2066984 - Allow Bugzilla user accounts to have more than one email address

Status: NEW

(Bugzilla :: User Accounts, enhancement)

Description

[Dave Miller [:justdave]]

This is a spin-off of bug 1963773, which splits apart usernames from email addresses, and migrates user login_names into email addresses, and allows users to change their username to something that isn't an email address. The schema that's going to land for that bug will allow the database to store multiple email addresses per user profile, however in order to save time and land it quicker, the front end and object code to actually manage them is not going to land with it (it's still going to assume everyone has one email address, even though the DB can technically store more now).

Here's the line item from the specification that got dropped on the other bug and is being spun off here for completion:

• User profiles should have one or more email addresses, with the capability to have multiple.
  • Users should be able to add and remove email addresses from their account.
  • Each email address should have an option whether to send notifications to it or not (to allow the user to have multiple they can log in with, but only get notifications in one place, for example).
  • At least one email address is required. The user should not be allowed to remove the last-remaining address without adding a new one to replace it.
  • The existing feature to change your email address should be removed, in favor of adding a new address, then removing the old one.
  • Adding a new address should require verification via a token emailed to the address (the same mechanism currently used for creating an account or changing your email). The new address will not be usable until it is verified.
  • The email address should track its verification state, and the date it was last verified. (potentially we can require them to be reverified periodically, but that’s out of scope for the moment). Email addresses migrated from older versions should assume the addresses are already verified, and use an obviously fake verification date like January 1, 1950 or something along those lines. The UI can choose to interpret that specific date as a legacy verification in the way it gets displayed.
  • Removing an email address should also require verification via a token emailed to the address. This should provide both an accept and cancel mechanism. Rationale: Bugzilla is often used to store critical data. If someone does manage to gain access to the account, the original owner needs an opportunity to regain access prior to being locked out.
    • If the accept token is submitted, the address is removed immediately.
    • If the cancel token is submitted, the removal of the address is canceled.
    • If no token is submitted after 3 days, then the address is removed (this is the fallback for no longer having access to the account to approve it).
  • Requesting a password reset by email address should just send a confirmation token to that address. Requesting a password reset by username should send the confirmation token to all verified email addresses.
  • Completed password changes should send a notification that the password was changed to all verified email addresses.