Planned removal of features: are you using them?

[fynnlyte]

Hi all,

I'm about to clean up superlogin-next's dependencies a bit further over the course of the next week. Please let me know whether you are using any of the following:

• IAM authentication on IBM Cloudant. The cloudant package is deprecated, but the new cloud-sdk doesn't seem to be quite ready and would require major rewrites internally, so I'd like to switch back to nano.
• Request parameters to customize the ejs - templates.
• passport can currently be passed when creating a superlogin instance. Do you have use cases for that or should that rather be an implementation detail? I'd like to upgrade to passport 0.5.
• customization of the signup fields via the userModel - config option. I'm considering to remove sofa-model and only keep the validate - option via validate.js (i.e. the way it currently works for passwordConstraints)
  • Anything more complex can by handled by intercepting the request before passing it to superLogin or via the onCreate - actions.

[fynnlyte]

Ping to @TssT16, @Karalix, @chrispahm, @rilrom, @Gods1son, @sullyinc, @dheimoz, @maxcodefaster and who else might be using this.

[dheimoz]

Hey @LyteFM thanks for consider my opinion. I have a couple of projects that are using IAM Auth. Seeing the package is deprecated makes me reliaze I also need to switch to nano.

I will inform the Pouchdb community and make awareness

Thank you very much.

[fynnlyte]

I realised that it's still possible to migrate to nano in this package, but to keep compatibility with Cloudant: Instead of providing the Cloudant credentials via the config, you'll need provide the ServerScope which will then be used for all subsequent requests.

[fynnlyte]

@dheimoz you can try out 0.16.0 now and pass the ServerScope as 2nd argument for the superlogin-API.

See the changelog - only nano is included in this package and passing the 2 db has been removed in favour of passing the ServerScope.

[Karalix]

Thanks a lot for the ping, not using any of those features. But it's nice to see that the project is living well, as I was CO sideri g it for a big project of mine.

[fynnlyte]

Yup it's alife and well. Just one company is maintaining it, though. Don't expect many new features to land or big, breaking changes though - I'm just cleaning things up a bit before declaring it 1.0 and „ready”.

[sullyinc]

Thanks for the ping, we're not using IAM auth. We do use passwordConstraints, for local, and we've made some modifications to support custom validation messages.

[fynnlyte]

Did you have to fork it or were you able to achieve that by using validate.js? This is exactly the use case for configuring passwordConstraints.

[fynnlyte]

I'd also like to remove the option to pass request parameters directly to ejs because this is a possible attack vector, see e.g. this vulnerability.

To me, the only use cases for adding request data to the mails would be a customization of the user name or the localization based on the request IP. I'd rather like to pass the sl-doc of the user instead: Additional relevant data can be processed from there.