[API] possibility to create users and then activate them

[AlainVagner]

We would like to synchronise the users with another database.
Currently we have tried to create one user via POST /users/ and it works, one user is created (the call is done with the api key from one admin user)
But this user cannot be activated and cannot login. The user does not receive any activation email.
When we thus have tried the activation process based on the email address ("renvoyer les instructions de confirmation"), when clicking on a link we get a page saying that the token is invalid.

Am I missing something? Is there any way to create users via API and let them later on do a password recovery to create their password?
Tests done on udata 10.0.3

[maudetes]

I don't know your use case but for a one-shot use case, there is also the udata user create command that exists (which already confirms the user).

The token should be valid when clinking on renvoyer les instructions de confirmation. But looking at the token generation logic, I wonder if the issue doesn't come from fs_uniquifier missing in user creation?
It was added later on and we don't use the post /api/1/users/ route on our side.

I'm unsure on your version, but could you test setting a fs_uniquifier

@api.doc("create_user")
...
def post(self):
  ...
  user.fs_uniquifier = uuid.uuid4().hex
  user.save()
  return user, 201

[AlainVagner]

Thanks for the insight! Indeed this line is missing on our side, we will do some tests with it.

[maudetes]

Let me know if it works as expected, we can add a fix in udata directly.

[AlainVagner]

We have made some tests and unfortunately it did not fix the issue for us. We are investigating and we will keep you posted.

[freesoul]

The change with fs_uniquifier should have been enough to make the confirm form work:

https://staging.data.public.lu/fr/confirm

That was probably an issue in our side.

However I noticed that this user creation route is already restricted to admins, so I directly added user confirmation on it

def post(self):
    """Create a new object"""
    form = api.validate(UserProfileAdminForm)
    user = form.save()
    datastore.set_uniquifier(user)
    confirm_user(user)
    return user, 201

Now, created users via this route are already confirmed, and the password can be reset directly via:

https://staging.data.public.lu/fr/reset