Follow up from #3007441: Use new authentication and scope

This might not be possible:
Creating a Drupal user from a Strava login is still disabled (@TODO in AthleteUserHandler::connect()) since email is no longer available.

Issue fork strava-3611130

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

markconroy created an issue. See original summary.

markconroy’s picture

f0ns’s picture

Version: 2.x-dev » 3.0.x-dev
f0ns’s picture

Status: Active » Closed (won't fix)

Closing as won't fix.

Auto-creating a Drupal user from an anonymous Strava login is not something we can support properly. Since the authentication and scope change in #3007441, the Strava API no longer exposes the athlete's email address, and there is no scope that returns it.

We could technically create an email-less account keyed on the Strava athlete id, but that account would be second-class in Drupal:

  • No password reset or one-time login (there is no email to send to).
  • No email notifications of any kind.
  • Open auto-registration from a third party is a spam and abuse vector.

Instead of auto-creating accounts, the supported flow is now "link, don't create": a visitor registers or logs into Drupal normally, then connects their Strava account while authenticated. That path needs no email address.

  • #3611219 wired AthleteManager::createAthlete() into AthleteUserHandler::connect(), so the athlete entity is now created on first connect for an authenticated user (and re-linked rather than duplicated on reconnect).
  • #3611131 removed the leftover email-based registration code (UserManager::registerUser(), getUserByEmail(), AthleteUserHandler::userExists() / userCreate()) that this feature used to depend on.

If a site genuinely needs "sign in with Strava" style account creation, that is better handled by a dedicated external-auth integration (for example a contrib OAuth login bridge) rather than by this module fabricating email-less accounts.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

f0ns’s picture

Status: Closed (won't fix) » Active

  • f0ns committed 983a812b on 3.0.x
    Issue #3611130: Document that anonymous auto-registration is...
f0ns’s picture

Status: Active » Fixed

Documented in code that anonymous auto-registration is intentionally unsupported because this is not possible with the Strava API (no email).

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.