Feature Request: Provide config param to require email be verified before users can request access, download files.

Overview of the Feature Request
Require email be verified before users can request access, download files.

What kind of user is the feature intended for?
(Example users roles: API User, Curator, Depositor, Guest, Superuser, Sysadmin)

All users.

What inspired the request?

The ADA access team spends A LOT of time checking that users who have requested data have verified their email address, have to email them to do so if they haven't, recheck it, etc. This is a considerable amount of overhead.

What existing behavior do you want changed?

Currently, a user doesn't have to verify their email address at any point - they can just request access and download files when given access.

If a verified email is required, there is a lot of overhead associated with all the checks and comms between the data custodian/owner and the users. This overhead could be eliminated.

Any brand new behavior do you want to add to Dataverse?

Provide a flag per dataverse installation that when set to true requires a user to verify their email address either full stop (they have to verify it before they can proceed with anything in the dataverse ui or api), or when they request data and when they go to download data (if their email is not verified, they can't request and they can't download).

Any open or closed issues related to this feature request?

Not sure.

Are you thinking about creating a pull request for this feature?

No resources to do so.

Start by locating the existing email-verification flow and the authorization paths for access requests and file downloads. Define the installation-level configuration behavior and decide whether enforcement applies throughout the UI and API or only to requesting and downloading; done means unverified users are blocked in the selected scopes and verified users retain access.