FindUserByConfirmationCode fails because of HasUser check

[therealjoesmith]

Hello

For the use case of verifying a user by having them click a link with the confirmation code as a URL parameter:

When calling UserState.FindUserByConfirmationCode() to find the uncomfirmed user whose confirmation code is the one specified in the URL query string, the function finds the candidate username and then does the following check (link to the relevant line in source code):

hasUser := state.HasUser(username)

The issue is that HasUser() has the following check:

state.usernames.Has(username)

which, for unconfirmed users, it fails. It really should also do the check on the state.unconfirmed Set.

Note that calling UserState.ConfirmUserByConfirmationCode() fails the same way, because the very first thing it does is call FindUserByConfirmationCode().

Having said all this, maybe I'm using the library incorrectly for the use case described at the beginning.

Thanks!

[xyproto]

Thanks for reporting! I will look into this.

[xyproto]

I'm in the process of writing a proper example for this, while also double-checking that everything works as expected and/or if there are issues with the documentation.

In the mean time, this function roughly outlines what I was thinking in terms of how to register/confirm users, and which order the functions can be called (siteengines is the predecessor to permissionbolt):

https://github.com/xyproto/siteengines/blob/1cdc99cc82e0baab4925e7541e21bb9f61963784/userengine.go#L163