Email anonymous registrations a confirmation link that signs them in (#4018)

An anonymous register-flow registration can't create its bike —
`Ownership` needs a creator — so step 1 now emails the address a link.
Following it proves the address, creates a passwordless account, signs
them in, and creates the bike the registration was holding, dropping
them on whatever step they're on.

- **The link carries its own single-use token**, minted only in the send
path, bound to the address it was mailed to, and spent on use. The
registration's `id_token` is already in the registrant's URL before any
email goes out, so a click carrying it would prove nothing about who
received what. Binding matters because step 1 stays resubmittable:
without it, editing `owner_email` after the link went out would let that
link confirm — and sign you in as — an address you never received mail
at.
- **`BParam::TOKEN_EXPIRATION` (90 days) governs both** the link and how
long the register flow resumes by token, since a link outliving the
registration it resumes is a dead end. The confirm lookup applies no
window of its own, so an expired link can say so and send a new one
rather than dumping them into a fresh registration.
- **The landing page only renders a form that posts itself** via #4019's
`auto-submit` controller — a link scanner's GET can't spend the token.
Resends are rate limited off a stamp written by the sender, not by the
delivering job.
- **The account it makes is a `passwordless_user`**, so it gets #4019's
offer to set a password like every other emailed sign in; an address
that already has an unconfirmed account gets confirmed, as the magic
link does. Creating one moves out of `Users::ProcessOrganizationRoleJob`
into `UserServices::PasswordlessCreator`, and the non-redirecting half
of `Sessionable#sign_in_and_redirect` becomes `sign_in_user`, so this
lands in the same session state as every other sign in.
- **The email rides on `Email::PartialRegistrationJob`**, which now
takes the notification kind alongside the id — it and
`partial_registration` are the two a registration sends before it has a
bike, so they share the domain check and the notification. Both are
seeded now, since nothing else leaves a b_param mid-flow for the mailer
previews.

New accounts still land on the terms-of-service gate the first time they
visit their account — same as passwordless org accounts. If step 1's
submit should count as acceptance, that's a follow-up.

Author: sethherr

app/components/emails/partial_register_confirmation/component.en.yml

@@ -0,0 +1,15 @@
+---
+en:
+  components:
+    emails:
+      partial_register_confirmation:
+        click_below_to_pick_up_where_you_left_off: Click below to confirm this email
+          address and pick up where you left off.
+        confirm_and_continue: Confirm my email
+        confirm_your_email: Confirm your email
+        link_signs_you_in: >-
+          This link signs you in to Bike Index, so don't forward it. It works for
+          %{days} days.
+        we_saved_your_registration_html: >-
+          We saved your registration for a <strong>%{color_and_brand}</strong> on
+          the world's most comprehensive bike registry.

app/components/emails/partial_register_confirmation/component.html.erb

@@ -0,0 +1,11 @@
+<h1><%= translation("confirm_your_email") %></h1>
+
+<p>
+  <%= translation("we_saved_your_registration_html", color_and_brand: @b_param.color_and_brand) %>
+</p>
+
+<p><%= translation("click_below_to_pick_up_where_you_left_off") %></p>
+
+<%= link_to translation("confirm_and_continue"), tokenized_url, "data-pm-no-track" => true, class: "binx-button" %>
+
+<p><%= translation("link_signs_you_in", days: expiration_days) %></p>

app/components/emails/partial_register_confirmation/component.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Emails
+  module PartialRegisterConfirmation
+    class Component < ApplicationComponent
+      def initialize(b_param:)
+        @b_param = b_param
+      end
+
+      private
+
+      def expiration_days
+        BParam::TOKEN_EXPIRATION.in_days.to_i
+      end
+
+      def tokenized_url
+        confirm_register_url(b_param_token: @b_param.id_token,
+          confirmation_token: @b_param.email_confirmation_token)
+      end
+    end
+  end
+end

app/components/emails/partial_registration/component.html.erb

@@ -1,7 +1,7 @@
 <h1><%= translation("youre_almost_done") %></h1>
 
 <p>
-  <%= translation("just_a_few_steps_away_html", color_and_brand: color_and_brand) %>
+  <%= translation("just_a_few_steps_away_html", color_and_brand: @b_param.color_and_brand) %>
 </p>
 
 <% if organization_snippet_body.present? %>

app/components/emails/partial_registration/component.rb

@@ -18,10 +18,6 @@ def organization
         @b_param.creation_organization
       end
 
-      def color_and_brand
-        [@b_param.primary_frame_color.presence, @b_param.mnfg_name].compact.join(" ")
-      end
-
       def tokenized_url
         @email_preview ? OrganizedServices::EmailPreview::TOKEN_PATH : new_bike_url(b_param_token: @b_param.id_token)
       end

app/components/register/confirm/component.en.yml

@@ -0,0 +1,8 @@
+---
+en:
+  components:
+    register:
+      confirm:
+        confirming_your_email: Confirming your email
+        continue: Continue
+        this_only_takes_a_moment: Hang on, we're picking up where you left off.

app/components/register/confirm/component.html.erb

@@ -0,0 +1,15 @@
+<%= render Register::Page::Component.new do %>
+  <div class="tw:px-1 tw:py-6 tw:text-center">
+    <%= render UI::Header::Component.new(text: translation(".confirming_your_email"),
+        subtitle: translation(".this_only_takes_a_moment")) %>
+
+    <%= form_with(url: confirm_email_register_path, method: :post,
+        data: {controller: "auto-submit"}) do %>
+      <%= hidden_field_tag :b_param_token, @b_param.id_token %>
+      <%= hidden_field_tag :confirmation_token, @token %>
+
+      <%= render UI::Button::Component.new(text: translation(".continue"), color: :primary, size: :lg,
+          kind: :submit, spinner: true, html_class: "tw:w-full") %>
+    <% end %>
+  </div>
+<% end %>

app/components/register/confirm/component.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Register
+  module Confirm
+    # Where the emailed confirmation link lands. Nothing is confirmed by rendering it -
+    # the form posts itself, so a link scanner's GET can't spend the token
+    class Component < ApplicationComponent
+      def initialize(b_param:, token:)
+        @b_param = b_param
+        @token = token
+      end
+    end
+  end
+end

app/components/register/step1/component.html.erb

@@ -67,7 +67,7 @@
     <%= render UI::Button::Component.new(text: translation(".next"), color: :primary, size: :lg,
         kind: :submit, spinner: true, html_class: "tw:w-full") %>
 
-    <% if confirmation_email_pending? %>
+    <% if BikeServices::Register.confirmation_email_pending?(@b_param, user: @current_user) %>
       <p
         class="
           tw:mt-3 tw:text-center tw:text-xs tw:text-gray-500

app/components/register/step1/component.rb

@@ -47,11 +47,6 @@ def cycle_type_names
         CycleType.slug_translation_hash_lowercase_short
       end
 
-      # Only an address the registrant hasn't proven is theirs has anything to wait on
-      def confirmation_email_pending?
-        !@b_param.self_made?(@current_user)
-      end
-
       # Step 1 is only revisitable once submitted, so this is a return from step 2
       # - where abandoning the registration is worth offering
       def returned_from_step_2?