feat: add ability to force email verification (#1837)

backend/internal/apperror/constructors.go

@@ -308,3 +308,11 @@ func OidcPARRequired() *Error {
 func InvalidEmailVerificationToken() *Error {
 	return New(CodeEmailVerificationTokenInvalid, http.StatusBadRequest, "Email verification token is invalid")
 }
+
+func EmailVerificationRequired() *Error {
+	return New(CodeEmailVerificationRequired, http.StatusForbidden, "You must verify your email address before you can access this service.")
+}
+
+func EmailChangeNotStarted(cause error) *Error {
+	return Wrap(cause, CodeEmailChangeNotStarted, http.StatusInternalServerError, "Your other changes were saved, but the email to confirm your new email address could not be sent")
+}

backend/internal/apperror/error.go

@@ -35,6 +35,8 @@ const (
 	CodeDeviceLoginExpired              Code = "device_login_expired"
 	CodeReauthenticationRequired        Code = "reauthentication_required"
 	CodeEmailVerificationTokenInvalid   Code = "invalid_email_verification_token"
+	CodeEmailVerificationRequired       Code = "email_verification_required"
+	CodeEmailChangeNotStarted           Code = "email_change_not_started"
 	CodeSetupNotAvailable               Code = "setup_not_available"
 	CodeSetupAlreadyCompleted           Code = "setup_already_completed"
 	CodeTokenInvalidOrExpired           Code = "token_invalid_or_expired"