Vendure sends verification email when customer is created without email address in the admin-ui

[jopdop30]

Describe the bug
When a new customer is created in the admin-ui without setting an email address for the customer,
Vendure still tries to send a verification email to the customer.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'customers' in the admin-ui
2. Click on 'create new customer'
3. Only enter a first and last name
4. Click on 'create'
5. Check dev mailbox

Expected behavior
An email shouldn't be sent as there is no email address to send to.

This behavior occurs in my own Vendure servers and in the official Vendure demo

[michaelbromley]

Is there a reason to create a customer without an email address? What you describe is certainly a bug, but I think that event allowing a new customer to be manually created without an email address is also wrong. Thoughts?

[agustif]

Is there a reason to create a customer without an email address? What you describe is certainly a bug, but I think that event allowing a new customer to be manually created without an email address is also wrong. Thoughts?

I can think older customers of mine that would (maybe) not have or handle email very well.

I guess a sales-rep could create their customer from admin-ui, would llike to have another way to confirm identity as mobile phone number for example, in order to recover password/access to account or just confirm it's the customer

Just my 2 cents

[michaelbromley]

@agustif Yeah that is valid, but also implies a completely custom AuthenticationStrategy using a different factor than email address to authenticate. But if we assume the default NativeAuthenticationStrategy (email address-based) then I'm wondering if there is any valid reason to create a Customer with no email address. Because then it would not be possible for them to ever log in.

[agustif]

@agustif Yeah that is valid, but also implies a completely custom AuthenticationStrategy using a different factor than email address to authenticate. But if we assume the default NativeAuthenticationStrategy (email address-based) then I'm wondering if there is any valid reason to create a Customer with no email address. Because then it would not be possible for them to ever log in.

I guess then only if you want to be able to add orders from non-online channels from which the customer data might not have an email but be a -somewhat- valid order nontheless? I don't know...

[michaelbromley]

I guess then only if you want to be able to add orders from non-online channels from which the customer data might not have an email but be a -somewhat- valid order nontheless? I don't know...

In that case you are trying to use Vendure for something it was not intended as, a general-purpose CRM. Let's see what @jopdop30 has to say.

[jopdop30]

Considering this bug isn't catastrophic and might require quite a bit of work, maybe this could be part of a milestone further down the road?

[jopdop30]

I guess then only if you want to be able to add orders from non-online channels from which the customer data might not have an email but be a -somewhat- valid order nontheless? I don't know...

In that case you are trying to use Vendure for something it was not intended as, a general-purpose CRM. Let's see what @jopdop30 has to say.

I just discovered this bug by playing around, I wouldn't be using this myself in a real world scenario but I felt it responsible to disclose here.

[michaelbromley]

@jopdop30 Thanks for the clarification. I only assigned it to milestone 0.14.1 because I'm right now working on "easy" issues and this just came up. I already fixed it, took about 10 minutes ;)

OK so in addition to what I've already done, I'll actually make the email field required when creating a customer.