...
| Attribute | Type | Required | purpose |
|---|---|---|---|
| name | string | true | name of user. can be combination of firstname , middle name and lastname |
| username | alphanumeric | false | unique identity to identify user. user name will be unique per installation |
| password | alphanumeric | true | |
| phone | number | conditional | either phone or email is mandatory . but during creation time user can't pass both. |
| alphanumeric | conditional | either phone or email is mandatory . but during creation time user can't pass both. | |
| userType | string | internal | To identify user is Teacher or Other , as of now there is only two types |
| isPhoneVerifiedphoneVerified | boolean | internal | will be true only when user verified phone otp |
| isEmailVerifiedemailVerified | boolean | internal | will be true only when user verified email otp |
Proposed solution 1:
Self sign up work flow:
- User will enter all mandatory field (name, phone/email, username,password) on consumer portal/app
- Consumer will make call for generate OTP for either phone or email
- OTP Generation will be taken care by Design for One time password (OTP)
- Once User enter OTP, consumer will check OTP basic Validation and then it will call create user APi:System will check uniqueness of email/phone , username and OTP , if every thing is ok then it will create user under sunbirdverify OTP using following design Design for verify OTP
- Once OTP is verified then they will call create user api.
- if any validation fails then it will throw proper error
| Code Block | ||||
|---|---|---|---|---|
| ||||
Changes in Create User api request body:
URI: v2/user/create
Method: POST
Request body:
{
"request":
{
"firstName":"name of user",
"email":"valid and unique email id",
"phone":"valid phone number",
"password":"user password",
"username" : "unique user name. Optional",
"channel" : "rootOrgchannel value (Optional)"// if user pass it , it must be valid and user will be associated with this as "PUBLIC" role.
"organisationId": "",
"sourceemailVerified": true, // will be "google"// optional true when user pass emailId
"phoneVerified" : true // will be true when user pass phone.
}
}
- Changes in create user api:
* username : field will be optional (if user is passing it then system will verify uniqueness only, if user is not passing then system will generate unique username.)
* channel : This field is optional .
* if caller will pass it, then system will verify it's validity ( should be rootOrg and status as active) once it's verified then user will be associated with that rootOrg.
* if channel is invalid or not active then creation will fail with proper error message.
* organisationId : This field is optional.
* if caller passes both channel and organisationId then , organisationId should be either suborg or rootOrg under same channel. it's status should be active. once it's verified then user will be associated with both as role "PUBLIC"
* if channel and organisationId belongs to different rootOrg or channel is active but suborg(organisationId) is inactive then user creation will fail with proper error message.
* if user will pass on organisationId , then system will check organisationId should be valid and active. if both condition satisfied then user will be associated with
corresponding rootOrg and suborg with role "PUBLIC".
* User creation won't ask any phoneverified or emailVerified field.
* Once Phone/email is verified by user in DB it will mark isPhoneVerifiedPhoneVerified or isEmailVerifiedemailVerified as true.
* For Google signIn user email verified will be always true.
Doubts:
* How to do validation for Indian phone number. As per PRD only Indian phone number is valid.
* Are we taking country code as well from user , or always will associate user country code as "+91"
|
As per discussion with design council we are going to take proposed solution 1:
Storage of user data pre-user creation:
...
| Pros | Cons |
|---|---|
|
|
Notes: After design discussion No need for storage of pre user creation.
Google sign In:
When user come to sunbird via Google sign in , Caller will do following check.
...
| Code Block | ||
|---|---|---|
| ||
URI: v1/user/verifyAndCreate
Method: POST
Request body:
{
"request": {
"firstName":"",
"email":"",
"phone":"valid phone number",
"verificationCode":"can be OTP or google token",
"verificationSource":"id_token in case of Google",
}
}
Response:
same as create user api
* This api will do following validation:
1. Make request verification api call based on verificationSource. In Case of OTP it will verify against generated OTP and in case of Google it will verify against below url.
https://www.googleapis.com/oauth2/v3/tokeninfo?id_token={verificationKey}
2. once verified then it will make create user api call to create a user once user is created his/her email verified field will be true.
Open Question:
1. What will happen if user is in sunbird but his/her status is inactive or deleted?
2. There is an old user in system whose emailVerified filed is false and same user trying to login with Google signin?
|
Notes: As per design discussion this will be completely handled by portal or app team . Sunbird backend need to just make emailVerified as true, if user create call is coming after Google signin.
State sign-in
When user comes through state-portal, he/she will get a link to access Diksha portal.
...
Resp: As discussed username will be auto-generated - internally system will make sure that auto-generated username will be related to user and not very hard to remember.
it will have lowercase of name and appended with 4 random digit. if name will be separated by spaces then space will be replaced by "_".
Example : MD MANZARUL HAQUE : md_manzarul_haque0098
* Does system need to generate password for Google signup user?
...