ccff0045fc
* fix: Add email verification requirement for API v1 and v2 email updates
- API v2 (/v2/me): Implement email verification check when updating primary email
- Store new email in metadata as emailChangeWaitingForVerification when verification is required
- Send verification email using sendChangeOfEmailVerification
- Allow immediate email change if new email is already a verified secondary email
- Add hasEmailBeenChanged and sendEmailVerification flags to response
- Add tests to verify email verification behavior
- Add findVerifiedSecondaryEmail method to UsersRepository
- Add PrismaFeaturesRepository to MeModule providers
- API v1 (/v1/users/{userId}): Implement same email verification logic
- Check if email-verification feature flag is enabled
- Store new email in metadata when verification is required
- Send verification email for unverified email changes
- Allow immediate change for verified secondary emails
- Preserve existing API v1 response format
- Test fixtures: Add createSecondaryEmail method to UserRepositoryFixture
This fixes the vulnerability where users could update their primary email
without verification via API endpoints.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* update
* refactor: Extract business logic to MeService and add platform-managed bypass
- Create MeService with all business logic extracted from MeController
- Update MeController to delegate to MeService (thin controller pattern)
- Add PrismaWorkerModule to MeModule imports to provide PrismaWriteService
- Add isPlatformManaged bypass: platform-managed users can update email without verification
- Fix test cleanup to use delete by ID instead of email to avoid failures when email changes
- Remove hasEmailBeenChanged and sendEmailVerification response flags per reviewer feedback
- Add comprehensive documentation to @ApiOperation describing email verification behavior
- Update tests to remove flag assertions
Addresses PR comments:
- supalarry: Extract logic to service layer
- supalarry: Allow platform-managed users to update email without verification
- supalarry: Remove response flags and document behavior in @ApiOperation instead
- cubic-dev-ai: Fix module dependency for PrismaFeaturesRepository
- cubic-dev-ai: Fix test cleanup issue
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* docs: Simplify API operation description
Remove internal implementation details about metadata staging and shorten the description to focus on API consumer behavior.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix
* update
* update
* update
* remove comment
* addressed commit
* review addressed
* use repository
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
56 lines
2.2 KiB
TypeScript
56 lines
2.2 KiB
TypeScript
import AttendeeAddGuestsEmail from "@calcom/emails/templates/attendee-add-guests-email";
|
|
import AttendeeCancelledEmail from "@calcom/emails/templates/attendee-cancelled-email";
|
|
import AttendeeDeclinedEmail from "@calcom/emails/templates/attendee-declined-email";
|
|
import AttendeeRequestEmail from "@calcom/emails/templates/attendee-request-email";
|
|
import AttendeeRescheduledEmail from "@calcom/emails/templates/attendee-rescheduled-email";
|
|
import AttendeeScheduledEmail from "@calcom/emails/templates/attendee-scheduled-email";
|
|
import AttendeeUpdatedEmail from "@calcom/emails/templates/attendee-updated-email";
|
|
import AttendeeVerifyEmail from "@calcom/emails/templates/attendee-verify-email";
|
|
import OrganizerAddGuestsEmail from "@calcom/emails/templates/organizer-add-guests-email";
|
|
import OrganizerCancelledEmail from "@calcom/emails/templates/organizer-cancelled-email";
|
|
import OrganizerReassignedEmail from "@calcom/emails/templates/organizer-reassigned-email";
|
|
import OrganizerRequestEmail from "@calcom/emails/templates/organizer-request-email";
|
|
import OrganizerRescheduledEmail from "@calcom/emails/templates/organizer-rescheduled-email";
|
|
import OrganizerScheduledEmail from "@calcom/emails/templates/organizer-scheduled-email";
|
|
import {
|
|
sendChangeOfEmailVerification,
|
|
sendEmailVerificationByCode,
|
|
} from "@calcom/features/auth/lib/verifyEmail";
|
|
import { sendSignupToOrganizationEmail } from "@calcom/trpc/server/routers/viewer/teams/inviteMember/utils";
|
|
import { verifyEmailCodeHandler } from "@calcom/trpc/server/routers/viewer/workflows/verifyEmailCode.handler";
|
|
|
|
export { AttendeeVerifyEmail };
|
|
|
|
export { AttendeeAddGuestsEmail };
|
|
|
|
export { OrganizerAddGuestsEmail };
|
|
|
|
export { AttendeeScheduledEmail };
|
|
|
|
export { OrganizerScheduledEmail };
|
|
|
|
export { AttendeeDeclinedEmail };
|
|
|
|
export { AttendeeCancelledEmail };
|
|
|
|
export { OrganizerCancelledEmail };
|
|
|
|
export { OrganizerReassignedEmail };
|
|
|
|
export { OrganizerRescheduledEmail };
|
|
|
|
export { AttendeeRescheduledEmail };
|
|
|
|
export { AttendeeUpdatedEmail };
|
|
|
|
export { OrganizerRequestEmail };
|
|
|
|
export { AttendeeRequestEmail };
|
|
|
|
export { sendSignupToOrganizationEmail };
|
|
|
|
export { sendEmailVerificationByCode };
|
|
export { sendChangeOfEmailVerification };
|
|
|
|
export { verifyEmailCodeHandler };
|