It's hard to communicate the delivery method to the "token sent" page

[ubershmekel]

@florianheinemann perhaps we can include the delivery method name in the req or res objects? The recipient would be useful too. Would that be an interesting pull request? E.g. I want the user to see the token was sent via SMS to +18481234567 upon delivery success.

[florianheinemann]

Hi,

Just to be sure - you should typically still be able to access "delivery" as well as any other field in your middleware that renders the page.

Using the code of https://passwordless.net/deepdive#several-delivery-strategies the req object should be populated as usual where res.render() is happening

Cheers

[ubershmekel]

router.post('/sendtoken', 
    passwordless.requestToken(
        function(user, delivery, callback, req) {
            if(delivery === 'sms')
                // lookup phone number
            else if(delivery === 'email')
                // lookup email
        }),
    function(req, res) {
          // `delivery` is not defined here
          // is it in req.query or req.body?
          res.render('sent');
});

My tokenSent middleware would have to copy paste this code:

https://github.com/florianheinemann/passwordless/blob/master/lib/passwordless/passwordless.js#L417

Then what if you define a 3rd way to set the delivery method from req?

[florianheinemann]

It should be in req.body - depending if you used POST or GET. While a good proposal, I wouldn't feel comfortable adding it to the req/res object a second time as it would further pollute those objects. However, you could copy & paste the code you mention into a separate middleware for easy reuse

Cheers

[ubershmekel]

That means I would have to somehow get a hold of the options object to correctly handle deliveryField and userField. Note that, for example, passport adds user to the req object upon successful auth http://passportjs.org/docs/authenticate

This is your library. So if you prefer to keep the req object clean that's 100% fair and I'll let this issue r.i.p. I apologize for commenting after you closed the issue twice. Thanks for writing a cool library.

[florianheinemann]

Checked once more what the current situation is and realized that the library does already pollute req to allow 2-step authentication: https://github.com/florianheinemann/passwordless/blob/master/lib/passwordless/passwordless.js#L470

So there wouldn't be much harm to further populate req.passwordless and to store e.g., delivery and user in there.

If you would want to develop the tests and code for that I would be happy to merge.