Hooray – I’ve been able to reproduce exactly what was explained to me on my production instance. The steps and symptoms differ a bit.
I have email token valid hours and purge unactivated users grace period days set to their default values. Then, I did the following steps:
- Sign in with SSO to a non-existing account. Since our SSO provider does not validate E-Mails, Discourse sends out an activation mail:
- Wait between 24 hours and 7 days, so the link expires but the account survives.
- Click the link, click the button to activate the account. Unsurprisingly, this tells me the link is invalid:
- Re-try to login. Once again, Discourse tells me it sent out an activation mail. I did not get the screen telling me that I can re-send the mail – it looked just as in step 1! Discourse sends out a new activation mail:
- Try to activate the account, which once again fails.
This failure is no surprise: Discourse sent out the old, expired token again! Look at my screenshots above, which include the date and time (both were captured just now, so no date means 21.08.2015).
While I’m not entirely sure why the behavior differs, the core difference seems to be SSO (my test install did not use SSO!). Both versions seem like a bug to me, with this one being more severe.