Separate account registration and institution joining requests

[Kristina Hoeppner]

When you allow registration in an institution, two actions are allowed:

1. New users can register on the site for that institution.
2. Existing users can request membership in the institution.

These two actions should be separated as they are two very different actions. While an institution may allow the registration of new accounts, they may not allow the switching of institutions by simply contacting another institution.

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/8478

[Robert Lyon (robertl-9)]

What I think we need for this patch is for it to be able to do the following:

* Add a new switch to the Institution configure page called "Change institution allowed"

So that when "Registration allowed" is set to 'No' users can still change institution if the "Change institution allowed" is set to 'Yes'

And conversely when "Registration allowed" is set to 'Yes' and "Change institution allowed" is set to 'No' they can register for an Institution but cannot then try and join another institution.

The "Confirm registration" switch would be for both the other switches, ie whether you are registering for the site or joining from another institution you will need to confirm if "Confirm registration" is set to 'Yes'

The current patch (8478) only removes selecting the Institution from register form - which does not seem like what we want.

[Kristina Hoeppner (kris-hoeppner)]

Actually, we don't have to change anything for the "Confirm registration" switch. That governs the "Pending registration" page under "Institutions".

When you allow registrations, the admin of the institution already gets a notification and can decide whether to allow a person into their institution or not. "Confirm registration" ensures that if a user registers for a new account in an institution but is denied registration that no account is set up. Without "Confirm registration", the user would not be able to be a member of an institution but still have an account under "No institution".

So:

1. Change "Registration allowed" to "Account registration allowed".
2. Change "Confirm registration" to "Confirm account registration", and keep it below "Account registration allowed".
3. New switch "Institution change allowed" that governs whether a member of the current institution is allowed to request membership in another institution. This switch is only clickable if the site allows multiple institutions in "Config site" -> "Site options" -> "Institution settings". If that is not allowed, the switch is greyed out.

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/8834

[Robert Lyon (robertl-9)]

I've added patch 8834 to deal with what is mentioned in #3 from Kristina

And I've adjusted patch 8478 to be this:

Have a flag to hide institutions from logged out users on register.php page

So if 'Registration to site only' is set to true a user can only register to the site even if institutions can be registered to.

[Steven (stevens-q)]

Environment tested: Master
Browser tested: Chrome

PRECONDITIONS:
------------------------
1) Site allows multiple institutions

TEST STEPS:
------------------------
1) Log in as Site admin
2) Browse to Administration menu > Institutions > Settings > edit institution
3) Confirm "Registration allowed" text is changed to "Account registration allowed". ✔
4) Confirm the "Confirm registration" text is changed to "Confirm account registration", and is below "Account registration allowed" ✔
5) Browse to Administration menu > Site options > Institution settings
6) Confirm that there is a Toggle switch labeled "Registration to site only" ✘

      * Actual result - toggle field label is a broken string as follows [[registrationsiteonly/admin]]

Catalyst QA Failed Testing ✘

[Steven (stevens-q)]

Bug Fixed Label is now displaying correctly

Catalyst QA Approved ✔

[Kristina Hoeppner (kris-hoeppner)]

Steven, please also write test cases for going through the individual settings checking that the functionality does what it promises.

[Kristina Hoeppner (kris-hoeppner)]

Comments from testing patch set 8 of https://reviews.mahara.org/#/c/8478/ and patch set 10 of https://reviews.mahara.org/#/c/8834 together as the latter one builds on top of the former one:

1.
We should not keep the setting "Registration to site only" in the site configuration. This is going to be a high work load for site administrators and put too much burden on them.

The usual scenarios for self-registration are on SaaS sites. There the institutions should be shown so that people know which institutions are available. Typically also in that case the site administrator should force "Confirm registration" so that institution admins can decide whether to let people into their institution or deny their request.

A site administrator may not know in most cases if a person registering is actually allowed to be added to an institution and thus shouldn't do that without consulting an institution admin.

If institutions are set up with external auth methods, they don't need the account self-registration setting as everything will be done internally and thus institution information is not displayed publicly.

This setting should be a custom one on the client site that requested it but not be pushed into Mahara core.

2.
"Allow account registration":
- Help file has wrong heading and will need an update once the functionality has been fixed.
- "People can register for this institution using the registration form. If registration is off, non-members cannot request membership of the institution and members cannot leave the institution or delete their user accounts themselves." needs changing as it doesn't quite capture what is needed.
- This setting cannot be tied to people wanting to leave an institution or delete accounts. Account deletion is already handled by the setting "Review accounts before self-deletion". We should not tie it to an account registration setting. This setting is required for GDPR as people need to be able to remove their content from a site. By having a review, we give institution admins the possibility to review the deletion before it happens in case certain data will need to be kept before the account is removed.

3.
"Allow institution request" doesn't work. Test scenario:
1. I have 2 institutions that both allow institution requests and site setting is to allow multiple institutions. "Allow account registration" is set to "No".
2. Student A is in Institution 1 and goes to /account/institutions.php
3. Student A does not see that he could join Institution B.

The institution request does work when "Allow account registration" is set to "Yes", which doesn't resolve the initial request of separating the self-registration from the institution request when an account is already available on the site.

[Mahara Bot (dev-mahara)]

Patch for "main" branch: https://reviews.mahara.org/12099