guardian/frontend — pull request #3086 by chrisfinch (2014-02-11 15:02:06+00:00)
Title: Discussion Email Verification

Discussion Email Verification
===

This pull request adds javascript functionality to the discussion code for ***checking, on post, if a users email is verified and initiating a verification flow if it is not***.

### How it looks

A user is not verified and must complete the verification flow:
![verify 1](https://f.cloud.github.com/assets/1170410/2137841/7e346a34-932c-11e3-90c6-d216858f9385.jpg)

A user is not verified and has been resent the verification email as part of the verification flow:
![verify2](https://f.cloud.github.com/assets/1170410/2137840/7e143b10-932c-11e3-9174-9712237401dc.jpg)

### /user/me endpoint

The `/user/me` endpoint now accepts a new parameter in conjunction with the recent identity api release;

```
data: {
refreshCookie:true
}
```

This parameter will cause the standard `/user/me` endpoint to drop a refreshed cookie as well as returning the user object.

### Additions to GU_U user cookie

The `GU_U` cookie now contains two new data fields; `accountCreatedDate` and `emailVerified`.

These fields are now used in the discussion comment submission process to check the user.

### New checks in discussion

The discussion code in `comment-box.js` will now check the following in order:

- That the new `discussionVerifiedEmailPosting` switch from `switches.scala` is `true`.
- That the users `emailVerified` cookie field is `true`.
- If either of the above are false;
- That the users `accountCreatedDate` is before Sun Feb 09 2014 00:00:01 GMT+0000 (GMT) (***SUBJECT TO CHANGE***)

If the above checks fail then there is a possibility that the users cookie is stale. This can happen if the user followed the verification email link on another browser or device. In this case the new `/user/me` endpoint is hit and the returned `response.user` object is checked for `statusFields.userEmailValidated === true`.

When the above checks see that the users email is validated then the original comment posting flow is followed in `validEmailCommentSubmission()` where the comment length and other validation takes place. The ordering of email verification > rest of validation is a UX directive.

### Date exemption

Users registered before the date in `priorToVerificationDate`, which is subject to change, are exempt from the requirement to have a verified email address. This is a business decision.

### Discussion API changes

After the release of this work the discussion api will also be updated to run server side checks for email verified status along with possible exemption on date basis. This will impact the mobile apps team and identity will liaise with them during the course of the rollout of these changes.

![xh94o](https://f.cloud.github.com/assets/1170410/2137823/39d0f95c-932c-11e3-9a7b-c59f792ee0fd.gif)