Files
accounted/tests/pg/profile-email-sync.pg.test.ts
Mattsson 7f0f25b558 feat(account): self-service login email change with double confirmation (#2017)
* feat(account): self-service login email change with double confirmation

New POST /api/account/email requests the change via the user session so
Supabase's AAL2 guard applies, and the account settings page gets an email
row with pending-confirmation state. Confirmation mails (both addresses)
and the /auth/callback email_change verification already existed; this
wires the missing initiation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* feat(account): map email_exists to a 409 with Swedish copy

Changing to an address that already has an account is refused by GoTrue
(addresses are unique per auth user); surface that as a clear conflict
instead of the generic fallback.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(account): trusted redirect origin + profiles.email sync trigger (skeptic findings)

- emailRedirectTo now derives from resolveRequestAppOrigin(): request.url
  can be an internal origin behind a proxy (dead confirmation links on
  self-hosted) and auth links must not follow attacker-chosen hosts;
  registered white-label hosts keep their brand.
- New migration 20260828191950: sync_profile_email trigger mirrors
  auth.users.email changes into profiles.email (member lists, notification
  recipients, AGI/KU contact, invite dedup all read profiles.email), plus a
  backfill for already-diverged rows. pg-real test included.
- Save button disabled while the same address awaits confirmation (no
  rate-limit re-fires); GoTrue's 'error sending email change email' now maps
  to the Swedish SMTP guidance.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(account): idempotent repeat request for the pending address

CodeRabbit follow-up: a second POST for the address already awaiting
confirmation now returns the pending state without another GoTrue round
trip (no duplicate confirmation mails, no rate-limit burn). Claims-mapped
sessions lack new_email; GoTrue's send rate limit remains the backstop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-28 22:12:20 +02:00

88 lines
2.6 KiB
TypeScript

import { describe, it, expect, afterAll } from 'vitest'
import { getPool } from './setup'
import { insertAuthUser } from './fixtures'
// 20260828191950_sync_profile_email_on_auth_email_change.sql:
// auth.users.email changes (self-service change, admin API, SQL) must mirror
// into public.profiles.email, which member lists, notification recipients,
// and AGI/KU contact fields read.
const createdUsers: string[] = []
async function seedUser(): Promise<string> {
const id = await insertAuthUser()
createdUsers.push(id)
return id
}
afterAll(async () => {
if (createdUsers.length > 0) {
await getPool().query(`DELETE FROM auth.users WHERE id = ANY($1::uuid[])`, [
createdUsers,
])
}
})
describe('sync_profile_email trigger', () => {
it('mirrors an auth.users email change into profiles.email', async () => {
const userId = await seedUser()
const before = await getPool().query(
`SELECT email FROM public.profiles WHERE id = $1`,
[userId],
)
expect(before.rows[0].email).toBe(`pg-real-${userId}@test.invalid`)
await getPool().query(`UPDATE auth.users SET email = $2 WHERE id = $1`, [
userId,
`changed-${userId}@test.invalid`,
])
const after = await getPool().query(
`SELECT email FROM public.profiles WHERE id = $1`,
[userId],
)
expect(after.rows[0].email).toBe(`changed-${userId}@test.invalid`)
})
it('does not clobber profiles on unrelated auth.users updates', async () => {
const userId = await seedUser()
// A user-managed profile email divergence must survive updates that do
// not touch auth.users.email (the trigger fires on UPDATE OF email only).
await getPool().query(
`UPDATE public.profiles SET email = $2 WHERE id = $1`,
[userId, `manual-${userId}@test.invalid`],
)
await getPool().query(
`UPDATE auth.users SET updated_at = now() WHERE id = $1`,
[userId],
)
const res = await getPool().query(
`SELECT email FROM public.profiles WHERE id = $1`,
[userId],
)
expect(res.rows[0].email).toBe(`manual-${userId}@test.invalid`)
})
it('syncs even when profiles.email was already divergent', async () => {
const userId = await seedUser()
await getPool().query(
`UPDATE public.profiles SET email = $2 WHERE id = $1`,
[userId, `stale-${userId}@test.invalid`],
)
await getPool().query(`UPDATE auth.users SET email = $2 WHERE id = $1`, [
userId,
`fresh-${userId}@test.invalid`,
])
const res = await getPool().query(
`SELECT email FROM public.profiles WHERE id = $1`,
[userId],
)
expect(res.rows[0].email).toBe(`fresh-${userId}@test.invalid`)
})
})