From 424d94f16d2e903014e8243bbabde393b0400dec Mon Sep 17 00:00:00 2001
From: Keith Williams <keithwillcode@gmail.com>
Date: Sun, 16 Mar 2025 11:20:20 -0300
Subject: [PATCH] feat: Use Watchlist on sending email verifications (#20114)

---
 packages/features/auth/lib/verifyEmail.ts | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/packages/features/auth/lib/verifyEmail.ts b/packages/features/auth/lib/verifyEmail.ts
index d2cd94d65a..b4fed47951 100644
--- a/packages/features/auth/lib/verifyEmail.ts
+++ b/packages/features/auth/lib/verifyEmail.ts
@@ -7,6 +7,7 @@ import {
   sendChangeOfEmailVerificationLink,
 } from "@calcom/emails/email-manager";
 import { getFeatureFlag } from "@calcom/features/flags/server/utils";
+import { checkIfEmailIsBlockedInWatchlistController } from "@calcom/features/watchlist/operations/check-if-email-in-watchlist.controller";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
 import { WEBAPP_URL } from "@calcom/lib/constants";
 import logger from "@calcom/lib/logger";
@@ -40,6 +41,11 @@ export const sendEmailVerification = async ({
     return { ok: true, skipped: true };
   }
 
+  if (await checkIfEmailIsBlockedInWatchlistController(email)) {
+    log.warn("Email is blocked - not sending verification email", email);
+    return { ok: false, skipped: false };
+  }
+
   if (isPlatform) {
     log.warn("Skipping Email verification");
     return { ok: true, skipped: true };
@@ -82,6 +88,11 @@ export const sendEmailVerificationByCode = async ({
   username,
   isVerifyingEmail,
 }: VerifyEmailType) => {
+  if (await checkIfEmailIsBlockedInWatchlistController(email)) {
+    log.warn("Email is blocked - not sending verification email", email);
+    return { ok: false, skipped: false };
+  }
+
   const translation = await getTranslation(language ?? "en", "common");
   const secret = createHash("md5")
     .update(email + process.env.CALENDSO_ENCRYPTION_KEY)
@@ -122,6 +133,11 @@ export const sendChangeOfEmailVerification = async ({ user, language }: ChangeOf
     return { ok: true, skipped: true };
   }
 
+  if (await checkIfEmailIsBlockedInWatchlistController(user.emailFrom)) {
+    log.warn("Email is blocked - not sending verification email", user.emailFrom);
+    return { ok: false, skipped: false };
+  }
+
   await checkRateLimitAndThrowError({
     rateLimitingType: "core",
     identifier: user.emailFrom,