User subsystems: update identity

[fisx]

WPB-8881

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[fisx]

a610321 is interesting:

validateTokens ::
  (ZAuth.TokenPair u a) =>
  List1 (ZAuth.Token u) ->
  Maybe (ZAuth.Token a) ->
  ExceptT ZAuth.Failure (AppT r) (UserId, Cookie (ZAuth.Token u))
validateTokens uts at = do
  tokens <- forM uts $ \ut -> lift $ runExceptT (validateToken ut at)
  getFirstSuccessOrFirstFail tokens
  where
    -- FUTUREWORK: There is surely a better way to do this
    getFirstSuccessOrFirstFail ::
      (Monad m) =>
      List1 (Either ZAuth.Failure (UserId, Cookie (ZAuth.Token u))) ->
      ExceptT ZAuth.Failure m (UserId, Cookie (ZAuth.Token u))
    getFirstSuccessOrFirstFail tks = case (lefts $ NE.toList $ List1.toNonEmpty tks, rights $ NE.toList $ List1.toNonEmpty tks) of
      (_, suc : _) -> pure suc
      (e : _, _) -> throwE e
      _ -> throwE ZAuth.Invalid -- Impossible

turned into this:

validateTokens ::
  forall u a v.
  (v ~ (UserId, Cookie (ZAuth.Token u))) =>
  (ZAuthWrapper.TokenPair u a) =>
  List1 (ZAuth.Token u) ->
  Maybe (ZAuth.Token a) ->
  Either ZAuthWrapper.Failure v
validateTokens uts at = ((`validateToken` at) `mapM` uts) & second List1.head

but

[fisx]

also i'm a little proud of my commit discipline today! :)

[fisx]

should this be called AuthorizedFor?

[fisx]

seems like all the extra authorization logic in changing email addresses is redunandant. we could just check for the z-user header, no? (thanks @akshaymankar)

[fisx]

Suggested change

	-- | Outcome of an email address the procedure.
	-- | Outcome of an email address activation.