Harden email verification resend against abuse

Add a per-address confirmation-email cooldown and disable the
resend/forgot-password submit buttons while the mutation is in
flight so callers cannot flood the mail queue or double-submit.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/coredata/email.go

@@ -319,6 +319,39 @@ WHERE id = @id
 	return err
 }
 
+// ExistsByRecipientSubjectCreatedAfter reports whether an email with the given
+// recipient and subject was created at or after createdAfter.
+func ExistsByRecipientSubjectCreatedAfter(
+	ctx context.Context,
+	conn pg.Querier,
+	recipientEmail mail.Addr,
+	subject string,
+	createdAfter time.Time,
+) (bool, error) {
+	q := `
+SELECT EXISTS (
+	SELECT 1
+	FROM emails
+	WHERE recipient_email = @recipient_email
+		AND subject = @subject
+		AND created_at >= @created_after
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"recipient_email": recipientEmail.String(),
+		"subject":         subject,
+		"created_after":   createdAfter,
+	}
+
+	var exists bool
+	if err := conn.QueryRow(ctx, q, args).Scan(&exists); err != nil {
+		return false, fmt.Errorf("cannot check recent email: %w", err)
+	}
+
+	return exists, nil
+}
+
 func ResetStaleProcessingEmails(
 	ctx context.Context,
 	conn pg.Querier,

pkg/iam/account_service.go

@@ -76,6 +76,11 @@ var SupportedIdentityLocales = []string{
 
 const (
 	TokenTypeEmailConfirmation = "email_confirmation"
+
+	// emailConfirmationResendCooldown is the minimum time between confirmation
+	// emails for the same address. Resend requests inside this window succeed
+	// without enqueueing another message (anti-enumeration + anti-abuse).
+	emailConfirmationResendCooldown = time.Minute
 )
 
 func NewAccountService(svc *Service) *AccountService {
@@ -243,6 +248,20 @@ func (s AccountService) ResendVerificationEmail(ctx context.Context, email mail.
 				return nil // Don't leak information about already-verified identities
 			}
 
+			recent, err := coredata.ExistsByRecipientSubjectCreatedAfter(
+				ctx,
+				tx,
+				identity.EmailAddress,
+				emails.SubjectConfirmEmail,
+				time.Now().Add(-emailConfirmationResendCooldown),
+			)
+			if err != nil {
+				return fmt.Errorf("cannot check recent confirmation email: %w", err)
+			}
+			if recent {
+				return nil // Cooldown: avoid flooding the recipient / mail queue
+			}
+
 			confirmationToken, err := statelesstoken.NewToken(
 				s.tokenSecret,
 				TokenTypeEmailConfirmation,