Create password for new internal user using less steps

[nmadruga]

Explained in our private repo: https://github.com/openmsupply/conforma-templates/issues/49

Basically instead of the current existing steps of:

1. As admin submit new internal user details
2. As new user open the email - click on the link
3. On the Password reset page write your username & submit
4. Open the email again and click on the new link
5. On the Password reset page finaly add your password & submit

It should be less steps:

1. As admin submit new internal user details
2. As new user open the email - click on the link
3. On the password reset page enter the new password & submit

[CarlosNZ]

This should be just config, right? I wonder why we haven't done it already.

[nmadruga]

This should be just config, right? I wonder why we haven't done it already.

No.... unfortunately. It would be great to have this simplified, but as I tagged, I think it's work for the next 12 months.
I think the problem is more complex than it seems, because we use the user's session to verify.

[CarlosNZ]

I think the problem is more complex than it seems, because we use the user's session to verify.

Hmm, that shouldn't be required for a verification to work. I might have a quick look at this and see if there's a hurdle I've forgotten about.

[CarlosNZ]

Oh I see, it's the password reset that makes it essentially two separate applications. And there's no way to pass the username on the "reset password" application for a user that's not (yet) logged in.

A simple workaround is just to generate a temporary password and put it in the verification email with instructions to change it as soon as possible. Though we don't have a way to enforce that, so it's probably a bit dodgy.

I think it can probably be done by adding a separate "hidden" section to the "createInternalUser" template, the same way the "Password reset" does. And when the user confirms the verification, they fill in part two of the same application (using the sessionId for authentication). And then we create the user AND their new password upon submission.

I think this should work, as it's basically the same idea as how the Password Reset form works. I'll have a play with it at some point. (Just for fun, I know it's not billable work right now)