The incident report form is a client-side application. When the user clicks the submit button, we will POST the data to a REST API endpoint managed by the ReportIncident extension.
The API endpoint should:
- require the user to be authenticated to submit
- validate the POST body for the following:
- user ID of person being reported
- revision ID for the page, when the user launched the "report" app
- [pending the DiscussionTools integration] comment ID (optional, used if report button clicked in context of the comment)
- [pending the DiscussionTools integration] topic ID / heading text (used if report button clicked in context of the header, also sent as additional metadata to help locate a comment in a page)
- details text
- abuse types
- ? (any other fields in the form, each one listed as a parameter)
For validated POST body, the endpoint should then:
- send an email containing contents (email content to be determined, cc @Madalina to create a separate task to document what the email subject line and contents should look like) to a list of email addresses determined by a configuration variable in extension.json
- in the HTTP response, provide a success/failure message and code, so that the client-side app can inform the user in case of failure.
The API endpoint should have rate limits (T345813: Implement rate limits for submitting data to ReportIncident API) in place for authenticated users, as a basic precaution to limit abuse.
User story:
As a user, when I click submit I expect an email containing my report to be sent to foundation email address.
- create an API endpoint to handle sending emails
- the endpoint should be rate limited (T345813)
[not-for-this-iteration] The endpoint should not allow users to submit duplicate submissions. This depends on having a database table to track submissions, though. We could define duplicate submission as having all of the same:
- user ID of submitter
- user ID of alleged harasser
- revision ID for the page
- topic ID
- comment ID