[Jetpack Setup] Use Magic Link for suspicious emails #13409

hichamboushaba · 2025-01-28T10:00:30Z

Description

This PR updates the WPCom login that takes part of the Jetpack Setup to use Magic Link by default for suspicious emails, the main changes are:

Trigger the Magic Link flow when detecting a suspicious email.
Update the Magic Link screen to allow not triggering the email automatically at start.
Update the Magic Link screen to show the "username" fallback button.

Steps to reproduce

Use a non-Jetpack site (either Jetpack not installed, or Jetpack not connected)
Sign in to the site.
Open the app.
Enable the API faker and add an endpoint following the below:

Endpoint type: WordPress.com
Endpoint path: /v1.1/users/{email}/auth_options (replace email with your WordPress.com email)
Response status code: 403
Response body: 
{
        "error": "email_login_not_allowed",
        "message": "Please log in using your WordPress.com username instead of your email address."
}

Tap on the Jetpack benefits banner.
Start the Jetpack setup.

Testing information

TC1: Use Magic Link for the login, and confirm you can continue.
TC2: Use the "username" button on the Magic Link screen, then use your username/password.

The tests that have been performed

^

Images/gif

Screen_recording_20250128_110632.mov

I have considered if this change warrants release notes and have added them to RELEASE-NOTES.txt if necessary. Use the "[Internal]" label for non-user-facing changes.

Reviewer (or Author, in the case of optional code reviews):

Please make sure these conditions are met before approving the PR, or request changes if the PR needs improvement:

The PR is small and has a clear, single focus, or a valid explanation is provided in the description. If needed, please request to split it into smaller PRs.
Ensure Adequate Unit Test Coverage: The changes are reasonably covered by unit tests or an explanation is provided in the PR description.
Manual Testing: The author listed all the tests they ran, including smoke tests when needed (e.g., for refactorings). The reviewer confirmed that the PR works as expected on big (tablet) and small (phone) in case of UI changes, and no regressions are added.

dangermattic · 2025-01-28T10:01:24Z

	1 Error
🚫	PR is not assigned to a milestone.

Generated by 🚫 Danger

wpmobilebot · 2025-01-28T10:04:35Z

📲 You can test the changes from this Pull Request in WooCommerce-Wear Android by scanning the QR code below to install the corresponding build.

	App Name	WooCommerce-Wear Android
	Platform	⌚️ Wear OS
	Flavor	Jalapeno
	Build Type	Debug
	Commit	`2f12442`
	Direct Download	`woocommerce-wear-prototype-build-pr13409-2f12442.apk`

wpmobilebot · 2025-01-28T10:17:35Z

📲 You can test the changes from this Pull Request in WooCommerce Android by scanning the QR code below to install the corresponding build.

	App Name	WooCommerce Android
	Platform	📱 Mobile
	Flavor	Jalapeno
	Build Type	Debug
	Commit	`2f12442`
	Direct Download	`woocommerce-prototype-build-pr13409-2f12442.apk`

hichamboushaba · 2025-01-28T10:24:15Z

WooCommerce/src/main/res/navigation/nav_graph_jetpack_activation.xml

+            app:launchSingleTop="true"
+            app:popUpTo="@id/jetpackActivationMagicLinkRequestFragment"
+            app:popUpToInclusive="true" />


This combination or parameters allows us to have only a single instance of the password fragment when used in this flow, as the popUpToInclusive will make sure the MagicLinkRequestFragment is removed from backstack, to make PasswordFragment as the top one, and then it will be replaced.

TIL about these popUpTo and popUpToInclusive.

hichamboushaba · 2025-01-28T10:24:33Z

WooCommerce/src/main/res/navigation/nav_graph_jetpack_activation.xml

+            app:launchSingleTop="true"
+            app:popUpTo="@id/jetpackActivationMagicLinkRequestFragment"
+            app:popUpToInclusive="true" />


Same as above.

irfano

Good job on adding this feature to a complex flow, @hichamboushaba !
I’ve added some comments and minor suggestions, but none of them are blockers, so I’m approving. I tested it and didn’t find any issues. 👍🏻

irfano · 2025-01-30T23:15:49Z

...in/com/woocommerce/android/ui/login/jetpack/wpcom/JetpackActivationMagicLinkRequestScreen.kt

+            val fallbackButtonText = when (viewState.magicLinkFallbackButton) {
+                MagicLinkFallbackButton.Password -> R.string.enter_your_password_instead
+                MagicLinkFallbackButton.UsernameAndPassword -> R.string.login_use_wpcom_username_instead
+                MagicLinkFallbackButton.None -> null
+            }


A minor suggestion: We can move this logic to the view model. So, the ViewState can only have fallbackButtonText.

irfano · 2025-01-30T23:51:51Z

...n/kotlin/com/woocommerce/android/ui/login/jetpack/wpcom/JetpackActivationWPComEmailScreen.kt

@@ -162,6 +168,7 @@ private fun JetpackActivationWPComScreenPreview() {
    WooThemeWithBackground {
        JetpackActivationWPComEmailScreen(
            viewState = JetpackActivationWPComEmailViewModel.ViewState(
+                usernameOnly = false,


Please correct me if I'm mistaken. We were using this screen with a text field labeled "email or username". Now, we've added usernameOnly argument, allowing the same screen to be used with only a "username" text field. Is that correct?

I'm considering whether we should rename the class from JetpackActivationWPComEmailScreen to JetpackActivationEmailOrUsernameScreen. I found it challenging to understand what was happening here, and I believe this change could make things clearer.

irfano · 2025-01-31T00:17:15Z

WooCommerce/src/main/res/navigation/nav_graph_jetpack_activation.xml

+            app:launchSingleTop="true"
+            app:popUpTo="@id/jetpackActivationMagicLinkRequestFragment"
+            app:popUpToInclusive="true" />


TIL about these popUpTo and popUpToInclusive.

irfano · 2025-01-31T00:30:19Z

...n/com/woocommerce/android/ui/login/jetpack/wpcom/JetpackActivationWPComEmailViewModelTest.kt

-                    WPCOM_EMAIL,
-                    JETPACK_STATUS,
+                    emailOrUsername = WPCOM_EMAIL,
+                    jetpackStatus = JETPACK_STATUS,
+                    magicLinkFallbackButton = MagicLinkFallbackButton.None,
+                    requestAtStart = true,


Is given email is WPcom passwordless user, when onContinueClick clicked, then trigger ShowPasswordScreen() incorrect? This test asserts that the magic link screen is shown, not the password screen.

irfano · 2025-01-31T00:46:43Z

...woocommerce/android/ui/login/jetpack/wpcom/JetpackActivationMagicLinkRequestViewModelTest.kt

+            verify(wpComLoginRepository, never()).requestMagicLink(
+                emailOrUsername = EMAIL,
+                flow = MagicLinkFlow.SiteCredentialsToWPCom,
+                source = MagicLinkSource.JetpackConnection,
+                isSignup = false
+            )


Since we are checking never condition, I suggest having general parameters here. Because, in the future, we might change SiteCredentialsToWPCom to something else in the code. Then this test case may give false positive.

Suggested change

verify(wpComLoginRepository, never()).requestMagicLink(

emailOrUsername = EMAIL,

flow = MagicLinkFlow.SiteCredentialsToWPCom,

source = MagicLinkSource.JetpackConnection,

isSignup = false

)

verify(wpComLoginRepository, never()).requestMagicLink(any(), any(), any(), any())

hichamboushaba added 9 commits January 27, 2025 11:09

Remove unused argument

ab7ca90

Navigate to magic link screen when email/password is not allowed

22170a7

Update unit test

625a017

Update navigation logic to allow for different fallback button types

05b91fe

Update fallback button text depending on use case

911a2e0

Don't send magic link automatically at start for suspicious emails

ab371ba

Handle navigation for fallback magic link actions

ede70fe

Update login screen logic to work with username mode

0a3860d

Add unit tests

3801a1e

hichamboushaba added type: enhancement A request for an enhancement. feature: login Related to any part of the log in or sign in flow, or authentication. feature: REST API Support connecting to sites using WordPress REST API. labels Jan 28, 2025

hichamboushaba added 2 commits January 28, 2025 11:22

Fix detekt issues

9653e9c

Add a release note

2f12442

hichamboushaba commented Jan 28, 2025

View reviewed changes

hichamboushaba marked this pull request as ready for review January 28, 2025 10:25

hichamboushaba requested review from JorgeMucientes and irfano January 28, 2025 16:23

irfano self-assigned this Jan 30, 2025

irfano approved these changes Jan 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Jetpack Setup] Use Magic Link for suspicious emails #13409

[Jetpack Setup] Use Magic Link for suspicious emails #13409

hichamboushaba commented Jan 28, 2025 •

edited

Loading

dangermattic commented Jan 28, 2025 •

edited

Loading

wpmobilebot commented Jan 28, 2025 •

edited

Loading

wpmobilebot commented Jan 28, 2025 •

edited

Loading

hichamboushaba Jan 28, 2025

irfano Jan 31, 2025

hichamboushaba Jan 28, 2025

irfano left a comment

irfano Jan 30, 2025

irfano Jan 30, 2025

irfano Jan 31, 2025

irfano Jan 31, 2025

irfano Jan 31, 2025

[Jetpack Setup] Use Magic Link for suspicious emails #13409

Are you sure you want to change the base?

[Jetpack Setup] Use Magic Link for suspicious emails #13409

Conversation

hichamboushaba commented Jan 28, 2025 • edited Loading

Description

Steps to reproduce

Testing information

The tests that have been performed

Images/gif

Reviewer (or Author, in the case of optional code reviews):

dangermattic commented Jan 28, 2025 • edited Loading

wpmobilebot commented Jan 28, 2025 • edited Loading

wpmobilebot commented Jan 28, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

irfano left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hichamboushaba commented Jan 28, 2025 •

edited

Loading

dangermattic commented Jan 28, 2025 •

edited

Loading

wpmobilebot commented Jan 28, 2025 •

edited

Loading

wpmobilebot commented Jan 28, 2025 •

edited

Loading