Force new users to confirm email before allowing them to log in

[gerwinbrunner]

This PR will enable guest on the website to register for new user accounts and have them redirected to a "check your email" page (instead of directly logged in).
Only after they confirmed the email address by clicking on the link sent via email they are able to log in.

I hope this is in a condition for you to use. If you need anything else, please let me know.

Best,
Gerwin

I assume that mail sending is set up correctly.

Settings on the client:

Meteor.startup ->
  AccountsEntry.config
    verifyEmail: true
    verifyEmailRoute: '/checkemail'

Setting you need to set on the server only:

Meteor.startup ->
  console.log "Server started"

  Accounts.config
    sendVerificationEmail: true

  Accounts.urls.verifyEmail = (token) ->
    Meteor.absoluteUrl "verify-email/" + token


  # Make sure only users with validated emails can log in
  Accounts.validateLoginAttempt (attempt) ->
    if attempt.user and attempt.user.emails and not attempt.user.emails[0].verified
      console.log "email not verified"
      return false # the login is aborted
    true

Routes you may need:
(Be aware that you have to also create the templates (not shown here).

Router.map ->

  # SignUp emails
  @route "verifyEmail",
    controller: "AccountController"
    path: "/verify-email/:token"
    action: "verifyEmail"

  @route "verified",
    path: "/verified"
    template: "verified"

  @route "checkemail",
    path: "/checkemail"
    template: "checkemail"

[gerwinbrunner]

Any comments on this? What do you think about it?

[stakabo]

I like this idea.

[chirvo]

I like this one too. In fact I'm kind of need this feature for a site I'm writing. Would be nice to have this one in the next release.

[gerwinbrunner]

Are you planning to add this to the main branch?

[jacksoggetto]

this part of code:

Accounts.validateLoginAttempt (attempt) ->
if attempt.user and attempt.user.emails and not attempt.user.emails[0].verified
console.log "email not verified"
return false # the login is aborted
true

shows an error when an user tried to register, but the user get registered anyway.

this happens with accounts-entry since it tries to login straight away automatically after registration