Discord slash commands and duplicate accounts

[jorys-paulin]

Hello, everyone!

Discord recently launched slash commands, and I wanted to integrate those with Fider. As part of the Moonlight Discord server, I would like to allow users from the Discord server to interact with our Fider site, to promote it and make it easier to give feedback.

I looked at the Discord documentation and Fider's documentation, and I think it can be done: a bot can create a Fider account for each Discord account, and act as a middle-man for interactions with Fider.
However, this means users with existing accounts would have two different Fider accounts (aka duplicate accounts), and I was wondering if it was possible to avoid that.

I would like to somehow "link" a user's Discord account to their existing Fider account or create one for them. They would then be able to log in to the Fider site, using the existing OAuth log-in, and see all their posts and votes like normal.
The problem is, Fider doesn't have a way to say "that account is linked to this external one", there is a reference option when creating an account, but it seems like it's never exposed or used anywhere else.
When executing a command, Discord sends the user's id and username, but (thankfully) not the email address, so Fider can't use it for de-duplication either.

Do you have ideas on how it could be done? I haven't looked at the source code yet, but I don't think it'll help.
Should I just give up and be content with duplicate accounts?

[indyteo]

I'm thinking of two potential solutions for you.

One apply if you control the only OAuth enabled, and the other that wouldn't request anything else than your Discord BOT.

1. In your custom OAuth provider, return the Discord user ID as reference ID. Then, when using the Create User API endpoint, your BOT would give the user ID as reference ID and then retrieve the user's account or create it if necessary. (Hopefully the Discord OAuth return the user ID I think, but double check this information)
2. If you have multiple OAuth providers or email authentication enabled, you should create a "link" command, allowing your users to setup their email address (don't forget to verify it by sending them an email with a confirmation code). Then, check whether the user using the suggestion command has linked his email or not, and if so use it to post the suggestion (the email in the Create User API endpoint would retrieve the correct account or create one) otherwise, tell him to link his email to make a suggestion.

This is the best solutions I can think so far, if you want more precision about one, don't hesitate I'll be happy to help you 😊

[jorys-paulin]

Hello, we have both email and two Discord OAuth options (one with mail included, one without), we don't have a custom OAuth provider.

1. I don't think I quite understand how the reference id works: does it do anything? If we were to include the Discord ID as a reference, would Fider be able to do anything with it?
2. We could have a link command, but if I understand correctly, we would need the user's email address, which some users might not want (hence why the no-email option).

I also noticed that Fider grabs the Discord account's ID when sign-in with OAuth, and it's required for it to work, but what is it used for? Maybe it could be stored and used for authentication later?

[indyteo]

I quite understand how the reference id works: does it do anything?

I also noticed that Fider grabs the Discord account's ID when sign-in with OAuth, and it's required for it to work, but what is it used for?

The Discord account's ID is used as reference ID. The reference ID is used to search an existing user before creating a new one.
You can think the database as:

User ID	Ref ID	Email	Name	...
1	324851291715141636	email@example.org	indyteo	...
2	611113354828347109	john.doe@gmail.com	John Doe	...
...	...	...	...	...

When the Create User API endpoint is reached, Fider search users using the Ref ID and the email, when possible. POST request at /api/v1/users will retrieve the User ID 2 (John Doe's account) with one of the following content:

{
  "name": "John Doe",
  "email": "john.doe@gmail.com",
  "reference": "611113354828347109"
}

{
  "name": "John Doe",
  "email": "john.doe@gmail.com"
}

{
  "name": "John Doe",
  "reference": "611113354828347109"
}

If no user exist with a email "john.doe@gmail.com" nor a reference ID (Discord user ID in your case) "611113354828347109", then a new account with name "John Doe" is created and its newly inserted user ID is returned (and the email and ref ID given are stored to map future request to this user).

Of course some users might not want to share their email address. Two solutions here:

1. Make the email linking optional and then ideas posted by a Discord user with no email linked are made by a user with only a ref ID (the Discord user ID). So if by change the user log in to Fider using the Discord OAuth provider, the idea will be linked to his account. However, if not, the idea will be associated to the other account.
2. Completely remove the email linking from Discord and only use Discord user ID as reference ID, and disable email sign in and every other OAuth provider than the Discord one.

I think the best option for you is the first one. Let's have a closer look to the different cases of users you would have:

A Discord user make a suggestion using your /suggest command:

1. An email is linked to the Discord user ID.
   You reach the Create User API endpoint with the following content:

   {
     "name": discord.getUsername(),
     "email": bot.getLinkedEmail(discord.getUserId()),
     "reference": discord.getUserId()
   }

   Fider will search for an account with either the given email or reference (ID):

   1. Your user has already signed in to Fider using the email or Discord OAuth.
      The Fider user's account is found and is returned

   2. Your user has never signed in to Fider using the email or Discord OAuth:
      A new account is created using the email and ref ID (and name obviously).

      The same user come to Fider now for the first time:

      1. He use email or Discord OAuth to sign in.
         The account that was created is found matching email or ref ID.

      2. He use another authentication method.
         A new separate account is created, because the user used neither the email nor the Discord OAuth. This is ineluctable.

2. No email is linked to the Discord user ID
   You reach the Create User API endpoint with the following content:

   {
     "name": discord.getUsername(),
     "reference": discord.getUserId()
   }

   Fider will search for an account with the given reference (ID):

   1. Your user has already signed in to Fider using the Discord OAuth.
      The Fider user's account is found and is returned

   2. Your user has never signed in to Fider using the Discord OAuth:
      A new account is created using the ref ID (and name obviously).

      The same user come to Fider now for the first time:

      1. He use Discord OAuth to sign in.
         The account that was created is found matching ref ID.

      2. He use another authentication method.
         A new separate account is created, because the user didn't used the Discord OAuth. This is ineluctable.

You received a Fider account ID to create the post and reach the Create Post API endpoint.

Then, the same Discord user make another suggestion. The same process is applied except that because the email or ref ID given to the Create User API endpoint are the same, no account are created, only the existing are found and returned.

I hope you have a clearer overview of the situation now, if something is still dark, feel free to ask!

[jorys-paulin]

Thanks a lot for the help. It seems like using reference gives the effect I want. No matter what the other fields are, the same reference will always give the same Fider user id, which means I can just use that and avoid duplication for most accounts.

For existing accounts, I guess we could ask the user if they already have one, and if so they can provide their email address to make sure they get their existing account, and that would be optional of course.

[jorys-paulin]

Okay, I have the first version of this working, it creates an account for each user with reference as the user's Discord account ID.

However, it seems like Fider can't do anything with that reference afterwards, as when the user signs-in through the UI using the Discord (email) or Discord (no-email) provider, they get different accounts (in fact, they can have three different accounts).

After experimenting, I now know that Fider considers reference, Discord (email) and Discord (no-email) to be different providers, like would be Facebook, Google and GitHub, and that's why it creates new accounts each time instead of linking to existing ones. That's also why when users sign-in using Discord (email) then Discord (no-email), they get different accounts.

I'm not sure how this can be solved, as the only field that can link to existing accounts is email, which is unavailable using Discord slash commands or the Discord (no-email) provider. You could tell Fider that two providers are the same service (feature request?), which would solve signing in with the UI but not creating accounts through the API, which is what my bot uses.

Have I missed something there, or is it just impossible to not have duplicate accounts?