Merge pull request #2170 from overleaf/ta-confirmation-email-missing-fix

Prevent Email Confirmation If Email Is Missing for User

GitOrigin-RevId: cab9667103b0a5596cf067f85f747b1481ca4e66

services/web/app/src/Features/User/UserEmailsConfirmationHandler.js

@@ -78,6 +78,12 @@ const UserEmailsConfirmationHandler = {
           if (!user) {
             return callback(new Errors.NotFoundError('user not found'))
           }
+          const emailExists = user.emails.some(
+            emailData => emailData.email === email
+          )
+          if (!emailExists) {
+            return callback(new Errors.NotFoundError('email missing for user'))
+          }
           UserUpdater.confirmEmail(userId, email, callback)
         })
       }

services/web/test/unit/src/User/UserEmailsConfirmationHandlerTests.js

@@ -44,9 +44,13 @@ describe('UserEmailsConfirmationHandler', function() {
         '../Helpers/EmailHelper': EmailHelper
       }
     })
-    this.mockUser = { _id: 'mock-user-id' }
+    this.mockUser = {
+      _id: 'mock-user-id',
+      email: 'mock@example.com',
+      emails: [{ email: 'mock@example.com' }]
+    }
     this.user_id = this.mockUser._id
-    this.email = 'mock@example.com'
+    this.email = this.mockUser.email
     return (this.callback = sinon.stub())
   })
 
@@ -229,5 +233,24 @@ describe('UserEmailsConfirmationHandler', function() {
           .should.equal(true)
       })
     })
+
+    describe('with secondary email missing on user', function() {
+      beforeEach(function() {
+        this.OneTimeTokenHandler.getValueFromTokenAndExpire = sinon
+          .stub()
+          .yields(null, { user_id: this.user_id, email: 'deleted@email.com' })
+        return this.UserEmailsConfirmationHandler.confirmEmailFromToken(
+          (this.token = 'mock-token'),
+          this.callback
+        )
+      })
+
+      it('should call the callback with a NotFoundError', function() {
+        console.log(this.callback.lastCall.args)
+        return this.callback
+          .calledWith(sinon.match.instanceOf(Errors.NotFoundError))
+          .should.equal(true)
+      })
+    })
   })
 })