Should a deactivated user recieve an email?

[benjamincfarmer (Ben Farmer)]

I am searching for a way to force an email revalidation of users. I saw
, in the user page and did a test. When attempting to log in the test gave me a response of

but no email to that address to re-validate, only change.

Should the Deactivated user have received an email alerting them that they need to revalidate?

[JammyDodger]

When you manually deactivate a user it doesn’t automatically send an email asking them to revalidate, though you can press the button that appears in their user/admin page to resend one.

When an inactive account attempts to login they should be prompted with a screen like this where they can choose to have a fresh one sent:

I’m not sure why your screenshot seems to be missing that option? Could it be some custom code you’ve added to hide a particular button that has also accidentally hidden this one? Does it show up in safe mode?

Edit: After a little bit of digging, I think it’s the must approve users setting that makes the box disappear. When I enable that I no longer get the option showing up:

I’m not 100% sure that’s intentional.

[JammyDodger]

@JammyDodger

I’m not 100% sure that’s intentional.

It does seem intentional:

FIX: Don't show "resend email" option when user approval is on

Though it does also break the revalidation flow for manually deactivating users so it still feels like a bug.

I’ll slide it over to Bug and see if someone more knowledgable can adjudicate.

[sam (Sam Saffron)]

To recap:

• The community is invite only and every new member must be approved by staff
• You want to force email re-validation on some users.
• Given must_approve_users is invite_only and login_required the option for re-sending activation email is missing.

Some observations:

• the interplay of the 3 settings is a bit confusing. Why would you want must_approve_users if you are already an invite_only community?

• must_approve_users blocking email approval is somewhat confusing, we should revisit.

Leaving this with the staff-experience team to triage. Expect a response this week.

@benjamincfarmer does it make sense to try must_approve_users off on your community given it is already invite only?

[Moin]

How is invite only connected to this?

When I disable a user, the resend activation email button is missing because must approve users is enabled. Invite only isn’t enabled on my forum.

app/assets/javascripts/discourse/app/components/activation-controls.gjs

[sam (Sam Saffron)]

Yeah I agree it is unrelated, but the particular forum in question does not appear to need must approve users cause it is invite only anyway.

[Moin]

I can understand that you use both, so users with a certain trust level can invite others, but staff can still control who joins the community. I would expect fewer sign-ups by spammers, so less work for staff.

[sam (Sam Saffron)]

The context for the change appears to be:

Account activation / email verification email not sent on sign up, when "must approve users" option is turned on

I’ve turned on the “must approve users” options in my login options. When this is turned on, the email verification emails don’t get sent, so user accounts sit as inactive. The message to the user after signing up is: Thanks for signing up. We will notify you when your account has been approved. In order to allow the newly created account, I need to activate it, then also approve it. This seems… a bit much, especially since activating an account is sat inside the admin page for the individu…

So “must approve users” relies on “admins” to actually do the email validation.

My gut here is that the change to fix is rather complex.

• Must approve users - should only get users that have validated emails
• Hence even if this setting is enabled we should validate emails first prior to passing on users to admins

Which would be a major rework of this feature. Not against this by any means but it feels somewhat complex.

[Moin]

@sam

The context for the change appears to be:

That topic was created in September 2017.

@JammyDodger

It does seem intentional:
FIX: Don't show "resend email" option when user approval is on · discourse/discourse@b584264 · GitHub

This was committed in May, so before the topic was created.

@sam

• Must approve users - should only get users that have validated emails
• Hence even if this setting is enabled we should validate emails first prior to passing on users to admins

Isn’t that the case?
When I sign up a new user:

1. I fill in the registration form
   
   
2. Then I am asked to validate the email address
   
   
3. When I open the link sent by email, I click to activate the account
   
   
4. I am told that I need to wait for staff to review my registration.
   
   
   
   At this point, the sign-up appears in the review queue, and staff can approve the user, who then receives the email that they can log in.
   
   

[benjamincfarmer (Ben Farmer)]

The root desire of account deactivation was to prune accounts of individuals who no longer have access to their original sign-up email address. After observing that you can move the account to a new address when the account is deactivated I’ve realized that this wouldn’t provide the effect we were looking for anyways.

Sorry for kicking the beehive @sam

Our forum is being used to provide support to our sales agencies. If one of these employees leaves, and goes to a competitor, we want to remove them from the system. Feedback from the agency would be the best way to do this, if I had faith they would tell me.