Looking through the code trying to solve part of CO-1647, I run into the problem that a user cannot verify an email address they added themselves.

The CoInvitesController requires the 'verifyEmailAddress' permission for this, which is set based on Role->canRequestVerificationOfEmailAddress. That method is called using the roles['copersonid'] value, which is only set if the current CoPersonId is also a member of the current CO.

However, the CoInvitesController does not set the current CO, probably because invites are mostly done before CoPersons are allowed in a CO. 'calculateImpliedCoId' (supposedly responsible for this) only runs for actions 'confirm' and 'authconfirm' and not for 'verifyEmailAddress'. It also does not call the parent::calculateImpliedCoId, although that probably would not fix it.

I assume 'calculateImpliedCoId' needs to be extended for action 'verifyEmailAddress' and set the CoId based on the EmailAddress.