System responds with ambiguous messages with unconfirmed accounts

[PropGit]

[Edited to bring it up to date]

We need to escalate the resolution of related issue(s) (parallaxinc/Cloud-Session#50 and parallaxinc/Cloud-Session#51) as well as this issue because occurrences are increasing in frequency, consuming more of our time.

Problem:
Multiple new users report problems logging in after creating an account. We've discovered that they either never received and/or clicked the confirmation email link and are later confused/misled by ambiguous responses in our system.

When an account is unconfirmed:

• Attempting to log in responds with the same message as when they've entered an invalid password; however, the truth is they can't log in because they're using an unconfirmed account.
• Choosing the password reset option allows them to successfully change their password; however, it doesn't matter because it's an unconfirmed account and no login attempts will succeed.

Without any message indicating that the account is unconfirmed, the user continues the circular path of resetting password + attempting log in + failure.

Solution:

• Make login attempts on an unconfirmed account 1) indicate that "This account can not be logged into because it's unconfirmed. We've just resent a confirmation email to email_address. Please find that email and click its confirmation link." and 2) automatically resend a confirmation email to the account's email address (or alternate address).
• Make password reset attempts halt before actually resetting the password, and instead 1) clearly indicate that the account can not have its password reset because it's unconfirmed (similar message to the above), and 2) automatically resend a confirmation email to the account's email address (or alternate address).

The email_address is the one that emails will actually be sent to- either the account email address (if no alternate address provided) or the alternate email address.

[zfi]

The first step in this process is to update the Cloud Session server code to return additional information when a login failure occurs to indicate more specifically what went wrong. The BlocklyProp server can then act on the additional data and render better information to the user.

parallaxinc/Cloud-Session#50

[PropGit]

Another issue is related: parallaxinc/Cloud-Session#51

[zfi]

Verified that the Cloud Session server is returning the correct error when a user attempts to login or change an account password using an unconfirmed email address. Also verified that the cloud-session-java-client is properly converting the error into an EmailNotConfirmedException.

[zfi]

We still need to update the UI code to present a more informative message to indicate that the account is not yet active; unconfirmed.