B.C. (and maybe others) not getting account recovery emails

[apjanke]

In the Sep 9 preview event, one of our users wasn't able to get the "password recovery" emails sometimes needed to sign in to an existing account. As reported in Discord:

Discussion

Analysis

I (apj) think this is a Firebase issue. Those password-recovery emails are sent out from Firebase, and I believe triggered by the firebase-reactui widget, not any of our custom code. I didn't see any custom code around this that seems related.

Seems specific to B.C.'s account. I have gone successfully through that same "recover the password" workflow with some of my own accounts in both the prod MUD and my test instance of it; never had a problem with the email not showing up.

Work

I'll have a look at this. Might be fixable just with some ops work triggering a password recovery or reset in the Firebase admin console. Worst case might be fixable with just deleting the account (in Firebase) and having them re-create it. I should be able to access the Firebase console using our shared logins.

[apjanke]

I manually triggered a password reset on B.C.'s account in the Firebase console. Maybe that will get things rolling if the problem was with react-firebaseui (the JS client UI library) not actually causing the Firebase service to fire off the password-reset email.

I also sent B.C. an email describing the situation, and directly including the password-reset link I got from the email template in Firebase. (Which might not work, because Firebase might do some substitution on the parameters in that URL. I don't know.)

We might also be having problems because Firebase is just down? I'm getting HTTP 503 Service Unavailable errors when I go to firebase.google.com in my browser. (Chrome on macOS.)

Details in my detail ticket.

[apjanke]

If that password reset didn't work, next step might be just re-creating the account. That might not work either, though, if the problem is emails from Firebase not getting delivered to that email address. Same problem might happen with the fresh account creation process.

Other option: Have him create a new account with "+" email aliasing on that gmail address (which Firebase recognizes as distinct, but'll go to the same mailbox), or just use a different email address.

To re-create the account

I think we'd need to:

• Delete the Redis entry for that email that maps email -> UID, bc there's logic to prevent an existing email from being taken by a different Firebase user?
• Delete the other Redis entry that maps UID -> email.
• Delete the Firebase account for that user.
• Have him go through the normal account creation process.

Though I might be misremembering the Redis structure here.

Follow-up

If this manual password reset turns out to work, that might mean that the "recover your password" Firebase UI workflow is unreliable due to JS client library issues. In that case, maybe we should add a message like "if you're not receiving password-reset emails, please contact an organizer in the Discord or email contact@..." on the sign-in page.

[apjanke]

The manual password reset request approach worked to get B.C. back in to their account.

On my first try, B.C. reported receiving the password-reset email, but was away from the computer and couldn't use it before it expired. We set up a time for later, I did another manual password reset request in the Firebase console, they got the email and were able to use it to reset their password, and got in to the MUD.

I think this manual reset, plus a note on the login page telling users to contact us, is the best approach for this year. Too late to make substantial code changes to the MUD, and it looks to me like the issue is in the react-firebaseui component and not our own code, so that could take a full library change, and that lib is abandonware now.