Email verification/confirmation bugs

[mdmADA]

Dataverse 5.6 (dataverse.harvard.edu)
Tested on harvard's dataverse to see if I could replicate issues on ADA test dataverse.

What steps does it take to reproduce the issue?

1. Create new user account with a valid email address
2. Upon clicking 'Create', user receives email that user account has been created
   • the verify email link with token is in that email
   • do not click on it
3. In Dataverse, once the account is created, you are automatically logged in
4. Go to 'Account Information'
   • email is showing as 'Not Verified'
   • click the 'Verify email' button
   • popup saying 'A verification email has been sent to . Please check your inbox.'
   • no email is received

I assume because there is already a token in the confirmemaildata table that that is the reason why a new email is not sent to the user. However it is confusing to users as the popup is telling them something should happen and it doesn't. The user may not read the initial email sent to them on account creation (if the email goes to junk or since the user is automatically logged in upon account creation, the user just starts navigating through the UI) so having popups with messages that reflect the true situation (email already sent, email is sent) is beneficial.

• When does this issue occur?
  On email-based account signup

• Which page(s) does it occurs on?
  Account creation/Account information

• What happens?
  See description above ^^^

• To whom does it occur (all users, curators, superusers)?
  Users who have created an account with email

• What did you expect to happen?
  If I click 'Verify Email', if the popup says I will get an email, then I expect to get an email.
  If the initial token in the confirmemaildata table is causing the new email not to be sent, I would expect the popup to say 'An email with validation instructions has already been sent to you. Please check your inbox and junk folders.' (or something similar).

Which version of Dataverse are you using?
This was on dataverse.harvard.edu (5.6)

Any related open or closed issues to this bug report?
There are several issues for shibboleth and other authentication-related services. Not sure if there are any for this particular issue.

---

This is @pdurbin adding some screenshots and other notes as I work on this.

Here's the popup described above (I repositioned it a bit for clarity). This message is somewhat misleading. It makes it sound like and email was JUST sent by you clicking the button. What really happened is that the database was checked and an existing token was found. That existing token/link should have already been emailed to the user when they signed up:

When you click a link to verify your email, you get a success message like this:

If you then navigate to your account page, here's how a verified email looks (that is, you got the email and clicked the link):

If the user doesn't have a token yet (because it expired, for example), they get a different message when they click "Verify Email":

[sbarbosadataverse]

@scolapasta this is similar. Can I amend this issue to include this verify fail issue?

[sbarbosadataverse]

To update this issue with more improvements:
verify email link received by account creators does not always work, and when account creators receive a "failed to verify" message, they reach out to HDV support which created unnecessary support inquiries, especially since we can't resolve the failed verification.

[TaniaSchlatter]

It sounds like resolving this issue may involve editing user messaging, per the description @mdmADA added. We should sort out the current functionality, and evaluate messaging.

[TaniaSchlatter]

Discussed with @pdurbin. Desired functionality is to always send a new email when the "Verify" button is clicked.

1. The most recently sent token replaces all previous tokens.
2. Change the button text to "Send Verification Email"
3. Eliminate the popup. The confirmation message on the page serves as feedback.