feat(admin): set primary email after recovery complete #16516
Conversation
If the Account Recovery process has an email that is to be used during the process, 'activate' it at the end once completed. Resolves pypi#16401
miketheman
added
admin
|
I think this fits the need. One thought that I hadn't really considered is if we should skip password/2FA reset in these conditions. My understanding is that generally this state occurs when someone has their password/2FA but has lost access to the original primary email address. @Thespi-Brain, do you have any input here? |
|
@ewdurbin I think we should still keep the password/2FA reset because there have been cases where 2FA was not set up in addition to the user not having access to their original primary email address. It's also nice to have a "clean" reset for due diligence and security. |
There was a problem hiding this comment.
@Thespi-Brain I am assuming that for situations where users still control their password/2FA, we will update their email address without the account recovery process leading to resetting password/2FA. If so this is good to go.
|
@ewdurbin Yes, we don't go through the account recovery process for an email update if the user doesn't have any existing projects. |
If the Account Recovery process has an alternate email that is to be used during the process, 'activate' it at the end once completed.
Resolves #16401