Guest Notifications - open discussion - I need your feedback, advice, critics, anything

[burt]

I've been asked to have a think about some type of Guest Notification system - in simple terms allow Guests (that's non customers) to sign up for Product Notifications.

Apparently I have already done this, but it's so long ago that I had no clear memory of it. One of the old "28 days of code" things from 2016 or so! So, let's modernise. Here is my thinking, and I am open to any and all ideas. feedback etc

Assumption, new DB table "guest_notifications" => product_id | email_address | date_added

To start with, to get the system up and running, for testing purposes;

1. A Box Module on the product_info page.
- this box has an email input box, linked to AJAXish insertion into that Table.
2. A mechanism (likely a hook)
- when a new customer signs up ... logic looks at his email_address ... and transfers any guest notifications (of this email) to the Core products_notifications table.
3. A report in the Admin side
- showing all the guest_notifications
- filter by product_id and/or email_address
- download to CSV

That's enough to get the system into a place where we can all see it working. After this, some other mechanism to actually send Product Notifications to guests - I am thinking "Queued Email" system.

[burt]

The Core Product Notifications in Admin works (I think, I have not ever really looked at it) but I know it's extremely clunky. Maybe as a side project look at removing it ? Replace it with Queued E-mail integration ? Don't know.

[burt]

Progress

1. Side Box module
- to accept a users email address
- this side box only shows to guests (not logged in customers)
- the box uses AJAX so no page reload
- it deals with subscribes only and has error messages "you are already subscribed" etc

2. Hook on create_account_success
- to transfer `guest` notifications to customer notifications
- assuming the new customer uses whatever email address he used as a guest!

--

TO DO

We need some sort of Reporting Page in Admin.
We need to allow a guest to unsubscribe per product.

What else have I not thought about ?

Bear in mind that I am making this as a Box only to show proof of concept, it could as easily be a PI module for product info or a content module for product info - not too interested in coding those until we can see the system working.

[ecartz]

What else have I not thought about ?

In the email, there should be an unsubscribe link. So if a malicious bot adds your email, you can unsubscribe. There may be formatting stuff with this as some email clients provide an unsubscribe button that hooks in. Apparently that involves a List-Unsubscribe header.

[azpro]

What else have I not thought about ?

Different scenario's I can imagine for guest notifications:

- Subscriber is customer - but not logged-in
- Product is not in Stock - Notify when product is available
- Notify when product goes in Sale / Special - this has Huge potential because guest is apperently interested but wants better price

In admin you need different mails for above scenario's. Ana a grid (eg DataTables) with a lot of filtering / searching (Ajax) because this will have potentially a lot of entries.

A

[burt]

What else have I not thought about ?

In the email, there should be an unsubscribe link. So if a malicious bot adds your email, you can unsubscribe. There may be formatting stuff with this as some email clients provide an unsubscribe button that hooks in. Apparently that involves a List-Unsubscribe header.

This would be the [sent from shop] "we updated Oranges" email - have a unsub link in there so `guest` can unsub if he wants to ?

[burt]

- Subscriber is customer - but not logged-in

Good thinking. Logic

Search inserted email address to see if it exists in customer table THEN
if yes & if customer is not already signed up to notes about this product => write to products_notifications table
if no =>write to guest_notifications table

That's fairly straightforward. I think it would work like that ?

- Product is not in Stock - Notify when product is available
- Notify when product goes in Sale / Special - this has Huge potential because guest is apperently interested but wants better price

A while back I plugged in the Queued Emails to handle both of these.
But for those `customers` with relevant notifications set.

I'm thinking the same sort of process but for `guests` => Queued Email (with unsub link per Matts advice above).

[burt]

A little bit more done on this;

1. CSRF protection on the Form so that a `bad actor` cannot directly invoke the script that adds guest notifications.
2. Solved the edge case where a guest actually has an account (ie they are a `not logged in customer`)

Anyone have any other ideas, feedback, etc

[ecartz]

Search inserted email address to see if it exists in customer table THEN
if yes & if customer is not already signed up to notes about this product => write to products_notifications table
if no =>write to guest_notifications table

This workflow would allow people who are not customers to register customers for notifications, which could be considered a kind of DOS attack. A more robust workflow in regards to that would be to do a select to see if they're a customer and then ask them to log in if yes. The "if no" case stays the same.