Fix/Email verification only for verified users #1875
Conversation
WalkthroughThe changes involve a modification to the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
src/resolvers/userResolver.ts (1)
291-293: Consider handling unverified email duplicates.While the change prevents verified email reuse, it might allow multiple unverified users to attempt verification with the same email. Consider adding a check for unverified duplicates and implementing a cleanup strategy.
Example implementation:
// Check do we have an email already in the database and is it verified const isEmailAlreadyUsed = await User.findOne({ where: { email: email, isEmailVerified: true }, }); + + // Check for unverified duplicates + const unverifiedDuplicate = await User.findOne({ + where: { email: email, isEmailVerified: false, id: Not(user.id) }, + }); + + if (unverifiedDuplicate) { + // Option 1: Prevent the operation + return 'EMAIL_PENDING_VERIFICATION'; + // Option 2: Clean up old unverified entries + // await unverifiedDuplicate.remove(); + }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
src/resolvers/userResolver.ts(1 hunks)
🔇 Additional comments (1)
src/resolvers/userResolver.ts (1)
291-293: LGTM! Verify impact on existing unverified users.
The addition of isEmailVerified: true condition correctly implements the requirement to only consider verified emails when checking for duplicates.
Let's verify if there are any existing unverified users that might be affected:
✅ Verification successful
Let me gather more information about email verification handling in the codebase.
The email verification implementation is correctly handling all edge cases
The codebase has comprehensive email verification handling that prevents any issues with unverified users:
- The
sendUserEmailConfirmationCodeFlowmethod checks if the current user's email is already verified before proceeding - Multiple safeguards exist across the codebase to prevent operations when email is not verified
- Test cases cover scenarios for both verified and unverified emails
- The implementation correctly allows multiple unverified users to attempt verification while preventing verified email duplicates
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Search for potential cases where multiple users share the same email
# but have different verification statuses
ast-grep --pattern 'await User.findOne({
where: { email: $_, isEmailVerified: true },
})' -A 10
Length of output: 852
Script:
#!/bin/bash
# Search for other email verification related queries and checks
ast-grep --pattern 'where: { email: $_ }'
# Also search for any other email-related conditions
rg "email.*verified" -A 3
Length of output: 7885
Summary by CodeRabbit
New Features
Bug Fixes