Leo Hemsted ddf88b70c0 clean up logic around existing users accepting invites ...

* if the service issuing the invite does not have permission to edit
  auth types, don't let them do anything. This will stop them turning
  existing email_auth users back to sms auth
* if the user hasn't got a mobile number, but the invite is for sms
  login, don't do anything either. They won't have a phone number if
  they signed up via an email_auth invite previously.

in these cases, we accept the invite and add the user to the service
as normal, however, just don't update the user's auth type.

2017-11-15 17:19:32 +00:00

6.3 KiB

Raw Blame History

View Raw