[Bug] partners inviting new users can enter invalid email addresses. (I entered newuser@example.co,)

[scooter-dangle]

Summary

Fix the email check when a partner is inviting user

Why

Prevents bad data and partner frustration. Makes incorrect data slightly less likely

Details

I tried this with newusers@example.co, which should not work, but creates a user.
With "Sam", it claims to create the user, but it does not appear in the list

Recreation

Sign in as verified@example.com
Click on the email in the top right
Click on "My co-workers"
Click on "Invite new user"
Enter newuser@example.co, in the email
Click on "Create User"

Criteria for completion

• only validly formatted user ids are accepted when partners are inviting new users
• tests to support that functionality

Note We're using email validation elsewhere (e.g., AccountRequest model). If that isn't wretched, use it here too!

[Learningstuff98]

@scooter-dangle I can take a crack at this

[Learningstuff98]

I have an update. I've added validation functionality to the partners/users_controller.rb create action.

Currently there appears to already be some form of format validation acting on the email attribute. Adding "validates :email, format: { with: URI::MailTo::EMAIL_REGEXP }" to the user model doesn't change any validation behavior from what I can tell. Currently button mashes like "gjkjgdkj" aren't allowed with or without the "MailTo::EMAIL_REGEXP" validation being added to the user model. According to this post the "MailTo::EMAIL_REGEXP" approach won't work, (I tested it and it doesn't), and will probably need a gem for anything like what we're after. I wanted to ask how you guys feel about adding a gem for this.

[dorner]

@scooter-dangle what problem are we trying to solve here? The "bad e-mail" you suggested is a perfectly valid e-mail address according to RFC 5322. Are we trying to validate that the domain exists? That would require some kind of DNS check. Or do we want to give the partner / org a set of valid domain names outside of which no e-mail addresses would be allowed?

[dorner]

Ah whoops I missed the , in your sample. @Learningstuff98 the regex should prevent bad characters like the one scooter provided. We need to figure out if the validation isn't being triggered for some reason, or if the regex isn't strong enough to catch bad characters like this.

[Learningstuff98]

I don't think that this regex is enough. Here's a post about this topic.

[dorner]

@Learningstuff98 if we want to go whole hog, yes, we would need to do that. But I think this ticket is just trying to solve the problem of people entering addresses which are legitimately invalid e-mail addresses, which it seems like they are able to do. You can go down a rabbit hole of "is this REALLY a real address?" (even if the domain name is real, the address might not exist on that domain name, and the only foolproof way of validating is by actually sending an e-mail to it) but I think for our purposes it isn't necessary.

[Learningstuff98]

@dorner I can work on a solution that just checks that an email ends in .com and includes an @ if that sounds good.

[dorner]

@Learningstuff98 not every e-mail ends in .com - in fact, most of them will be at least .org. The regex should be sufficient - the question is why it isn't catching these errors - either it's not being called at all, or there's something wrong with the regex itself.

[Learningstuff98]

@dorner Unfortunately I haven't been able to find a solution for this. I'm going to unassign myself from this issue so someone else can work on it.

[lokisk1155]

Hey, if no ones working on this currently I can take it over