Prevent Unlinking Social Accounts

Support

AI-generated summary

Prevent Unlinking Social Accounts

The discussion revolves around preventing users from disassociating their Steam and Discord accounts in a gaming community on Discourse. cookieman768 wants to stop users from unlinking accounts as it may cause issues, especially since the community uses Discourse for rank sync on both in-game and Discord platforms.

ondrej suggests hiding the delete button using CSS, but cookieman768 notes that this can be bypassed by using the browser’s inspect element.

cookieman768 discovers that modifying the can revoke part in the managed_authenticator.rb file might solve the issue. They attempt to modify the Steam Discourse login plugin but are initially unsuccessful. However, after editing the correct part of the plugin, they manage to disable the feature for Steam. The challenge now is to figure out how to achieve the same result for the Discord login, which is a core file.

1

I’m using Discourse for a gaming community where being able to disassociate your Steam and Discord accounts doesn’t make sense and will only cause issues. How can I stop users from disassociating accounts? I know that the SAML plugin stops it but, since I used Discourse to facilitate rank sync both in-game and on Discord, I really don’t want users unlinking. If anything, I’d rather have to manually unlink it.

image
image346×182 7.45 KB

As a side note, from the admin side would it be possible to display Steam64 ID and Discord IDs? They’re not really confidential per se, and would be really useful information to have readily available. They’re also not exposed via the API which is rather limited for my use-case.

2

You can hide the delete button with. That way users can’t disable?

.btn-danger, .json-schema-editor-modal .json-editor-btn-delete {
    display: none;
}
3

That would partially do the trick, but would anyone know if there’s a way to make it impossible to do so? They could theoretically just go into the browser’s inspect element and un-hide it.

Edit: it looks like after doing some research into this, I found this: discourse/lib/auth/managed_authenticator.rb at main · discourse/discourse · GitHub

What I found interesting was the “can revoke” part, I’m not too sure if I can modify the built-in Discord auth though. Does anyone know if this would be possible?
Edit 2: I tried to modify the Steam Discourse login but was unsuccessful (probably due to my lack of knowledge with Ruby) but here’s what I tried:

# frozen_string_literal: true

# name: Steam authentication with Discourse
# about: Authenticate with Discourse with Steam
# version: 2.0.1
# author: J. de Faye, tgxworld

# omniauth-openid is not included in core since v2.4.0.beta10
unless defined? OmniAuth::Strategies::OpenID
  gem 'ruby-openid', '2.9.2', require: false
  gem 'rack-openid', '1.3.1', require: false
  gem 'omniauth-openid', '1.0.1'
end

gem 'omniauth-steam', '1.0.6'

register_svg_icon "fab-steam" if respond_to?(:register_svg_icon)

def can_revoke?
  false
end

register_asset 'stylesheets/steam-login.scss'

[
  "../lib/auth/steam_authenticator.rb",
  "../lib/validators/enable_steam_logins_validator.rb"
].each { |path| load File.expand_path(path, __FILE__) }

auth_provider authenticator: Auth::SteamAuthenticator.new, icon: 'fab-steam'

For reference, the file I modified is from this extension.

Edit: I was totally editing the wrong part of the plugin, I was able to disable the feature entirely for Steam. Now I just need to figure out how to do this with the Discord login since that’s a core file.