Prevent Unlinking Social Accounts

Support
1

I’m using Discourse for a gaming community where being able to disassociate your Steam and Discord accounts doesn’t make sense and will only cause issues. How can I stop users from disassociating accounts? I know that the SAML plugin stops it but, since I used Discourse to facilitate rank sync both in-game and on Discord, I really don’t want users unlinking. If anything, I’d rather have to manually unlink it.
image

As a side note, from the admin side would it be possible to display Steam64 ID and Discord IDs? They’re not really confidential per se, and would be really useful information to have readily available. They’re also not exposed via the API which is rather limited for my use-case.

2

You can hide the delete button with. That way users can’t disable?

.btn-danger, .json-schema-editor-modal .json-editor-btn-delete {
    display: none;
}
3

That would partially do the trick, but would anyone know if there’s a way to make it impossible to do so? They could theoretically just go into the browser’s inspect element and un-hide it.

Edit: it looks like after doing some research into this, I found this: discourse/managed_authenticator.rb at main · discourse/discourse · GitHub

What I found interesting was the “can revoke” part, I’m not too sure if I can modify the built-in Discord auth though. Does anyone know if this would be possible?
Edit 2: I tried to modify the Steam Discourse login but was unsuccessful (probably due to my lack of knowledge with Ruby) but here’s what I tried:

# frozen_string_literal: true

# name: Steam authentication with Discourse
# about: Authenticate with Discourse with Steam
# version: 2.0.1
# author: J. de Faye, tgxworld

# omniauth-openid is not included in core since v2.4.0.beta10
unless defined? OmniAuth::Strategies::OpenID
  gem 'ruby-openid', '2.9.2', require: false
  gem 'rack-openid', '1.3.1', require: false
  gem 'omniauth-openid', '1.0.1'
end

gem 'omniauth-steam', '1.0.6'

register_svg_icon "fab-steam" if respond_to?(:register_svg_icon)

def can_revoke?
  false
end

register_asset 'stylesheets/steam-login.scss'

[
  "../lib/auth/steam_authenticator.rb",
  "../lib/validators/enable_steam_logins_validator.rb"
].each { |path| load File.expand_path(path, __FILE__) }

auth_provider authenticator: Auth::SteamAuthenticator.new, icon: 'fab-steam'

For reference, the file I modified is from this extension.

Edit: I was totally editing the wrong part of the plugin, I was able to disable the feature entirely for Steam. Now I just need to figure out how to do this with the Discord login since that’s a core file.

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.