feat(email): require verified approval email

Backfill approved legacy users with verified emails and replace the old unverified-email warning setting with a single approval email policy.

apps/backend/migration_steps/email_approval_policy.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from sqlalchemy import text
+from sqlalchemy.engine import Connection
+
+
+def _table_columns(conn: Connection, table_name: str) -> set[str]:
+    rows = conn.execute(text(f"PRAGMA table_info({table_name})")).fetchall()
+    return {str(row[1]) for row in rows}
+
+
+def apply(conn: Connection) -> None:
+    columns = _table_columns(conn, "email_notification_settings")
+    if "require_verified_email_for_approval" not in columns:
+        conn.execute(
+            text(
+                "ALTER TABLE email_notification_settings "
+                "ADD COLUMN require_verified_email_for_approval BOOLEAN NOT NULL DEFAULT 1"
+            )
+        )
+        conn.commit()
+        columns = _table_columns(conn, "email_notification_settings")
+
+    if "warn_unverified_email_before_approval" in columns:
+        conn.execute(
+            text(
+                "ALTER TABLE email_notification_settings "
+                "DROP COLUMN warn_unverified_email_before_approval"
+            )
+        )
+        conn.commit()

apps/backend/migration_steps/email_notification_settings.py

@@ -18,7 +18,7 @@ def apply(conn: Connection) -> None:
                 notify_token_expiring BOOLEAN NOT NULL DEFAULT 1,
                 notify_check_in_success BOOLEAN NOT NULL DEFAULT 1,
                 require_admin_approval_for_registration BOOLEAN NOT NULL DEFAULT 1,
-                warn_unverified_email_before_approval BOOLEAN NOT NULL DEFAULT 1,
+                require_verified_email_for_approval BOOLEAN NOT NULL DEFAULT 1,
                 created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
                 updated_at DATETIME
             )

apps/backend/migration_steps/legacy_user_email_verification.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from sqlalchemy import text
+from sqlalchemy.engine import Connection
+
+
+def apply(conn: Connection) -> None:
+    verified_at = datetime.now(timezone.utc).isoformat()
+    conn.execute(
+        text(
+            """
+            UPDATE users
+            SET email_verified_at = :verified_at
+            WHERE email_verified_at IS NULL
+              AND email IS NOT NULL
+              AND email != ''
+              AND is_approved = 1
+            """
+        ),
+        {"verified_at": verified_at},
+    )
+    conn.commit()

apps/backend/migration_steps/user_email_verification.py

@@ -19,6 +19,16 @@ def _add_column_if_missing(
     return columns
 
 
+def _drop_column_if_present(
+    conn: Connection, table_name: str, columns: set[str], column_name: str
+) -> set[str]:
+    if column_name in columns:
+        conn.execute(text(f"ALTER TABLE {table_name} DROP COLUMN {column_name}"))
+        conn.commit()
+        return _table_columns(conn, table_name)
+    return columns
+
+
 def apply(conn: Connection) -> None:
     user_columns = _table_columns(conn, "users")
     user_columns = _add_column_if_missing(
@@ -51,10 +61,16 @@ def apply(conn: Connection) -> None:
         "require_admin_approval_for_registration",
         "require_admin_approval_for_registration BOOLEAN NOT NULL DEFAULT 1",
     )
-    _add_column_if_missing(
+    settings_columns = _add_column_if_missing(
+        conn,
+        "email_notification_settings",
+        settings_columns,
+        "require_verified_email_for_approval",
+        "require_verified_email_for_approval BOOLEAN NOT NULL DEFAULT 1",
+    )
+    _drop_column_if_present(
         conn,
         "email_notification_settings",
         settings_columns,
         "warn_unverified_email_before_approval",
-        "warn_unverified_email_before_approval BOOLEAN NOT NULL DEFAULT 1",
     )