When successfully invite user by email it's not cleared from the input

[maxceem]

Expected behavior

When successfully invite a user by email it's cleared form the input.

Actual behavior

When successfully invite a user by email it stays in the input as if we failed to invite such a user.

Steps to reproduce the problem

• Invite any user by email (in the Customer Team), but the user should not be registered in Topcoder yet
• Observer that success alert has been shown in the bottom left corner and invitation has been added to the list. But the email still stays in the input field.

Screenshot/screencast

User

Any non-admin user who got masked emails, for example, pshah_manager.

Reason

This happens after we started masking emails in the invites. So when we get response from the server with masked email, we don't know if we should remove it from the input or no.

[RishiRajSahu]

@maxceem not reproducible, email got cleared after successful invite ?

[maxceem]

@RishiRajSahu This issue can be reproduced by any non-admin user who got masked emails, for example, pshah_manager. Also, probably, user shouldn't be registered in the system yet.

[RishiRajSahu]

yep just realized that and tried with my copilot user, its reproducible

[maxceem]

There are two ways to go for fixing this:

1. Proper Project Service has to return emailChecksum (md5 of email) that we can use for removing invited email from the input. This would require implementing it server-side.
2. Incosistent. Actually, when we invite users by email we can skip masking email in such case in Project Service as user who invited by email already know this email. Now it works like this: we invite someone by email, send it to the server, but the server returns email masked after creating the invitation. Actually, we know that email, so the server might return it as it is - not masked. The downside of such an approach is that we would have inconsistency in displaying such an invitation. As soon as we invite user by email, we would see the email unmasked, but as soon as we reload the page we would see it masked.

@RishiRajSahu which way do you prefer?

[RishiRajSahu]

@maxceem I prefer doing it proper way.

totally separate thought, could we allow the users to see their invited user's email instead of masking them, could there be any risk with this approach? could other personB unmask Person A's invites email by just knowing the userId of personA in that approach.

[maxceem]

totally separate thought, could we allow the users to see their invited user's email instead of masking them, could there be any risk with this approach? could other personB unmask Person A's invites email by just knowing the userId of personA in that approach.

I think we can do that. So when Project Service would mask emails it could check if the user who created each invite, and for the invite created by the current user who makes the requests such emails could be returned unmasked. I don't see security loops here and from the top of my head, this is doable.

[vikasrohit]

@maxceem just wanted to check on if we are working on this one in this release.

[maxceem]

@vikasrohit this only happens when we enable email masking, which is temporarily disabled. This would be handled together with enabling email masking again, as now we have all ready server-side to fix this.