Provide Resend verification email only for DB connections

[nicosabena]

AD/LDAP connections (and maybe others) can have unverified email addresses, but the verify email action only works for DB connections. So the link to Resend verification email should only be shown to users coming from a DB connection.

API v1's send_verification_email does not check that, but the link sent by email will cause an error when the user tries to use it.

[joshcanhelp]

@nicosabena - I'll suppress that link on our end. It sounds like that should be added to the job API request, if possible, like "email verification not possible" ... which it actually looks like it does already:

https://auth0.com/docs/api/management/v2#!/Jobs/post_verification_email

I'll get this into the next release.

[joshcanhelp]

@nicosabena - I've got this working now and ready for review but want to get your input on what happens if someone is not verified and also not a DB connection. We discussed have a way to skip email verification for certain connections, something I can look at for a future release. But, in the meantime, here's what they would see:

Not too terribly helpful.

So, in the case we're trying to catch here, what's a good next action or helpful text we could provide?

[nicosabena]

The thing is, some identity providers (especially enterprise ones, like SAML) don't provide an email_verified claim/attribute at all. And, in an enterprise environment, the concept of verifying an email doesn't even make sense (the account is created for an employee working at a company, so they are all assumed to be verified), so the above text might not be really meaningful for users.

And when an Auth0 admin creates a connection to an enterprise IdP that doesn't provide the email_verified claim, there's no good way of saying "Hey, we can assume that all users coming from this connection have their email verified".

I know we are approaching the problem from the wrong side (this should probably be fixed both in the core server and in API v2 to support verifying users coming from upstream identity providers), but telling users to "Please verify your email and log in again" won't help much.

Maybe only leave "The site requires a verified email to log in", and have the administrator decide if they want to remove that restriction if they use anything other than database connections.

[joshcanhelp]

Fixed in #447 and merged into dev