overleaf/services/web/app/src/Features/User/UserEmailsConfirmationHandler.js

const EmailHelper = require('../Helpers/EmailHelper')
const EmailHandler = require('../Email/EmailHandler')
const OneTimeTokenHandler = require('../Security/OneTimeTokenHandler')
const settings = require('settings-sharelatex')
const Errors = require('../Errors/Errors')
const UserUpdater = require('./UserUpdater')
const UserGetter = require('./UserGetter')

const ONE_YEAR_IN_S = 365 * 24 * 60 * 60

const UserEmailsConfirmationHandler = {
  sendConfirmationEmail(userId, email, emailTemplate, callback) {
    if (arguments.length === 3) {
      callback = emailTemplate
      emailTemplate = 'confirmEmail'
    }

    // when force-migrating accounts to v2 from v1, we don't want to send confirmation messages -
    // setting this env var allows us to turn this behaviour off
    if (process.env['SHARELATEX_NO_CONFIRMATION_MESSAGES'] != null) {
      return callback(null)
    }

    email = EmailHelper.parseEmail(email)
    if (!email) {
      return callback(new Error('invalid email'))
    }
    const data = { user_id: userId, email }
    OneTimeTokenHandler.getNewToken(
      'email_confirmation',
      data,
      { expiresIn: ONE_YEAR_IN_S },
      function(err, token) {
        if (err) {
          return callback(err)
        }
        const emailOptions = {
          to: email,
          confirmEmailUrl: `${
            settings.siteUrl
          }/user/emails/confirm?token=${token}`,
          sendingUser_id: userId
        }
        EmailHandler.sendEmail(emailTemplate, emailOptions, callback)
      }
    )
  },

  confirmEmailFromToken(token, callback) {
    OneTimeTokenHandler.getValueFromTokenAndExpire(
      'email_confirmation',
      token,
      function(error, data) {
        if (error) {
          return callback(error)
        }
        if (!data) {
          return callback(new Errors.NotFoundError('no token found'))
        }
        const userId = data.user_id
        const email = data.email

        if (!userId || email !== EmailHelper.parseEmail(email)) {
          return callback(new Errors.NotFoundError('invalid data'))
        }
        UserGetter.getUser(userId, {}, function(error, user) {
          if (error) {
            return callback(error)
          }
          if (!user) {
            return callback(new Errors.NotFoundError('user not found'))
          }
          const emailExists = user.emails.some(
            emailData => emailData.email === email
          )
          if (!emailExists) {
            return callback(new Errors.NotFoundError('email missing for user'))
          }
          UserUpdater.confirmEmail(userId, email, callback)
        })
      }
    )
  }
}

module.exports = UserEmailsConfirmationHandler