feat: Add change password, reset password, and new sync device notification emails.

[shane-tomlinson]

fixes #24

Link to:
mozilla/fxa-js-client#146
mozilla/fxa-auth-server#876
mozilla/fxa-auth-server#941
mozilla/fxa-content-server#2129
mozilla/fxa-content-server#2561
mozilla/fxa-content-server#2562

[shane-tomlinson]

https://accounts.firefox.com/reset_password?email=%(encodedEmail)s

Maybe a better solution is to pass in the entire link, that way it can be customized per deployment and there is less for localizers to worry about.

[pdehaan]

Should this have an 'X-Link': link as well?

(I'm guessing "no" since I dont see a values = { link: ... })

[shane-tomlinson]

@pdehaan - your guess is correct, this email does not send a link. I should document that.

[pdehaan]

"Change" or "Changed" (past tense)?
If it's "Change" we may need more words.
If it's "Changed" then it's probably fine and matches the "successfully changed" text on line 2 below.

---

I didn't see that string in the HTML version of this email, so I can't compare.

[jrgm]

So, is this ready for review. It has a WIP label on it.

[shane-tomlinson]

I'm calling this ready. Goes with mozilla/fxa-auth-server#876

This can merge before the auth server work.

@rfk - r?

[shane-tomlinson]

Here are screenshots of the emails:

new sync device

password reset

password changed

[rfk]

There's a lot of structural dupliction in these functions. @shane-tomlinson do you think there's scope for factoring out a common helper here? (Maybe in a follow-up PR, but worth thinking about)

[shane-tomlinson]

@shane-tomlinson do you think there's scope for factoring out a common helper here?

I thought the same thing as I was copy-pasting. ;)

[shane-tomlinson]

See shane-tomlinson#2

[rfk]

I'm not sure the top-level SUMO page will be much help, should we consider a dedicted article for this?

[shane-tomlinson]

We should, all of the previous emails suffer from the same problem.

[rfk]

This should be added to config.js for completeness

[shane-tomlinson]

done

[rfk]

I guess we should get @ryanfeeley to sign off on the emails here as well, unless that's covered in a previous issue?

[shane-tomlinson]

@ryanfeeley - Can you have a look at the screen shots I pasted? I find the password reset one a bit strange. The user receives a notification email at the address they just verified when they reset their password.

Another thing I noticed:
bash
➜ templates git:(issue-24-initial-notifications) ✗ grep support.mozilla.org *.txt
new_sync_device.txt:{{t "For more information, please visit https://support.mozilla.org"}}
password_changed.txt:{{t "For more information, please visit https://support.mozilla.org" }}
password_reset.txt:{{t "For more information, please visit https://support.mozilla.org" }}
reset.txt:{{t "This is an automated email; if you received it in error, no action is required."}} {{t "For more information, please visit https://support.mozilla.org"}}
unlock.txt:{{t "This is an automated email; if you received it in error, no action is required."}} {{t "For more information, please visit https://support.mozilla.org"}}
verify.txt:{{t "This is an automated email; if you received it in error, no action is required."}} {{t "For more information, please visit https://support.mozilla.org"}}
```
If you look at the first three (the new emails), we only have text about visiting sumo. The last 3 all say "This is an automated email;..." Should we add the automated email text to the new emails?

Ignore all of this. The automated email bit is done on a different line.

[shane-tomlinson]

@rfk and @ryanfeeley - I also find the new sync device a bit strange, esp considering we do not offer the user any way to revoke access to the new device, nor do we give them any information about the device.

Should we try to present some sensible device name based on UA string? I'm fine if something like this is a follow on PR, it just seems odd to send a notification email that provides little useful information and no way of revoking access.

[ryanfeeley]

@shane-tomlinson Looks good, although try to follow the new template set by @johngruen with slightly different font sizing and the Firefox logo above used in the new verification email.

Because changing the password disconnects all clients, perhaps for the new sync devices we should say:

h1. Account Activity Notice

p.A new device is now syncing with all of the devices connected to your Firefox Account.

small.This is an automated email; if you didn’t add a new device to your Firefox Account, you should change your password immediately at [link]. For more information, please visit https://support.mozilla.org

[shane-tomlinson]

@shane-tomlinson Looks good, although try to follow the new template set by @johngruen with slightly different font sizing and the Firefox logo above used in the new verification email.

It looks like @johngruen's changes have not yet landed. I'm of the opinion, first in wins. The other has to update. 🎱

Because changing the password disconnects all clients, perhaps for the new sync devices we should say:

The text here looks the same except for the addition of the link in the footer?

[shane-tomlinson]

Thanks @ryanfeeley! I forgot to link to you above.

[shane-tomlinson]

From @johngruen in IRC:

[21:51:54] stomlinson: i think we should get your emails merged, and my email merged, and then follow up by installing some tooling in the auth mailer to make everything totally DRY

[shane-tomlinson]

@ryanfeeley - updated the text.

[shane-tomlinson]

@ryanfeeley - I have a couple of comments after further testing.

• Some of the emails titles contain Firefox Accounts, some do not.
  • Neither "Reset your password" nor "Verify your account" mention Firefox Accounts. I feel like we should add "Firefox Accounts" to these titles, e.g., "Reset your Firefox Accounts password"

• The main header of "Reset your password" use sentence casing whereas the new emails capitalize the first letter of each word.

• For the "Password Changed Successfully" and "Password Reset Successfully" emails, we swap the order of (Changed|Reset) & Successfully between the title and the body. We use the <verb> successfully pattern within the content server, should we swap the order in the body text too?

• Should we add a "Your Firefox Account has been deleted" email (possibly for a separate PR)?

[johngruen]

@shane-tomlinson: checked out all the emails using the email on acid testing service. Everything looks right and the links are all working correctly!

[ryanfeeley]

@shane-tomlinson Good idea. I would keep it singular (account, not accounts)

e.g.
"Reset your Firefox Account password"
"Verify your Firefox Account"

"reset succesfully" in heading is fine to contrast "succesfully reset" in the body (if one way doesn't sink in by scanning the text, he other will)

Avoid using "Your". I think deletion message is fine like that (right under Firefox Account heading).

[shane-tomlinson]

From IRC:

[21:20:59]  <rfeeley>   it's okay
[21:21:12]  <rfeeley>   your is fine
[21:21:20]  <rfeeley>   don't sweat it
...
[21:22:50]  <stomlinson>    Ah, one final thing - sentence case vs capitalise the first letter of every word?
[21:23:01]  <stomlinson>    for the main header
[21:23:35]  <rfeeley>   sentence case

[ryanfeeley]

[shane-tomlinson]

Here are all of the updated screens. We now have a symmetry that I can deal with. Thanks @ryanfeeley!

Original emails (with updated titles)

New emails

Titles

[ryanfeeley]

Ship it!

[shane-tomlinson]

Thanks @ryanfeeley!

@rfk - mind if I issue the refactor PR (See shane-tomlinson#2) separately, after this one? I have asked @zaach to hold off on the string extraction to slip this in, and don't want to hold up any longer than necessary, and honestly, I'm not completely happy with my cleanup.

If that seems reasonable, could you do an r?

[rfk]

SGTM, r+