Allow users to send verification code to verified secondary email
What does this MR do and why?
Implements #416451 (closed).
Allow a user to receive a new email verification code on one of their verified secondary email when their account is locked (see doc).
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Screen_Recording_2024-09-11_at_4.03.22_PM
How to set up and validate locally
- Enable
require_email_verification
andsend_verification_code_to_secondary_email
features$ rails console > Feature.enable(:require_email_verification) => true > Feature.enable(:send_verification_code_to_secondary_email) => true
- Still on the Rails console, create a verified secondary email for the
root
user> FactoryBot.create(:email, email: 'root_secondary@ex.com', user: User.first, confirmed_at: Time.zone.now)
- Update
app/controllers/concerns/verifies_with_email.rb
so that a successful sign-in results to a locked account. This will display the email verification page after a successful sign-in.diff --git a/app/controllers/concerns/verifies_with_email.rb b/app/controllers/concerns/verifies_with_email.rb index c68fc28cae5a8..4e3450d04c2db 100644 --- a/app/controllers/concerns/verifies_with_email.rb +++ b/app/controllers/concerns/verifies_with_email.rb @@ -167,9 +167,10 @@ def handle_verification_success(user) end def trusted_ip_address?(user) - return true if Feature.disabled?(:check_ip_address_for_email_verification) + false + # return true if Feature.disabled?(:check_ip_address_for_email_verification) - AuthenticationEvent.initial_login_or_known_ip_address?(user, request.ip) + # AuthenticationEvent.initial_login_or_known_ip_address?(user, request.ip) end def prompt_for_email_verification(user)
- Sign-in with
root
user - Verify that you are redirected to the email verification page with the option to resend a new code to a verified secondary email
- Click the
send the code to a verified secondary email instead
link - Enter the secondary email you created in step 2
- Go to http://localhost:3000/rails/letter_opener and verify that a new code has been sent
Edited by Eugie Limpin