Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Someone who signed up can't get back to their spot without the confirmation email

Đang mở
  • Có gì không ổn?
#657 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
43/100
Loại issue
Tính năng
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
postgresql, typescript
Lĩnh vực
authentication, full-stack

Hướng nghiên cứu

Start with the public signup page at /s/[slug], the magic link rate limiting in src/lib/rate-limit.ts, and editTokenFor and commitmentEditUrl; then inspect the privacy page and src/app/query-budget.db.test.ts. Trace how the endpoint, email, activity row, and public form fit existing patterns. Done means the listed cases and checks pass, the page query budget is unchanged, and the privacy text and dates are updated.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

enhancement pipeline:proposed pipeline:ux

Needs your OK: this adds a way, on the public signup page, for someone who signed up to have their link emailed to them again. Swap pipeline:proposed for pipeline:ready to have it built.

What happens

The only way to change or cancel a sign-up is its private link: /s/<slug>/c/<id>?token=…, from commitmentEditUrl and editTokenFor. It arrives in the confirmation email, and in reminder and moved-slot emails. The public page /s/[slug] recognises you only from the os_commit cookie (src/lib/returning-participant.ts), which is set in the browser that signed up.

So someone on another phone or browser, or who cleared cookies, or who deleted or never got the email, has no way back:

  • The public page shows their slot like anyone else's ("1 left · Sign up"). Nothing says they're on it, and there's no "already signed up?" path.
  • The footer's Help is written for organizers. Contact goes to the site's operator, not the organizer.
  • The only way out is to ask the organizer to remove them, and to know how to reach the organizer.

In the walkthrough, a parent on a fresh phone tried to drop a snack week. They looked on the page and then in Help, and found nothing. A real parent would have texted the coach.

Fix, in outline

  • An entry point on the public page: a quiet "Already signed up? Get your link by email" under the slot list. It shows only while the signup is open or closed, because people can still cancel when it's closed. It opens a small form with one email box.
  • A public endpoint, e.g. POST /api/public/signups/[slug]/links. It consumes a rate limit per IP and per email-and-signup before doing any work, as every unauthenticated write must. It finds the participant with that email on this signup. If they hold any sign-up that still has a place, it sends one email listing each with its private link.
  • Always the same answer: "If that email is signed up here, we've sent it the link." Whether or not anything was sent, the page and the response time look the same, so the form can't be used to learn who signed up.
  • One new email: a subject from src/email/subjects.ts, and each spot printed with the shared SlotDetailsText and its commitmentEditUrl. editTokenFor is an HMAC of the sign-up's id, so the link is the same one the first email had.

Watch for

  • Nobody else's address. Mail only goes to an address that already holds a sign-up on this signup. The form must never send to an address that has nothing there.
  • Sign-ups with no email (when the organizer made it optional) can't use this. The form's text says so, and their answer stays "ask the organizer".
  • Rate limits: reuse the magic link's per-email and per-IP pattern in src/lib/rate-limit.ts. Add the new surface to the rate-limited list in CLAUDE.md.
  • Query budget: /s/[slug] is capped in budgets.json. The entry point must add no query to the page's render. Only the POST does any work.
  • Legal pages: the privacy page says "sends four kinds of email". This makes five. Update it, the terms if they list emails, and the "Last updated" dates.
  • Telemetry: if it records an activity row, add the event type and update docs/telemetry.md. Record no email address in the payload.
  • Every signup state: draft, archived, deleted and not-found pages show no entry point. The endpoint gives a draft, archived or deleted signup the same answer as an unknown one.

Choices this makes

  • One email listing all their spots on this signup, not one email per spot. Someone with two slots gets one message.
  • Open and closed signups only. On a closed one, the link still lets them cancel or give spots back, which is the case this is for.
  • Wording: "Already signed up? Get your link by email". The confirmation it shows: "If that email is signed up here, we've sent it the link. Check your spam folder too."
  • An activity row per email sent (say participant.links_resent, keyed by participant id, no address), so the organizer's log shows it and abuse can be seen. Nothing is recorded when no email goes out.

Done when

  • On a fresh browser, someone who signed up can enter their email on the public page and get an email with a working link to each of their spots on that signup.
  • An email that isn't signed up gets the same on-screen answer and no email. A tested service function pins both outcomes.
  • The endpoint refuses past its per-IP and per-email limits, checked in a DB test.
  • src/app/query-budget.db.test.ts still passes for /s/[slug] with no budget raised.
  • The privacy page (and terms, if needed) list the new email, with their dates bumped.
  • pnpm lint && pnpm typecheck && pnpm knip && pnpm test && pnpm test:db pass.

Found by the UX walkthrough, scenario P2 (change of plans, on a phone), on opensignup-prod main merged with upstream 1d4ff3a. Checked against /s/[slug], the os_commit cookie and editTokenFor: nothing on the public page leads back to a sign-up without that cookie or the emailed link. https://claude.ai/code/session_01ATJ4moQv7TF11SrH9fDe2q

Ngôn ngữ chính
TypeScript
Star
19
Fork
4
Merge trung bình
21 giờ 3 phút
Pull request đã merge (30 ngày)
176

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của richshaw/OpenSignup

Tất cả issue của richshaw/OpenSignup

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.