Spiff bounties process - Submission

[harmeet-status]

We are wanting to do bounties for SpiffWorkflow, using SpiffWorkflow.

Process model: https://cawemo.com/share/29b8873a-8332-42ca-bd75-864bddea8bc4

Process model details: https://www.notion.so/Spiff-Bounties-22a7e2e23ee843c7bffd261ab15d1c9b

[harmeet-status]

We may want to use the onboarding process that @MarD0607 is developing, piggyback off this. TBD.

[calexh-sar]

@harmeet-status does this process model fall under one of the current Status process groups? If so, which one? If not, where should it be placed?

[harmeet-status]

Lets do it like this

[calexh-sar]

@harmeet-status is this what you had in mind:

[calexh-sar]

@harmeet-status couple of questions:

1. How do we validate that "Payment address is an ETH wallet"?
2. Which bounty hunter fields are considered PII?

[harmeet-status]

@harmeet-status couple of questions:

1. How do we validate that "Payment address is an ETH wallet"?
2. Which bounty hunter fields are considered PII?

1. https://docs.web3js.org/api/web3-validator/function/isAddress
2. Physical address, Payment address, Percentage split of bounty, per user

[burnettk]

@harmeet-status can we handle ETH address validation by just asking the user to confirm their address or something for the time being? i don't think we are going to have access to the client-side validation library when the process is running.

[harmeet-status]

Yes that is a good idea to save dev time.

[madhurrya]

23. When I submit/resubmit it shows this loading screen for a long time. It might be better to show some text here. Otherwise user might feel something is wrong.
    

[madhurrya]

24. Got this error when resubmitting
    https://dev.app.spiff.status.im/i/76
    

[madhurrya]

25. When I click the Home button here it shows the Spiff home page for few seconds and then it says Access denied. Please check this videos. https://drive.google.com/file/d/19Oq9wqR4TXJxYwR99gv6RnFtDX7x6zQl/view?usp=sharing

[madhurrya]

26. @calexh-sar @harmeet-status are you doing any updates in the model at the moment? I am getting the same above error now when submitting a request also https://dev.app.spiff.status.im/i/85

[madhurrya]

27. @harmeet-status is there any security risk in sending both the url and the password at the same time to the same place?
    

[harmeet-status]

27. @harmeet-status is there any security risk in sending both the url and the password at the same time to the same place?
    

This is ok, run past security. I'm actually considering just sending 1 message, with the secret in the URL. All websites when they get you to confirm the email belongs to you, send you just 1 link to verify. We can follow the same practise, since we no longer allow the user to retrieve an already filled out request, the need to have 2 separate messages, 1 including the link and the other including the password is no longer required.

@calexh-sar could you pls update the model to just use the GUID and not required a password

[calexh-sar]

@calexh-sar how can we handle these edge case scenarios?

If you did not receive a Guest URL and One-Time-Password, your GitHub handle is either not valid or you have not requested to be a Collaborator Contributor on the repository.

Or if you did not receive any Discord messages, your Discord username is invalid.`

@harmeet-status the initial instructions presented should be clear that the bounty hunter needs to be a collaborator in the repository the issue they are requesting resides. As for incorrect GitHub handle and/or Discord username, they just need to provide the correct one.

Is there way to check if the user is a current collaborator through the API?

@harmeet-status we are using the GitHub REST API to check if the requestr is a current collaborator.

[calexh-sar]

27. @harmeet-status is there any security risk in sending both the url and the password at the same time to the same place?
    

I am following what I understand is the process @MarD0607 established with Status Security Team approval that it is acceptable to send both to the same place, but they should be in two different Discord messages. If you hover over each, you can determine that each is a separate message. The time very well may be the same since they were sent sequentially, but they are distinct.

[calexh-sar]

23. When I submit/resubmit it shows this loading screen for a long time. It might be better to show some text here. Otherwise user might feel something is wrong.
    

@madhurrya or @dinithihj I added some text to display after the initial submission and it is not showing up. I suspect that this feature is not working on the interstitial page when transitioning between Guest User Forms, but not sure. If you haven't already, would you please set up a test process to confirm/refute that this is the issue and if it is, write up an issue for it.

[calexh-sar]

24. Got this error when resubmitting
    https://dev.app.spiff.status.im/i/76
    

I am not getting this error. Pls retest and if still getting the error, provide more detail on the steps to reproduce.

[calexh-sar]

25. When I click the Home button here it shows the Spiff home page for few seconds and then it says Access denied. Please check this videos. https://drive.google.com/file/d/19Oq9wqR4TXJxYwR99gv6RnFtDX7x6zQl/view?usp=sharing

@madhurrya I suspect this issue here is we shouldn't take a Guest user to the Home page since they don't have the rights to do anything there. If @burnettk and/or @jasquat concur, please write up an issue so we can address this.

[calexh-sar]

@harmeet-status unless you indicate otherwise, I will assume you will be addressing the text related issues 18-22 above.

[madhurrya]

24. Got this error when resubmitting
    https://dev.app.spiff.status.im/i/76
    

I am not getting this error. Pls retest and if still getting the error, provide more detail on the steps to reproduce.

Alex, today I got the same error when using the link sent in Discord.
https://dev.app.spiff.status.im/i/534

Please try with these info
Issue No : 1320, git : madhurrya discord : madhurya1 (I'll send you the link when I get it)

[madhurrya]

23. When I submit/resubmit it shows this loading screen for a long time. It might be better to show some text here. Otherwise user might feel something is wrong.
    

@madhurrya or @dinithihj I added some text to display after the initial submission and it is not showing up. I suspect that this feature is not working on the interstitial page when transitioning between Guest User Forms, but not sure. If you haven't already, would you please set up a test process to confirm/refute that this is the issue and if it is, write up an issue for it.

I added an issue for this #1740

[madhurrya]

25. When I click the Home button here it shows the Spiff home page for few seconds and then it says Access denied. Please check this videos. https://drive.google.com/file/d/19Oq9wqR4TXJxYwR99gv6RnFtDX7x6zQl/view?usp=sharing

@madhurrya I suspect this issue here is we shouldn't take a Guest user to the Home page since they don't have the rights to do anything there. If @burnettk and/or @jasquat concur, please write up an issue so we can address this.

Added an Issue for this #1741

[calexh-sar]

27. @harmeet-status is there any security risk in sending both the url and the password at the same time to the same place?
    

This is ok, run past security. I'm actually considering just sending 1 message, with the secret in the URL. All websites when they get you to confirm the email belongs to you, send you just 1 link to verify. We can follow the same practise, since we no longer allow the user to retrieve an already filled out request, the need to have 2 separate messages, 1 including the link and the other including the password is no longer required.

@calexh-sar could you pls update the model to just use the GUID and not required a password

Done

[calexh-sar]

@madhurrya regarding #24, the primary reason you were getting this error is because #1320 is a PR, not an issue. In production this should have been caught by the label check since I don't know of any reason a PR would be assigned one of the Bounty labels. But to be safe and thorough, I added a check to make sure the issue requested was a PR with an incorrectly placed bounty label.

[harmeet-status]

Hi EVERYONE, this thread is getting really busy so if any bugs or improvement are raised and they have been fixed/implemented, then pls go back and mark with strikethrough.

[madhurrya]

@harmeet-status is it OK if we create a new ticket for any new issues we find?

[harmeet-status]

28. Got this error after I tried to submit a request, but my GitHub account name was wrong. So then I started again and getting this error. Closing browser and even trying in incognito didn't work.

[madhurrya]

New issues will be added in this ticket #1752