Prevent login until email is confirmed

app/controllers/session_controller.rb

@@ -22,9 +22,14 @@ class SessionController < ApplicationController
 
       # If their password is correct
       if @user.confirm_password?(params[:password])
-        log_on_user(@user)
+        if @user.email_confirmed?
-        render_serialized(@user, UserSerializer)
+          log_on_user(@user)
-        return
+          render_serialized(@user, UserSerializer)
+          return
+        else
+          render :json => {error: I18n.t("login.not_activated")}
+          return
+        end
       end
     end
 

app/models/user.rb

@@ -380,6 +380,10 @@ class User < ActiveRecord::Base
     end
   end
 
+  def email_confirmed?
+    email_tokens.where(email: self.email, confirmed: true).present?
+  end
+
 
   protected
 

config/locales/en.yml

@@ -1039,6 +1039,7 @@ en:
     wait_approval: "Thanks for signing up. We will notify you when your account has been approved."
     active: "Your account is active and ready."
     activate_email: "You're almost done! We sent an activation email to <b>%{email}</b>. Please follow the instructions in the email to activate your account."
+    not_activated: "You can't log in yet. We sent an activation email to you. Please follow the instructions in the email to activate your account."
     errors: "Failed to create account: %{errors}"
     not_available: "Not available. Try %{suggestion}?"
 

spec/controllers/session_controller_spec.rb

@@ -6,77 +6,93 @@ describe SessionController do
 
     let(:user) { Fabricate(:user) }
 
-    it "raises an error when the login isn't present" do
+    context 'when email is confirmed' do
-      lambda { xhr :post, :create }.should raise_error(Discourse::InvalidParameters)
-    end
-
-    describe 'invalid password' do
-
-      it "should return an error with an invalid password" do
-        xhr :post, :create, login: user.username, password: 'sssss'
-        ::JSON.parse(response.body)['error'].should be_present
-      end
-
-    end
-
-    describe 'success by username' do 
       before do
-        xhr :post, :create, login: user.username, password: 'myawesomepassword'
+        token = user.email_tokens.where(email: user.email).first
-        user.reload
+        EmailToken.confirm(token.token)
       end
 
-      it 'sets a session id' do
+      it "raises an error when the login isn't present" do
-        session[:current_user_id].should == user.id
+        lambda { xhr :post, :create }.should raise_error(Discourse::InvalidParameters)
       end
 
-      it 'gives the user an auth token' do
+      describe 'invalid password' do
-        user.auth_token.should be_present
+        it "should return an error with an invalid password" do
+          xhr :post, :create, login: user.username, password: 'sssss'
+          ::JSON.parse(response.body)['error'].should be_present
+        end
       end
 
-      it 'sets a cookie with the auth token' do
+      describe 'success by username' do
-        cookies[:_t].should == user.auth_token
+        before do
-      end
+          xhr :post, :create, login: user.username, password: 'myawesomepassword'
-    end
+          user.reload
+        end
 
-    describe 'strips leading @ symbol' do 
+        it 'sets a session id' do
-      before do
+          session[:current_user_id].should == user.id
-        xhr :post, :create, login: "@" + user.username, password: 'myawesomepassword'
+        end
-        user.reload
+
+        it 'gives the user an auth token' do
+          user.auth_token.should be_present
+        end
+
+        it 'sets a cookie with the auth token' do
+          cookies[:_t].should == user.auth_token
+        end
       end
 
-      it 'sets a session id' do
+      describe 'strips leading @ symbol' do
-        session[:current_user_id].should == user.id
+        before do
-      end
+          xhr :post, :create, login: "@" + user.username, password: 'myawesomepassword'
-    end
+          user.reload
+        end
 
-    describe 'also allow login by email' do 
+        it 'sets a session id' do
-      before do
+          session[:current_user_id].should == user.id
-        xhr :post, :create, login: user.email, password: 'myawesomepassword'
+        end
       end
 
-      it 'sets a session id' do
+      describe 'also allow login by email' do
-        session[:current_user_id].should == user.id
-      end
-    end
-
-    describe "when the site requires approval of users" do
-      before do
-        SiteSetting.expects(:must_approve_users?).returns(true)      
-      end
-
-      context 'with an unapproved user' do
         before do
           xhr :post, :create, login: user.email, password: 'myawesomepassword'
         end
 
-        it "doesn't log in the user" do
+        it 'sets a session id' do
-          session[:current_user_id].should be_blank
+          session[:current_user_id].should == user.id
         end
-
       end
 
+      describe "when the site requires approval of users" do
+        before do
+          SiteSetting.expects(:must_approve_users?).returns(true)
+        end
+
+        context 'with an unapproved user' do
+          before do
+            xhr :post, :create, login: user.email, password: 'myawesomepassword'
+          end
+
+          it "doesn't log in the user" do
+            session[:current_user_id].should be_blank
+          end
+        end
+      end
     end
 
+    context 'when email has not been confirmed' do
+      before do
+        xhr :post, :create, login: user.email, password: 'myawesomepassword'
+      end
+
+      it "doesn't log in the user" do
+        session[:current_user_id].should be_blank
+      end
+
+      it 'returns an error message' do
+        ::JSON.parse(response.body)['error'].should be_present
+      end
+    end
   end
 
   describe '.destroy' do

spec/models/user_spec.rb

@@ -617,4 +617,30 @@ describe User do
     it { should_not be_active }
   end
 
+  describe 'email_confirmed?' do
+    let(:user) { Fabricate(:user) }
+
+    context 'when email has not been confirmed yet' do
+      it 'should return false' do
+        user.email_confirmed?.should be_false
+      end
+    end
+
+    context 'when email has been confirmed' do
+      it 'should return true' do
+        token = user.email_tokens.where(email: user.email).first
+        EmailToken.confirm(token.token)
+        user.email_confirmed?.should be_true
+      end
+    end
+
+    context 'when user has no email tokens for some reason' do
+      it 'should return false' do
+        user.email_tokens.each {|t| t.destroy}
+        user.reload
+        user.email_confirmed?.should be_false
+      end
+    end
+  end
+
 end