Skip to content

Remove the second prompt to accept or decline an invitation

What does this MR do?

Currently the flow for a user who does not have an account yet for GitLab at the time of invite is below:

  1. A user invites another that does not have an account yet at time of invite.
  2. The invited user gets an email, which is to the invite_url as a get (not post for accepting).
  3. When clicking the link, if they are not logged in, they will be directed to sign in or sing up (standard setup for application).
  4. They are then redirected after sign in to the link they clicked on in the email.
  5. They land on this invite_url show page via get.
  6. This page is the one shown in the description with the accept invite link.
  7. The accept link has a token in it which then hits the accept action as a post action.
  8. User successfully becomes a member.

We want to remove the following steps from above for a user when they click the invite_url if their signed in email after signing in/up matches the invite email:

  1. They land on this invite_url show page via get.
  2. This page is the one shown in the description with the accept invite link.

We'll accomplish this by allowing user to follow steps as seen above after clicking the invite_url in the email, but after they sign up/in, we'll consider that as acceptance and take them to the project or group they were invited to.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Refs #214103

Edited by Peter Leitzen

Merge request reports