User active functionality

[dgvirtual]

Could someone explain to me the meaning of "active" column in users table?

The original user, created at Bonfire install, is created as inactive (value 0 in column "active"). But the user can login all right. There is a filter in users table that allows to filter by active/inactive status, and the superadmin user there is treated as inactive. There is no way to set the status to active in the Bonfire UI, and it seems the setting is treated as irrelevant.

So, is it lack of implementation in Bonfire, or is it lack of implementation in Shield, or maybe I misunderstand the meaning of user being "active"?

[lonnieezell]

I'm not finding the discussion right now, but it looks like that was something that wasn't finished in Shield just yet. Sounds like there's a missing piece in Bonfire, also.

[kgrruz]

As I recall this field was generally used for account activation via email (or other type of activation). The reason for allowing login even with the account "inactive", I believe it is like some sites that allow the user to access and then activate the account. I don't know to what extent it is currently used.

[lonnieezell]

Yes, looking back, this works with the EmailActivator action.

• By default a user is marked inactive.
• If \CodeIgniter\Shield\Authentication\Actions\EmailActivator::class is specified in Config\Auth for register, the user will be required to go through an activation step where an email is sent to their account and they have to verify it.
• Once they've successfully verified, the active field is set to 1.

It looks like the flow was never finished, though. I think we need to add the following:

1. An $activationNeeded setting in the Auth config file that determines where a user must be active to log in. If you want to require email activation that would be true, otherwise it would be false.
2. Add an active check to the Session and Token filters that rejects the user if they're inactive.

EDIT: This needs to be done on Shield, not Bonfire, though Bonfire will need the User Settings page updated.

[dgvirtual]

In my apps the admin may mark user inactive to prevent him from further interaction with the system while keeping the content created by him intact. So the feature might be used for more than just email verification. (I am using IonAuth, planning a switch to shield).