Allow anonymous use of the chat #5647

snaiperskaya96 · 2017-01-18T13:19:22Z

@RocketChat/core

Closes #604

The idea is basically to create a guest user automatically (We need a physical user due to the massive user checks), assign him guest role and eventually delete it when the session is over.

To enable guest/anonymous access: Admin -> Accounts -> Allow guest access

garg · 2017-01-22T12:25:09Z

I have tested the functionality provided by this patch and, in my opinion, it meets the requirements of #604.

I was able to enable and disable anonymous access from the admin page
I was able to enable and disable 'automatic login' for guests.
I was able to only read data in public channels as guest.
guest accounts get deleted as soon as the tab/window is closed.

As reported in #604, I wasn't able to directly visit a public channel when attempting to go in as a guest when using a direct URL. eg Going to http://localhost:3000/channel/general took me to the login page.

We may want some UI changes such as grouping all guests in the channel user list. And an addition of a more prominent notification that tells users that they are logged in as a read-only guest, and provides a link to register.

I'll continue to test this. Thanks! :)

TheReal1604 · 2017-01-25T09:05:34Z

@snaiperskaya96 thats awesome what you build here.. maybe keep an eye on mobile, whats happening there if i access this with the cordova app? Could there some side effects regarding to this PR?

snaiperskaya96 · 2017-01-25T09:09:42Z

@TheReal1604 Thanks! Honestly i did not test on mobile, though I haven't used any external dependencies or invented any new mechanism so I cannot think of any trouble. Would be great if anyone could test and confirm 😄

maxdwit · 2017-01-25T11:43:27Z

Can this be limited to a subset of channels/private channels?

snaiperskaya96 · 2017-01-25T12:23:04Z

@maxdwit Guest/Anonymous users automatically join default channels, so you can create a room, set it as default and automagically guests will be able to read them.
Also guests have "Guest" (Impressive, right? ;) ) as default role so you may want to modify this permission in order to provide more elasticity 😄

marceloschmidt · 2017-01-26T18:30:41Z

Hey! So I've tried to test it against a copy of our demo server and this would not work on the demo, because we already have several guest-# users... would you like to propose a different solution? Maybe checking if the username exists and increment the number until one doesn't exist?

marceloschmidt · 2017-01-26T18:35:51Z

Something like this, maybe?

		while (RocketChat.models.Users.findOne({ username: username })) {
			guestId++;
			username = 'guest-' + guestId;
		}

marceloschmidt · 2017-01-26T18:38:21Z

Also, can you please change your new .coffee files to .js, please, according to our Guidelines?

snaiperskaya96 · 2017-01-26T18:39:54Z

Sure, will work on it now and hopefully commit in an hour or less

marceloschmidt · 2017-01-26T18:42:22Z

I just realized that guest-# usernames are used by LiveChat. That might pose a problem.

marceloschmidt · 2017-01-26T18:42:35Z

Also,

Those buttons should be removed as well :)

marceloschmidt · 2017-01-26T18:46:22Z

Sorry for being picky, I am just trying to cover all edges :)

When Automatically login user as guest is set to true, I think we should display a message that tells the user it is being automatically logged in and tell them to wait a bit.

marceloschmidt · 2017-01-26T18:47:01Z

Also, there's no way to login or register a guest user after it's logged in... and there's no logout button either.

marceloschmidt

See the comments above for requested changes

snaiperskaya96 · 2017-01-26T18:52:39Z

No worries!

I just realized that guest-# usernames are used by LiveChat. That might pose a problem.

Well I use the guestId field more than the username, I can change it in anonymous-#

Also, there's no way to login or register a guest user after it's logged in... and there's no logout button either

Not sure you would really need to register a guest account, you can just go to the login page and register with your nickname. Also the Login button acts like Logout. It's a matter of context. Using "Logout" instead of "Login" makes the user feel more like already logged in while you are supposed to be a non-logged in guest. But again, I could just change the "Login" button to "Logout"

marceloschmidt · 2017-01-26T19:00:01Z

Hey, sorry... I didn't see the Login button because it was hidden by another bug (our fault, no worries):

The search bar hides it.

marceloschmidt · 2017-01-26T19:00:34Z

And yes, I think you should probably use anonymous-# :)

snaiperskaya96 · 2017-01-26T19:52:41Z

Should be good to go now 😃

When Automatically login user as guest is set to true, I think we should display a message that tells the user it is being automatically logged in and tell them to wait a bit.

I haven't done this one because the login is quite fast and the user wouldn't be able to read it and also i have no idea about where to put it 😜 . Do you think it's really necessary?

graywolf336 · 2017-01-26T20:12:57Z

server/methods/getGuestAccount.js

+			guestId = lastGuest.guestId + 1;
+		}
+		let username = 'anonymous-' + guestId;
+		while (RocketChat.models.Users.findOne({ username: username })) {


I am not a fan of this. I feel like the logic should something like "count how many anonymous- users there are and add one, then check if that one exists and add up from there". That way we aren't starting from anonymous-1 each and every time, but starts from the amount of users + 1.

graywolf336 · 2017-01-26T20:13:51Z

server/startup/removeOfflineGuests.js

@@ -0,0 +1,14 @@
+Meteor.startup(() => {
+	let query = {


The query isn't being assigned a value, so I think this should be const instead of let.

graywolf336 · 2017-01-26T20:15:18Z

server/methods/getGuestAccount.js

+			username = 'anonymous-' + guestId;
+		}
+
+		let userId = Accounts.createUser({


const instead of let as well.

snaiperskaya96 · 2017-01-27T08:59:19Z

Not sure about this last travis failure, false positive?

Edit: Not really, trying to sort it out

mdrobisch · 2017-03-23T10:38:52Z

Any news here?
Thanks.

WebSavvyDude · 2017-04-19T13:48:03Z

Hi, i would like to see "guest" login with the ability to post messages. Also, as someone already mentioned, i think having the ability to keep some user info (even just an IP address) about anonymous users for at least a certain amount of time, is very important. (of course, keeping in mind the use of memory and cpu resources). We run a very popular public chat website now that the current software records the guests IPs in a log and we set up a cron job to delete them at certain intervals. We have worked with law enforcement on numerous occasions to help identify "anonymous" users doing bad things that way. Any new updates on this?

snaiperskaya96 · 2017-04-19T13:53:46Z

I am sorry, looks like the Rocket.Chat team just started ignoring this PR

…

On Apr 19, 2017, at 2:48 PM, WebSavvyGuy ***@***.***> wrote: Hi, i would like to see "guest" login with the ability to post messages. Also, as someone already mentioned, i think having the ability to keep some user info (even just an IP address) about anonymous users for at least a certain amount of time, is very important. (of course, keeping in mind the use of memory and cpu resources). We run a very popular public chat website now that the current software records the guests IPs in a log and we set up a cron job to delete them at certain intervals. We have worked with law enforcement on numerous occasions to help identify "anonymous" users doing bad things that way. Any new updates on this? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5647 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFCOMbmYHnO_JrsS7dFUrVySbqzr9lM_ks5rxhChgaJpZM4Lm359>.

djsteveb · 2017-04-20T00:09:07Z

So this was supposed to be accepted into the release on mar 3, but now it looks like it got punted to the milestone 68.. https://github.com/RocketChat/Rocket.Chat/milestone/68 - by https://github.com/engelgabriel 6 days ago. This thing still has a 'changes requested - and that is listed as "need to prevent user creation" - but we discussed that - why it's needed - and someone else offered code to make that optional right?
@engelgabriel - please explain WTH - as explained earlier in the thread, I can't use rocket chat without this anonymous option - I've now paid for 3 months of vultr hosting waiting to launch rocket chat for testing, donated to this issue with money and time...

now considering if this project should just be forked - or if we should of been spending time working with matrix / https://vector.im/ / riot.im instead -

I see development is busy with other issues - and I respect that - but lack of explanation and punting this without notice - this is worse than what the wordpress devs do, and sadly a very bad sign for this project as a whole.
@snaiperskaya96 marceloschmidt

@graywolf336

@rodrigok
Who is running this thing?
Is this the kind of delay and lack of response we should expect from rocket chat if we continue to invest in it?

I've heard that elixr is better at handling high load chat type things, and that we should consider moving in that direction instead of thinking about meteor based things - however the splashy front for rocket chat made it look like it was more mature than it is it seems.

@hwillson
@abernix

The issues with rocket chat make things look bleak for meteor's future imho.

WebSavvyDude · 2017-04-20T00:19:43Z

I also feel @djsteveb frustration. As for user creation i do believe this should be optional for the Admins to enable and disable. I only need partial user info such as an IP address in the logs and wouldn't mind to see no user creation at all due to the extra resources used. Would love to see this feature enabled. I think it should be a very high priority feature.

djsteveb · 2017-04-20T00:46:57Z

@WebSavvyGuy - I think some clarification may be needed especially within this thread - as I had assumed that people wanted users that could interact - and it seems that many or some were thinking of letting someone just access and view the chat - not actually type anything - which to me it completely different - if someone was just going to enter and watch - then you may just need a log of username chosen, ip addy, rooms entered - whatever..

but I was wanting a user role for guests that admins could choose to allow them to type in main lobby, but not in upper room #2, and not send pms.. then user level registered could do other things, and user level 3 could do more.. - we need extra info for trolls with users - special attention to unicode characters - and the ability to give them roles / restrictions as to what guest users can do.. I want them to be able to type - but with limitations..

frankly - adding a system that just allows someone to enter the chat as a guest and not type - you could just pipe the chat to an html page and let people see that without them having to login to the system and no need to create a user - but I understand others may see things differently - so yes, options all around would be best.. but I think that gets into the other code blocks - how roles work, how they are set controlled... but I have not tested any of that yet.

WebSavvyDude · 2017-04-20T01:00:41Z

@djsteveb Yes, i understood what you wanted. I want almost the same thing. You see, i don't think it is necessary to get all the info (or any for that matter) for a user if they are just "watching" as they wouldn't be able to do anything (spam, troll, etc). Like you, I do want guests to be able to chat also. But i think where we differ is I dont want as much information as you. To be honest i am just looking for username chosen, ip address, and time and date. I value the load of the server very much. One of our chat rooms can have up to 2000 users chatting concurrently so this is very important to me. Thats just one chat room, if i put everything on one server, were talking many more. (I do realize all on one server is not going to cut it). So, thats why i think they don't really want to make the guest as a normal user, to cut down on system resources. I could be wrong here but that's what i read and understood here. Either way, guest user is very very important and i would like one where they delete that guest after a certain interval or even when they log out (but still leave some info such an Ip address)

rodrigok · 2017-04-20T01:07:53Z

Sorry guys, we forgot this PR, we loosed it in our huge list of PRs 😞 we are trying hard to keep improve the code to add more tests, we think it is very important to keep the code without bugs when we merge new features like this one.

We are working to get more people involved on the project to improve the issue triage, pr reviews, etc...

I can understand your frustration, I'll back to work on this implementation tomorrow to ensure this feature in the next release.

I'll fix the conflicts of the PR #5986, merge it and my plan is to start a new PR with a more simple solution for the write problem:

Change the button on text area to allow users to post as guest
Ask user to enter a username (showing a suggestion of a generated username)
Create the user with a role anonymous or something like that to allow permission management with the following permissions by default
a. Allow post message
b. Don't allow create rooms
c. Don't allow direct messages
Replace that role by the role user when user adds an email and confirm it

Any addition or suggestion?

WebSavvyDude · 2017-04-20T01:19:36Z

@rodrigok

Will we have the ability to log in as a guest from the main login screen? (not have to register)?
Ability to set in admin panel if these guest users are automatically deleted after they log out and/or deleted/removed after a certain set time frame (such as idle for more than 20 minutes)
I assume the guest being able to have direct messages with others will be an option we can turn back on if you set them as default off?

Thanks so much for getting this in the next release it will help a lot of us.

rodrigok · 2017-04-20T01:44:28Z

@WebSavvyGuy

Will we have the ability to log in as a guest from the main login screen? (not have to register)?
IDK, I was planing to allow only from inside the room when you are seeing the messages like here Allow anonymous use of the chat #5647 (comment)
Maybe add this feature in other PR?
Ability to set in admin panel if these guest users are automatically deleted after they log out and/or deleted/removed after a certain set time frame (such as idle for more than 20 minutes)
I'll see how we can implement that
I assume the guest being able to have direct messages with others will be an option we can turn back on if you set them as default off?
Yes, since the guest will be a role you can enable the DM back

rodrigok · 2017-04-20T01:45:26Z

I fixed the conflicts of my PR #5986

WebSavvyDude · 2017-04-20T01:47:40Z

@rodrigok If you put it inside the chat room, wouldn't that then require the user to register first in some way to even access the chat room? Thats how i understand RC to operate. Giving them the option to log in immediately from the login box as a Guest would save a lot of time and more user friendly for the end user, IMO.

At least the many chat systems i have worked with had it set up this way.

rodrigok · 2017-04-20T01:49:34Z

@WebSavvyGuy that is what my PR add, the ability to see the public rooms as anonymous without need to create accounts. Since you can see the messages you can decide to create a guest account or login to post a message

WebSavvyDude · 2017-04-20T01:55:33Z

@rodrigok Ok got it now. Well i don't want you to get sidetracked off what you are doing. I hope we can have the ability for the guest user to just choose to login directly into the chat and then maybe we can set the abilities of what that guest can do (type, direct message, etc) via the admin panel in the future then :)

djsteveb · 2017-04-20T02:09:39Z

@WebSavvyGuy - see that's what I was saying - some others are promoting this other method of entering the chat without a login / user needed - that's not what I think most of us need - THIS pr that https://github.com/snaiperskaya96 has made here - does create a user - which is what I think most of us need for many different reasons.

as far as any kind of pruning - does this have the option to auto-delete from DB after X minutes or X days - I don't know. I am pretty sure the user roles are handled by other code chunks already - and from what I have scanned over - it appears that these abilities are optional choices / change-able in the admin screen..

It is my hope that this PR gets put in - so we can actually use this sytem - and then get a wordpress user / auth bridge created and we have a cool system -

I posted some video and additional suggestions on one of my sites and linked to that earlier in the thread here- Feb 14th ( #5647 (comment) ) - showing how the guest login works with similar systems like realchat, avchat, gchat - which is what I have experienced as being the best option for user access, with ability to create a more solid / permanent profile - after entering as a guest without too many barriers to entry - but with more abilities than just "seeing the chatmessages / unable to type"

WebSavvyDude · 2017-04-20T02:14:07Z

@djsteveb I am thinking that having either options is needed by many. They are pretty closely tied so why not try to get both with the options in the admin panel of having either system. I guess easier said than done though :) i can live with either as long as that user is pruned.

rodrigok · 2017-04-25T18:54:12Z

I submitted a new PR with the first version of the anonymous write option #6797

snaiperskaya96 · 2017-04-25T18:55:06Z

Now that's a good news

please-ignore · 2017-10-22T03:57:27Z

This thread is a perfect examply of why we shouldnt invite marketing people and other clueless people to join code issue discussions. These comments were everything from funny to crazy, and more often than not totally missing the point.

Lovely!

snaiperskaya96 force-pushed the allow-anonymous-access branch 5 times, most recently from cc5945d to 34d7f33 Compare January 21, 2017 18:53

snaiperskaya96 mentioned this pull request Jan 22, 2017

Allow anonymous use of the chat [$250] #604

Closed

marceloschmidt previously requested changes Jan 26, 2017

View reviewed changes

snaiperskaya96 force-pushed the allow-anonymous-access branch from f28b3ee to 76c23b3 Compare January 26, 2017 19:58

graywolf336 reviewed Jan 26, 2017

View reviewed changes

graywolf336 previously requested changes Jan 26, 2017

View reviewed changes

snaiperskaya96 force-pushed the allow-anonymous-access branch 2 times, most recently from c860be5 to b2e7f39 Compare January 26, 2017 21:02

engelgabriel removed this from the 0.53.0 milestone Mar 3, 2017

engelgabriel modified the milestones: 0.54.0, 0.55.0 Mar 22, 2017

engelgabriel modified the milestones: 0.55.0, 0.56.0 Apr 13, 2017

rodrigok mentioned this pull request Apr 25, 2017

[NEW] Option to allow to signup as anonymous #6797

Merged

engelgabriel closed this in #6797 Apr 27, 2017

Allow anonymous use of the chat #5647

Allow anonymous use of the chat #5647

Conversation

snaiperskaya96 commented Jan 18, 2017 • edited Loading

garg commented Jan 22, 2017

TheReal1604 commented Jan 25, 2017

snaiperskaya96 commented Jan 25, 2017

maxdwit commented Jan 25, 2017

snaiperskaya96 commented Jan 25, 2017 • edited Loading

marceloschmidt commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017

snaiperskaya96 commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017

marceloschmidt left a comment

Choose a reason for hiding this comment

snaiperskaya96 commented Jan 26, 2017

marceloschmidt commented Jan 26, 2017 • edited Loading

marceloschmidt commented Jan 26, 2017

snaiperskaya96 commented Jan 26, 2017

graywolf336 Jan 26, 2017

Choose a reason for hiding this comment

graywolf336 Jan 26, 2017

Choose a reason for hiding this comment

graywolf336 Jan 26, 2017

Choose a reason for hiding this comment

snaiperskaya96 commented Jan 27, 2017 • edited Loading

mdrobisch commented Mar 23, 2017

WebSavvyDude commented Apr 19, 2017

snaiperskaya96 commented Apr 19, 2017 via email

djsteveb commented Apr 20, 2017

WebSavvyDude commented Apr 20, 2017

djsteveb commented Apr 20, 2017

WebSavvyDude commented Apr 20, 2017 • edited Loading

rodrigok commented Apr 20, 2017

WebSavvyDude commented Apr 20, 2017

rodrigok commented Apr 20, 2017

rodrigok commented Apr 20, 2017

WebSavvyDude commented Apr 20, 2017

rodrigok commented Apr 20, 2017

WebSavvyDude commented Apr 20, 2017 • edited Loading

djsteveb commented Apr 20, 2017

WebSavvyDude commented Apr 20, 2017 • edited Loading

rodrigok commented Apr 25, 2017

snaiperskaya96 commented Apr 25, 2017 via email • edited by engelgabriel Loading

please-ignore commented Oct 22, 2017

snaiperskaya96 commented Jan 18, 2017 •

edited

Loading

snaiperskaya96 commented Jan 25, 2017 •

edited

Loading

marceloschmidt commented Jan 26, 2017 •

edited

Loading

snaiperskaya96 commented Jan 27, 2017 •

edited

Loading

WebSavvyDude commented Apr 20, 2017 •

edited

Loading

WebSavvyDude commented Apr 20, 2017 •

edited

Loading

WebSavvyDude commented Apr 20, 2017 •

edited

Loading

snaiperskaya96 commented Apr 25, 2017 via email •

edited by engelgabriel

Loading