrong.

My debugger is running through this part of the verify-account request (in in rodauth-2.32.0/lib/rodauth/features/email_base.rb) :

   65:     def account_from_key(token, status_id=nil)
=> 66:       id, key = split_token(token)
   67:       id = convert_token_id(id)
   68:       return unless id && key

... Aside - why is verify-account using a method from email_base? Is this expected?

You can clearly see why it isn't working to verify the account:

(byebug) id, key = split_token(token)
["ufXaSLU0FLvaIkRBRwlmoDPqGF5cZwr3SJOQogJxEfc"]
(byebug) id
"ufXaSLU0FLvaIkRBRwlmoDPqGF5cZwr3SJOQogJxEfc"
(byebug) key
nil
(byebug) convert_token_id(id)
nil
(byebug) id && key
nil

[pboling]

Perhaps this is an issue of feature collision where multiple features define the same methods and as a result last one wins, making the behavior inconsistent across implementations?

[pboling]

My initial hope was to be able to use both the views, for easy user self-management, and the JSON/JWT APIs for programmatic management.

[janko]

I'm guessing you found a solution. Yes, the token saved in the database is the raw token, it needs to be HMAC'ed and have account ID prepended to it to be usable. Why do you need to generate it manually, doesn't the default mailer already do this for you?

Perhaps this is an issue of feature collision where multiple features define the same methods and as a result last one wins, making the behavior inconsistent across implementations?

That's just module inheritance. A lot of famous gems are built this way, e.g. Active Record. The main difference is that these gems usually load all those modules unconditionally, while in Rodauth you pick and choose.

My initial hope was to be able to use bot the views, for easy user self-management, and the JSON/JWT APIs for programmatic management.

Rodauth supports both HTML and JSON/JWT modes simultaneously, as long as you don't set only_json? true in your Rodauth configuration. The mode is determined by the Content-Type request header; application/json will switch to JSON/JWT mode, otherwise HTML mode is used.

[pboling]

Yeah, I did get it working, and the only difficulty was getting the mailer to send immediately.

The issue is that the default config uses deliver_later which meant it sends via background job, which is far more complex to intercept (e.g. need a worker on that queue).

So I ended up switching to deliver locally, so I can use mailcatcher, and deliver_later otherwise.