use case: verifying org access using tokens

[ear7h]

Description

A student organization shall verify their privileges as an organization by using a one-time password sent to their email.

Desired Outcome

A one-time password will be created and sent to their specified email. The student organization will then be able to login with the one-time password sent.

User Goal

An organization should be able to do privileged actions, such as modify social media links, descriptions, create events etc. per #22 , #21 , and #27 .

Actor

A student organization

Dependent Use Cases

None.

Requirements

The system shall be able to verify the identities of Admins and grant them associated privileges.

Pre-Conditions

The user in question is a principal member of a valid registered student org.

Post-Conditions

The user has privileged actions for the purposes of modifying name, description and adding events.

Trigger

Student organizations want to be able to create a page with events and contact information to reach a broader audience.

Workflow

1. The user shall request write access to the organization on the website.
2. The system shall send an email to the organization's official email with a one-time token request link.
3. The user shall use the link from the email to go to a page to obtain a token signed with an EventHub secret
   • the token is then used for subsequent requests to make changes to the organization.

Alternative Workflow

None.

Dependent Design Use cases

None.

Design Workflow

1. The user shall enter their email in the org login page.
2. The Controller shall request a new org login using EventHub.js.
3. The server shall send an email with a one-time login link containing a secret to the official email address stored in the database.
   3.1 The user is ensured to have am affiliation to the org because they then access the official email to click on the link
4. (at the one-time link) the controller shall send the secret to the server using EventHub.js.
5. The server shall respond by issuing a token (that can be used repeatedly).
6. The controller shall store the token in a cookie or local storage.
7. Subsequent requests that require authentication shall use the token in the Authorization header.

Design Alternative Workflow

None.

[ear7h]

related to #14

[AdamW19]

For reference, here's a link to JSON Web Tokens: https://jwt.io

In addition, here's Auth0's link on emailed tokens: https://auth0.com/docs/connections/passwordless/guides/email-magic-link