Ideally, users who are using Auth0 in French should get French content from this app.

This should cover:

• Web content
• Email content

Currently, based on #39 and #57, users will get a new verification email each time they try to log in.

Instead of sending an email each and every time, perhaps we can track if/when the email was sent and only automatically send one if none has been sent before.

The Auth0 action could look at the login count, and if it's the first time (1), trigger the email sending, otherwise don't. E.g. Send users to /start, otherwise send users to / (or pass an argument to indicate the intended action)

Some users get stuck on the holding page after having verified their email in another channel. This leads to a poor user experience.

In the case where the email address has been verified, the user should no longer be stuck on the holding page. The use should also not have the option of sending another verification message (which will "fail" with a cryptic error message as the email address has already been verified -- but the user doesn't see that, they see only a "unable to verify, try again later" message)

Some places where this could be improved:

• before sending a new email verification message, check the status of the email address. Only send the verification message if the email address is not verified.
• on each page load, check the status of the email address. Should the holding page reload itself periodically?

While this system is normally used as an interim landing page for users who haven't yet verified their email address, it might be useful as a standalone destination.

E.g. when dealing with support, we could send users directly to this system, where they would log in and request a new verification email.

This would remove the need for the failure page that's currently at /about.

Instead of triggering a verification email to go out, use the ticket system to get a new verification link and send our own email.

This is to account for a change where we only sometimes want to send this verification email message, but Auth0 currently doesn't provide means for us to do this.

See this discussion on Auth0 Community: https://community.auth0.com/t/do-not-send-email-verification-in-select-cases/92189

• Get the verification link from the Auth0 API
• Send that link by email
• Update documentation

There's a "Get help" link in this app that goes to https://service.yukon.ca/forms/en/help-yukon-government-online-services-account

It should include from and page arguments, to improve user support that starts from this system.

We're using Auth0 with a custom domain, but some application use the auth0 equivalent. Currently this verifier program only check a single audience.

It looks like the PHP SKD supports multiple audiences.

https://github.com/auth0/auth0-PHP/blob/main/src/Token/Validator.php#L26

Doesn't matter, it's not multiple audiences that are the problem, it's multiple issuers.

Some uses have reported that clicking on the "continue logging in" link does not work.

Steps to reproduce

1. Create an account (or change the email address of an existing account). This account must have the "email verified" flag off
2. attempt to log in. This should bring you to the account email verifier holding page
3. From your email program, click the email verification link. Do not click "Continue to {app name}"
4. Back in the Verify your email address service, click on the "continue logging in" link

Expected behaviour

Clicking on "continue logging in" will take the user first (and transparently) to Auth0, then to the application to finish logging in.

Actual behaviour

Clicking on "continue logging in" causes a file to download.

Users will be confused if they get to this app or page after they've verified their email address. While this shouldn't be a common situation, this application shouldn't assume that all users who are here still need their email address verified.

If we sent a new email verification message (which Auth0 will happily do, even for users who are already verified), following that link will take users to an error message, since the verification "failed" (thankfully there's a note there about their email address already being verified, but still it's confusing).

It is unlikely that users who are first redirected here will have their email address verified, since Auth0 (just checked that).

Some options:

• check status before we send a new verification message
• check status periodically (e.g. refresh the page every minute or so)