Verify a phone or email after an admin change

Audience: Kulcare support and platform admins who use the admin app (kulcare-admin).

TL;DR: When an admin changes a practitioner's phone or a user's email, the new phone or email is unverified. The user verifies a new phone at sign-in: Kulcare sends a code to the new number, and the user enters it. Usually the admin does not send a code. The user verifies a new email in Connect, on My profile, with a code that Kulcare sends to that email.

Status: this page applies after PR #2648 and PR #2636 merge. The link to the flow map section works after PR #2648 merges.

Source: PR #2648 (the phone, and the reset of verification on an admin change) and PR #2636 (the email verification on My profile). For the API and the token details, see After an admin changes the phone in the authentication flow map.

What an admin change doesCopy Anchor Link

The user never proved a phone or an email that an admin types. So the change makes it unverified.

Some edits are not a change, and the verification stays:

• A phone typed in a different format: with a + at the start, or with the country code in front. Kulcare stores +919876500000 and 919876500000 as 9876500000.
• An email that differs only in upper and lower case.

The admin cannot change the country code, and the admin can change the phone of a practitioner only. The Users page cannot change a phone. After the country code is removed, the number must have 10 to 15 digits. If it does not, the save fails and nothing changes.

An unverified phone or email has two effects:

• Invites. An invite finds a user only by a verified phone or a verified email. An invite sent to the new phone or email does not show on the user's invites page until the user verifies it. An invite that Kulcare already linked to the user's account is not affected.
• Phone sign-in. Sign-in with the new phone and the password asks for a code before it continues.

Help a user verify a new phoneCopy Anchor Link

Tell the user to do these steps:

1. Open the Kulcare sign-in page.
2. Sign in with the new phone number and the usual password.
3. On Verify your phone, enter the 6-digit code from the SMS. Kulcare sends the code when the page opens.
4. If no SMS comes, wait until the Resend in countdown ends, then select Resend code.
5. On the sign-in page, sign in again with the phone and the password.

What the user sees:

• After step 2, a message: "Please verify your phone number to continue." Then the Verify your phone page opens.
• After step 3, the sign-in page opens again with the message "Your number is verified. Sign in to finish." This is correct for a user who signed in before. The code proves the phone only, so the user must sign in again. A user with two-factor authentication also enters the second factor.
• The sign-in form does not fill in the phone number. The user types it again.
• After step 5, the user is in Kulcare. Invites sent to the new phone now show on the invites page.

If the user does not know the password, the user selects Forgot password? on the sign-in page and resets it first. Then the user starts at step 1.

When the admin sends a codeCopy Anchor Link

The admin app has no button for this. A platform admin sends the code through the API: POST /identity/admin/practitioners/:id/phone_verification. The code goes by SMS to the practitioner's current phone. It is the same code as Resend code sends, and the user enters it on the same Verify your phone page.

Each new code replaces the previous code. The Verify your phone page sends a code when it opens, so a code that the admin sent before the user signs in is no longer valid. Send an admin code only when:

• The user is already on Verify your phone, and
• No SMS came, and Resend code does not help. For example, Kulcare blocks Resend code after too many tries from the same network.

Then tell the user to stay on the page and enter the new code. Do not sign in again, because that sends another code.

The API refuses a send in these cases:

Problems the user can tell you aboutCopy Anchor Link

Help a user with a new emailCopy Anchor Link

The Verify your phone page cannot verify an email: Kulcare sends that code by SMS only. The user verifies an email in Connect. Tell the user to do these steps:

1. Sign in to Kulcare with the phone number and the password.
2. Open My profile.
3. Find Sign-in email. A vendor finds it in Identity. Other users find it in Your account. An email that is not verified shows Unverified, and Verify your email shows under it.
4. Select Send code. Kulcare sends a code to that email.
5. Enter the code in Code, then select Verify.

What the user sees:

• After step 4: "We sent a code to" and the email address.
• After step 5: "Your email is verified". The Unverified tag changes to Verified. Invites sent to that email now show on the invites page.
• If no email comes, the user waits for the countdown, then selects Send a new code.

The user can also change the email to a different address: Sign-in email > Change email. Kulcare sends a code to the new address, and the new address is verified when the user enters it.

RelatedCopy Anchor Link

• Authentication flow map: every sign-in path, with the API calls.