# Staff cannot manually activate invited accounts after 48 hours has elapsed

**URL:** <https://meta.discourse.org/t/staff-cannot-manually-activate-invited-accounts-after-48-hours-has-elapsed/66292>\
**Category:** Bug\
**Created:** [2017 年7 月 16 日 18:22 UTC](https://meta.discourse.org/t/staff-cannot-manually-activate-invited-accounts-after-48-hours-has-elapsed/66292 "2017-07-16T18:22:26Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

作者： ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)\
发布日期： [2017 年7 月 19 日 18:14 UTC](https://meta.discourse.org/t/staff-cannot-manually-activate-invited-accounts-after-48-hours-has-elapsed/66292/9 "2017-07-19T18:14:31Z")

</div>

I can repro the issue described by @Steve_Pavlina and @Benjamin_Mosior .

Here are the repro steps:

- Invite a user to forum
- User accepts the invite, but does not click on reset password email or activate account email link
- User now has “active” account on forum, but the account is actually not active because [email is not confirmed](https://github.com/discourse/discourse/blob/69b2d64334de9fe1aba10d96be127fe1a39bed22/app/models/user.rb#L687-L689) yet
- When user tries to login, they get “account not activated” error

Now, there is an additional issue here which @Steve_Pavlina is facing:

> [@Steve\_Pavlina](#):
>
> If I manually deactivate and reactivate it, that doesn’t let them login either.

This is because of [this logic](https://github.com/discourse/discourse/blob/69b2d64334de9fe1aba10d96be127fe1a39bed22/app/models/user.rb#L691-L698), specifically:

```plaintext
 if email_token = self.email_tokens.active.first

```

We are only confirming _active_ email tokens (by default: created in last 48 hours), so if the Admin tries to manually deactivate/activate the account after 48 hours the older email tokens are not getting confirmed, only the `active` field in user account is set to `true`.

But when user is trying to login, [we are checking](https://github.com/discourse/discourse/blob/69b2d64334de9fe1aba10d96be127fe1a39bed22/app/models/user.rb#L687-L689) if user has _any_ email token present, and if present, one of them _must be confirmed_. So there is a divergence here.

Since this fix involves changes in login related code path, I need to look more into it (and confirm) before suggesting a fix.

* * *

Kudos to @Steve_Pavlina for his indispensable support to help me repro this issue. 👍

---

_[View the full topic](https://meta.discourse.org/t/staff-cannot-manually-activate-invited-accounts-after-48-hours-has-elapsed/66292)._