Verify new users by email

[rossjones]

Support for email verification of new user accounts would be very useful for systems that want to ensure the email account provided actually exists/is-valid.

[davidread]

Aside from the anti-spam element, it's also pretty necessary to allow people to recover their passwords.

[adamamyl]

+1, although (from my perspective) it would be useful for an admin to be able to disable the feature.

[davidread]

sean: this is a persona ckan extensino which already does this. nigel/adria: keen to have this in core. user would need a new column for the key.

[rufuspollock]

@rossjones @davidread might be worth detailing the implementation and UX steps here. I imagine something like:

DB

• Add field confirmation_token to user table.
  • confirmation_token just a uuid
  • If confirmation_token is not null then account is not usable [alternative: have a separate status field which is set to "awaiting confirmation" or similar]

Logic / User Flow

• Upon sign-up user has confirmation_token set. They are sent email with confirmation token link /user/confirm?token=....
  • confirmation_token also set on password sign-up (??) - not sure this is necessary (could just send that an email saying their password was reset)
• New controller action /user/confirm
  • If correct, set confirmation_token to null and redirect user to their dashboard
  • If failure notify and leave token as is

[rossjones]

There's a new issue for this ( #2838 ) where a PR will be incoming. Closing this in favour of that one.