Optionally require fields before sending login link / logging-in

[zarathustra323]

Adds the ability, optionally, to require fields to be answered before a user receives a login link. This behavior is only applicable to unverified (new) users only -- this was done to prevent unauthenticated requests from modifying verified user data. This requires base-cms/id-me#81 to be merged and deployed.

To enable, the requiredLoginFields array must be set in the implementing website's IdentityX config. The fields that can be required are:

• givenName
• familyName
• organization
• organizationTitle
• countryCode
• regionCode
• postalCode

For example:

// site.js
module.exports = {
  // other site config options...
  identityX: {
    requiredLoginFields: ['regionCode', 'countryCode'],
    // other identity-x config options...
  },
};

If a locale field is set (e.g. countryCode) the regional consent questions will also be prompted if a user selects a country with an enabled consent policy in IdentityX (e.g. Canada or the EU, etc).

Example flow:

Standard login screen

If the user is unverified and is missing the configured fields, they will be asked before sending the login link

If a country is selected that has a regional consent question, it will also be prompted

Once submitted, the login link will be sent as normal

The remaining authentication flow remains the same.