Send a confirmation email when the user adds a secondary email address

What does this MR do?

When a user adds a secondary email address, we now send a conformation email. The Devise confirmable capability is used to deliver the email in the same way and format style as a new user email confirmation.

I believe this feature is mostly complete. Feature and rspec tests are written, however the handling of the confirmation path (that the user links on) is not explicitly tested and probably should be.

A couple notes:

  • At this time, I don't think a "Re-send confirmation" button on the email list is necessary. It's easy to simply remove and re-add the email, which will trigger another confirmation. That's something that could be considered in the future if there is too much friction in the process.
  • I think the "Unconfirmed" label should be gray, typically by using the label-default class. However, the background is way too light. So for now I used the orange label-warning, though next to the Remove button, I almost think the Remove button should be red, label-danger
  • It's unclear if we need to honor user.can?(:receive_notifications) for this feature. For now, assume it does not since the actual email sending process is handled by Devise.
  • I added Spinach feature tests, as that was where this particular panel is currently tested. However I just read that you are trying not to add more Spinach tests. Maybe it's acceptable for now until that entire test gets moved to Rspec features.

Are there points in the code the reviewer needs to double check?

An index was added in the migration - I don't know if the DOWNTIME variable should be set or not.


Why was this MR needed?

As mentioned in the issue, in order to use secondary emails for GPG verification, they must first be validated.

Screenshots (if relevant)

Does this MR meet the acceptance criteria?

What are the relevant issue numbers?

Closes #37385 (closed), #28621, #36959 (closed)

Edited by Douwe Maan