What happens#

When logging in, your account needs to be verified. If you're not verified, you must respond to the original verification email - there is no clear way to resend it.

Why should you care?#

This is probably normally fine, but if the email doesn't get through -e.g. if standing up a new server and testing SMTP config, if the user's mailserver rejects the email, etc.- there's no way I can see to resend the verification email.

It's also not enough to reset your password or security token via email, this doesn't count as making your account "verified".

This effectively locks up the account

Mitigation#

I manually went into postgres and verified the account.

It would be nice if:#

• Logging in when unverified resent the verification email
• Interacting with some other email than a "verification" email still verified your account