User needs to login again in the in-app webview when creating their first site

[crazytonyli]

This issue appears to only happen to newly signed-up users.

Prerequisite

From my testing, this issue only happens to new accounts created via the app's web login.

Steps to reproduce

1. Open the app and create a new account via the web login.
2. After login completes, tap "Create WordPress.com site".
3. Go through the process to the step of choosing a domain.
4. Choose a domain and go to the next step, which is in a web view.

Expected result

The app shows a "Choose a plan" screen in a web view, which is automatically authenticated with the current user.

Actual result

The web view shows a login page.

[dangermattic]

Thanks for reporting! 👍

[crazytonyli]

The root cause is new accounts created via web login are not activated (they need to click a link in their email to activate the account). The endpoint to authenticate web view does not respond with auth cookies for unactivated accounts.

[crazytonyli]

I believe the only scenario that would lead to this issue at the moment is straight after the user creates a new account within the iOS app. After creating an account from the web login, they'll sign into the app. They would see the "no sites view", with option to "Create WordPress.com site", which leads to this issue.

At the moment, the "Create WordPress.com site" flow is also broken because users won't be able to sign in to the in-app web view. The login page web view use an email verification link to sign in by default. There is an option to "User username and password instead". However, that option does not show the username & password form, which could be a bug in Calypso. The user would stuck using the email verification link to log in. Since email link can't authenticate the in-app web view (there is a related issue #24171), user won't be able to sign in at all.

We could fix the endpoint by ignoring the fact that the account is not activated and returning auth cookies. But that is probably against the general policy of trying to get new accounts' email verified as soon as possible. I tried to look through the backend codebase but couldn't find the place for this kind of change.

In the spirit of nudging customers to verify their email, we can show the "Verify Your Email" view on the newly created account. Since the "Create WordPress.com site" flow is broken, we can disable the button, which echos the description in "Verify Your Email": "Verify your email to [...] access more features".