Email verification system does not prevent users from signing up with emails they do not own

Increasing Access

Prevents users from registering with email accounts they do not own, so that users who own the email accounts are able to register.

If we migrate to OAuth, the sign up flow for users should also be easier (one-click for new users, less memorization for passwords)

Feature enhancement details

Context:

@Geethegreat is working on the 2026 GSOC project to add E2e testing to the p5.js web editor.
As part of his work, he started writing a test for the "User sign-up flow".

He found that users who are registered, but unverified, can continue to use the p5.js web editor with their accounts.

This could mean that user A could sign up with an email belonging to user B, thereby preventing user B from signing up with their email.

This also results in easy creation of spam bot accounts.

Proposed Solutions:

We would either plan a migration to OAuth or add a re-direct to a "Please verify your account" page for users who are registered but not verified.

The latter looks easier, but we would need to figure out how to accommodate users who maybe registered with an email they no longer have access to & what to do with all stray accounts that do not get verified (do their emails become eligable for new users to register with after a TTL?)

Start with the E2E test for the “User sign-up flow” and read the existing registration and email-verification flow it exercises. Determine how unverified users currently reach the web editor, then define the chosen OAuth or verification-page behavior, including treatment of inaccessible accounts and unverified accounts after the decision period.