Gate password sign-in on email verification
Unverified password identities were able to open sessions after signing out. Reject sign-in with EMAIL_NOT_VERIFIED and add a resend-confirmation flow so users can complete verification. Signed-off-by: Émile Ré <emile@probo.com>
This commit is contained in:
Émile Ré
111
e2e/console/email_verification_test.go
Normal file
111
e2e/console/email_verification_test.go
Normal file
@@ -0,0 +1,111 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
||||
//
|
||||
// Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
// of this software and associated documentation files (the "Software"), to deal
|
||||
// in the Software without restriction, including without limitation the rights
|
||||
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
// copies of the Software, and to permit persons to whom the Software is
|
||||
// furnished to do so, subject to the following conditions:
|
||||
//
|
||||
// The above copyright notice and this permission notice shall be included in
|
||||
// all copies or substantial portions of the Software.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
// SOFTWARE.
|
||||
|
||||
package console_test
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.probo.inc/probo/e2e/internal/testutil"
|
||||
)
|
||||
|
||||
func TestEmailVerification_PasswordSignInRequiresVerifiedEmail(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
client := testutil.NewUnauthenticatedClient(t)
|
||||
|
||||
uniqueID := fmt.Sprintf("%d", time.Now().UnixNano())
|
||||
email := fmt.Sprintf("unverified-%s@e2e.probo.test", uniqueID)
|
||||
password := "TestPassword123!"
|
||||
fullName := fmt.Sprintf("Unverified User %s", uniqueID)
|
||||
|
||||
const signUpMutation = `
|
||||
mutation($input: SignUpInput!) {
|
||||
signUp(input: $input) {
|
||||
identity { id }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var signUpResult struct {
|
||||
SignUp struct {
|
||||
Identity struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"identity"`
|
||||
} `json:"signUp"`
|
||||
}
|
||||
|
||||
err := client.ExecuteConnect(signUpMutation, map[string]any{
|
||||
"input": map[string]any{
|
||||
"email": email,
|
||||
"password": password,
|
||||
"fullName": fullName,
|
||||
},
|
||||
}, &signUpResult)
|
||||
require.NoError(t, err, "signUp should succeed for unverified identity")
|
||||
require.NotEmpty(t, signUpResult.SignUp.Identity.ID)
|
||||
|
||||
client.SignOut()
|
||||
|
||||
err = client.SignIn(email, password)
|
||||
testutil.RequireErrorCode(t, err, "EMAIL_NOT_VERIFIED")
|
||||
|
||||
client.ResendVerificationEmail(email)
|
||||
|
||||
token := client.GetEmailConfirmationToken(email)
|
||||
require.NotEmpty(t, token)
|
||||
|
||||
const verifyMutation = `
|
||||
mutation($input: VerifyEmailInput!) {
|
||||
verifyEmail(input: $input) {
|
||||
success
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var verifyResult struct {
|
||||
VerifyEmail struct {
|
||||
Success bool `json:"success"`
|
||||
} `json:"verifyEmail"`
|
||||
}
|
||||
|
||||
err = client.ExecuteConnect(verifyMutation, map[string]any{
|
||||
"input": map[string]any{
|
||||
"token": token,
|
||||
},
|
||||
}, &verifyResult)
|
||||
require.NoError(t, err, "verifyEmail should succeed")
|
||||
assert.True(t, verifyResult.VerifyEmail.Success)
|
||||
|
||||
err = client.SignIn(email, password)
|
||||
require.NoError(t, err, "signIn should succeed after email verification")
|
||||
}
|
||||
|
||||
func TestEmailVerification_ResendIsEnumerationSafe(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
client := testutil.NewUnauthenticatedClient(t)
|
||||
|
||||
client.ResendVerificationEmail(fmt.Sprintf("missing-%d@e2e.probo.test", time.Now().UnixNano()))
|
||||
}
|
||||
@@ -127,6 +127,9 @@ func (c *Client) setupTestUser() {
|
||||
// Sign up
|
||||
c.userID = c.signUp(email, password, fullName)
|
||||
|
||||
// Confirm email so password sign-in works for later re-authentication.
|
||||
c.verifyEmail(c.GetEmailConfirmationToken(email))
|
||||
|
||||
// Create organization (this makes the user an OWNER)
|
||||
orgName := fmt.Sprintf("Test Org %s", uniqueID)
|
||||
c.organizationID = c.createOrganization(orgName)
|
||||
@@ -197,28 +200,7 @@ func (c *Client) signUp(email, password, fullName string) gid.GID {
|
||||
}
|
||||
|
||||
func (c *Client) signIn(email string, password string) {
|
||||
const query = `
|
||||
mutation($input: SignInInput!) {
|
||||
signIn(input: $input) {
|
||||
identity { id }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
SignIn struct {
|
||||
Identity struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"identity"`
|
||||
} `json:"signIn"`
|
||||
}
|
||||
|
||||
err := c.ExecuteConnect(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"email": email,
|
||||
"password": password,
|
||||
},
|
||||
}, &result)
|
||||
err := c.SignIn(email, password)
|
||||
require.NoError(c.T, err, "signIn mutation failed")
|
||||
}
|
||||
|
||||
@@ -417,6 +399,129 @@ func (c *Client) getActivationToken(email string) string {
|
||||
return c.pollForLinkToken(fmt.Sprintf("to:%s subject:\"Invitation to join\"", email))
|
||||
}
|
||||
|
||||
func (c *Client) GetEmailConfirmationToken(email string) string {
|
||||
c.T.Helper()
|
||||
|
||||
return c.pollForLinkToken(fmt.Sprintf("to:%s subject:\"Confirm your email address\"", email))
|
||||
}
|
||||
|
||||
func (c *Client) verifyEmail(token string) {
|
||||
const query = `
|
||||
mutation($input: VerifyEmailInput!) {
|
||||
verifyEmail(input: $input) {
|
||||
success
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
VerifyEmail struct {
|
||||
Success bool `json:"success"`
|
||||
} `json:"verifyEmail"`
|
||||
}
|
||||
|
||||
err := c.ExecuteConnect(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"token": token,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(c.T, err, "verifyEmail mutation failed")
|
||||
require.True(c.T, result.VerifyEmail.Success, "verifyEmail should succeed")
|
||||
}
|
||||
|
||||
func (c *Client) ResendVerificationEmail(email string) {
|
||||
c.T.Helper()
|
||||
|
||||
const query = `
|
||||
mutation($input: ResendVerificationEmailInput!) {
|
||||
resendVerificationEmail(input: $input) {
|
||||
success
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ResendVerificationEmail struct {
|
||||
Success bool `json:"success"`
|
||||
} `json:"resendVerificationEmail"`
|
||||
}
|
||||
|
||||
err := c.ExecuteConnect(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"email": email,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(c.T, err, "resendVerificationEmail mutation failed")
|
||||
require.True(c.T, result.ResendVerificationEmail.Success, "resendVerificationEmail should succeed")
|
||||
}
|
||||
|
||||
func (c *Client) SignOut() {
|
||||
c.T.Helper()
|
||||
|
||||
const query = `
|
||||
mutation {
|
||||
signOut {
|
||||
success
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
SignOut struct {
|
||||
Success bool `json:"success"`
|
||||
} `json:"signOut"`
|
||||
}
|
||||
|
||||
err := c.ExecuteConnect(query, nil, &result)
|
||||
require.NoError(c.T, err, "signOut mutation failed")
|
||||
}
|
||||
|
||||
// SignIn attempts password sign-in and returns any GraphQL/transport error.
|
||||
func (c *Client) SignIn(email string, password string) error {
|
||||
c.T.Helper()
|
||||
|
||||
const query = `
|
||||
mutation($input: SignInInput!) {
|
||||
signIn(input: $input) {
|
||||
identity { id }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
SignIn struct {
|
||||
Identity struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"identity"`
|
||||
} `json:"signIn"`
|
||||
}
|
||||
|
||||
return c.ExecuteConnect(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"email": email,
|
||||
"password": password,
|
||||
},
|
||||
}, &result)
|
||||
}
|
||||
|
||||
// NewUnauthenticatedClient returns a Connect client with no session cookie.
|
||||
func NewUnauthenticatedClient(t testing.TB) *Client {
|
||||
t.Helper()
|
||||
|
||||
jar, err := cookiejar.New(nil)
|
||||
require.NoError(t, err, "cannot create cookie jar")
|
||||
|
||||
return &Client{
|
||||
T: t,
|
||||
baseURL: GetBaseURL(),
|
||||
mailpitBaseURL: GetMailpitBaseURL(),
|
||||
httpClient: &http.Client{
|
||||
Jar: jar,
|
||||
Timeout: 30 * time.Second,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// pollForLinkToken polls mailpit for a message matching searchQuery and
|
||||
// returns the first "token" query parameter found among its links.
|
||||
func (c *Client) pollForLinkToken(searchQuery string) string {
|
||||
|
||||
Reference in New Issue
Block a user