+14

.sqlx/query-92d601a6ea9ca3bcbafc228b258ede6948c18f2c824be8dcce434041d386e439.json

··· 1 1 + { 2 2 + "db_name": "PostgreSQL", 3 3 + "query": "UPDATE users SET email_verified = TRUE, updated_at = NOW() WHERE id = $1", 4 4 + "describe": { 5 5 + "columns": [], 6 6 + "parameters": { 7 7 + "Left": [ 8 8 + "Uuid" 9 9 + ] 10 10 + }, 11 11 + "nullable": [] 12 12 + }, 13 13 + "hash": "92d601a6ea9ca3bcbafc228b258ede6948c18f2c824be8dcce434041d386e439" 14 14 + }

+15

.sqlx/query-ad9d1f4dbd7075a15733e2366db78fb42554ba52b985068318ff3af0e4ad81a6.json

··· 1 1 + { 2 2 + "db_name": "PostgreSQL", 3 3 + "query": "UPDATE users SET email = $1, email_verified = FALSE, updated_at = NOW() WHERE id = $2", 4 4 + "describe": { 5 5 + "columns": [], 6 6 + "parameters": { 7 7 + "Left": [ 8 8 + "Text", 9 9 + "Uuid" 10 10 + ] 11 11 + }, 12 12 + "nullable": [] 13 13 + }, 14 14 + "hash": "ad9d1f4dbd7075a15733e2366db78fb42554ba52b985068318ff3af0e4ad81a6" 15 15 + }

-28

.sqlx/query-d6ec64a262936b8def9e5cad7d021df408b3a9b80fce5a7446647fbf276092ca.json

··· 1 1 - { 2 2 - "db_name": "PostgreSQL", 3 3 - "query": "SELECT id, email FROM users WHERE did = $1", 4 4 - "describe": { 5 5 - "columns": [ 6 6 - { 7 7 - "ordinal": 0, 8 8 - "name": "id", 9 9 - "type_info": "Uuid" 10 10 - }, 11 11 - { 12 12 - "ordinal": 1, 13 13 - "name": "email", 14 14 - "type_info": "Text" 15 15 - } 16 16 - ], 17 17 - "parameters": { 18 18 - "Left": [ 19 19 - "Text" 20 20 - ] 21 21 - }, 22 22 - "nullable": [ 23 23 - false, 24 24 - true 25 25 - ] 26 26 - }, 27 27 - "hash": "d6ec64a262936b8def9e5cad7d021df408b3a9b80fce5a7446647fbf276092ca" 28 28 - }

+40

.sqlx/query-e1d6f474116c4eade83f39956a7ce32a175f8cdfce0d30bbb2cf155aa11bc840.json

··· 1 1 + { 2 2 + "db_name": "PostgreSQL", 3 3 + "query": "SELECT id, handle, email, email_verified FROM users WHERE did = $1", 4 4 + "describe": { 5 5 + "columns": [ 6 6 + { 7 7 + "ordinal": 0, 8 8 + "name": "id", 9 9 + "type_info": "Uuid" 10 10 + }, 11 11 + { 12 12 + "ordinal": 1, 13 13 + "name": "handle", 14 14 + "type_info": "Text" 15 15 + }, 16 16 + { 17 17 + "ordinal": 2, 18 18 + "name": "email", 19 19 + "type_info": "Text" 20 20 + }, 21 21 + { 22 22 + "ordinal": 3, 23 23 + "name": "email_verified", 24 24 + "type_info": "Bool" 25 25 + } 26 26 + ], 27 27 + "parameters": { 28 28 + "Left": [ 29 29 + "Text" 30 30 + ] 31 31 + }, 32 32 + "nullable": [ 33 33 + false, 34 34 + false, 35 35 + true, 36 36 + false 37 37 + ] 38 38 + }, 39 39 + "hash": "e1d6f474116c4eade83f39956a7ce32a175f8cdfce0d30bbb2cf155aa11bc840" 40 40 + }

-2

frontend/src/lib/api.ts

··· 279 279 280 280 async requestEmailUpdate( 281 281 token: string, 282 282 - email: string, 283 282 ): Promise<{ tokenRequired: boolean }> { 284 283 return xrpc("com.atproto.server.requestEmailUpdate", { 285 284 method: "POST", 286 285 token, 287 287 - body: { email }, 288 286 }); 289 287 }, 290 288

+14 -1

frontend/src/locales/en.json

··· 234 234 "deleting": "Deleting...", 235 235 "messages": { 236 236 "emailCodeSent": "Verification code sent to your notification channel", 237 237 + "emailCodeSentToCurrent": "Verification code sent to your current email address", 237 238 "emailUpdated": "Email updated successfully", 238 239 "emailUpdateFailed": "Failed to update email", 239 240 "handleUpdated": "Handle updated successfully", ··· 659 660 "codeResent": "Verification code resent!", 660 661 "codeResentDetail": "Verification code sent! Check your inbox.", 661 662 "backToLogin": "Back to Login", 663 663 + "backToSettings": "Back to Settings", 662 664 "verifyingAccount": "Verifying account: @{handle}", 663 665 "startOver": "Start over with a different account", 664 666 "noPending": "No pending verification found.", ··· 671 673 "continue": "Continue", 672 674 "identifierLabel": "Email or Identifier", 673 675 "identifierPlaceholder": "you@example.com", 674 674 - "identifierHelp": "The email address or identifier the code was sent to" 676 676 + "identifierHelp": "The email address or identifier the code was sent to", 677 677 + "emailUpdateTitle": "Update Email Address", 678 678 + "emailUpdateSubtitle": "Enter your new email address and the verification code sent to your current email.", 679 679 + "emailUpdateRequiresAuth": "You must be signed in to update your email address.", 680 680 + "emailUpdateFailed": "Failed to update email address", 681 681 + "emailUpdateCodeHelp": "The code was sent to your current email address", 682 682 + "newEmailLabel": "New Email Address", 683 683 + "newEmailPlaceholder": "new@example.com", 684 684 + "updateEmail": "Update Email", 685 685 + "updating": "Updating...", 686 686 + "emailUpdated": "Your email has been updated successfully.", 687 687 + "emailUpdatedInfo": "You may need to verify your new email address." 675 688 }, 676 689 "resetPassword": { 677 690 "title": "Reset Password",

+14 -17

frontend/src/locales/fi.json

··· 234 234 "deleting": "Poistetaan...", 235 235 "messages": { 236 236 "emailCodeSent": "Vahvistuskoodi lähetetty ilmoituskanavallesi", 237 237 + "emailCodeSentToCurrent": "Vahvistuskoodi lähetetty nykyiseen sähköpostiosoitteeseesi", 237 238 "emailUpdated": "Sähköposti päivitetty", 238 239 "emailUpdateFailed": "Sähköpostin päivitys epäonnistui", 239 240 "handleUpdated": "Käyttäjänimi päivitetty", ··· 671 672 "noPending": "Odottavaa vahvistusta ei löytynyt.", 672 673 "noPendingInfo": "Jos loit tilin äskettäin ja sinun on vahvistettava se, sinun on ehkä luotava uusi tili. Jos olet jo vahvistanut tilisi, voit kirjautua sisään.", 673 674 "createAccount": "Luo tili", 674 674 - "signIn": "Kirjaudu sisään" 675 675 + "signIn": "Kirjaudu sisään", 676 676 + "backToSettings": "Takaisin asetuksiin", 677 677 + "emailUpdateCodeHelp": "Koodi lähetettiin nykyiseen sähköpostiosoitteeseesi", 678 678 + "emailUpdateFailed": "Sähköpostiosoitteen päivitys epäonnistui", 679 679 + "emailUpdateRequiresAuth": "Sinun on kirjauduttava sisään päivittääksesi sähköpostiosoitteesi.", 680 680 + "emailUpdateSubtitle": "Syötä uusi sähköpostiosoitteesi ja nykyiseen sähköpostiisi lähetetty vahvistuskoodi.", 681 681 + "emailUpdateTitle": "Päivitä sähköpostiosoite", 682 682 + "emailUpdated": "Sähköpostiosoitteesi on päivitetty.", 683 683 + "emailUpdatedInfo": "Sinun on ehkä vahvistettava uusi sähköpostiosoitteesi.", 684 684 + "newEmailLabel": "Uusi sähköpostiosoite", 685 685 + "newEmailPlaceholder": "uusi@esimerkki.fi", 686 686 + "updateEmail": "Päivitä sähköposti", 687 687 + "updating": "Päivitetään..." 675 688 }, 676 689 "resetPassword": { 677 690 "title": "Palauta salasana", ··· 754 767 "verificationMethod": "Vahvistusmenetelmä", 755 768 "email": "Sähköpostiosoite", 756 769 "emailPlaceholder": "sinä@esimerkki.fi", 757 757 - "discord": "Discord", 758 758 - "discordId": "Discord-käyttäjätunnus", 759 759 - "discordIdPlaceholder": "Discord-käyttäjätunnuksesi", 760 760 - "discordIdHint": "Numeerinen Discord-käyttäjätunnuksesi (ota Kehittäjätila käyttöön löytääksesi sen)", 761 761 - "telegram": "Telegram", 762 762 - "telegramUsername": "Telegram-käyttäjänimi", 763 763 - "telegramUsernamePlaceholder": "@käyttäjänimesi", 764 764 - "signal": "Signal", 765 765 - "signalNumber": "Signal-puhelinnumero", 766 766 - "signalNumberPlaceholder": "+358401234567", 767 767 - "signalNumberHint": "Sisällytä maakoodi (esim. +358 Suomelle)", 768 770 "inviteCode": "Kutsukoodi", 769 771 "inviteCodePlaceholder": "Syötä kutsukoodisi", 770 770 - "inviteCodeRequired": "vaaditaan", 771 771 - "didWebDescription": "Käytä DID-identiteettiä, jota isännöidään omalla verkkotunnuksellasi.", 772 772 - "didWebToggle": "Käytä ulkoista did:web", 773 772 "externalDid": "Sinun did:web", 774 773 "externalDidPlaceholder": "did:web:verkkotunnuksesi.fi", 775 775 - "dnsVerificationInstructions": "Vahvistaaksesi verkkotunnuksesi, lisää tämä TXT-tietue:", 776 776 - "copyDid": "Kopioi DID", 777 774 "createButton": "Luo tili", 778 775 "creating": "Luodaan...", 779 776 "alreadyHaveAccount": "Onko sinulla jo tili?",

+16 -41

frontend/src/locales/ja.json

··· 234 234 "deleting": "削除中...", 235 235 "messages": { 236 236 "emailCodeSent": "通知チャンネルに確認コードを送信しました", 237 237 + "emailCodeSentToCurrent": "現在のメールアドレスに確認コードを送信しました", 237 238 "emailUpdated": "メールを更新しました", 238 239 "emailUpdateFailed": "メールの更新に失敗しました", 239 240 "handleUpdated": "ハンドルを更新しました", ··· 671 672 "noPending": "保留中の確認が見つかりません。", 672 673 "noPendingInfo": "最近アカウントを作成して確認が必要な場合は、新しいアカウントを作成する必要があります。すでにアカウントを確認した場合は、サインインできます。", 673 674 "createAccount": "アカウントを作成", 674 674 - "signIn": "サインイン" 675 675 + "signIn": "サインイン", 676 676 + "backToSettings": "設定に戻る", 677 677 + "emailUpdateCodeHelp": "コードは現在のメールアドレスに送信されました", 678 678 + "emailUpdateFailed": "メールアドレスの更新に失敗しました", 679 679 + "emailUpdateRequiresAuth": "メールアドレスを更新するにはサインインが必要です。", 680 680 + "emailUpdateSubtitle": "新しいメールアドレスと、現在のメールに送信された確認コードを入力してください。", 681 681 + "emailUpdateTitle": "メールアドレスの更新", 682 682 + "emailUpdated": "メールアドレスが正常に更新されました。", 683 683 + "emailUpdatedInfo": "新しいメールアドレスの確認が必要な場合があります。", 684 684 + "newEmailLabel": "新しいメールアドレス", 685 685 + "newEmailPlaceholder": "new@example.com", 686 686 + "updateEmail": "メールを更新", 687 687 + "updating": "更新中..." 675 688 }, 676 689 "resetPassword": { 677 690 "title": "パスワードリセット", ··· 754 767 "verificationMethod": "確認方法", 755 768 "email": "メールアドレス", 756 769 "emailPlaceholder": "you@example.com", 757 757 - "discord": "Discord", 758 758 - "discordId": "Discord ユーザー ID", 759 759 - "discordIdPlaceholder": "Discord ユーザー ID", 760 760 - "discordIdHint": "数値の Discord ユーザー ID（開発者モードを有効にして確認）", 761 761 - "telegram": "Telegram", 762 762 - "telegramUsername": "Telegram ユーザー名", 763 763 - "telegramUsernamePlaceholder": "@yourusername", 764 764 - "signal": "Signal", 765 765 - "signalNumber": "Signal 電話番号", 766 766 - "signalNumberPlaceholder": "+81XXXXXXXXXX", 767 767 - "signalNumberHint": "国番号を含めてください（例: 日本は +81）", 768 770 "inviteCode": "招待コード", 769 771 "inviteCodePlaceholder": "招待コードを入力", 770 770 - "inviteCodeRequired": "必須", 771 771 - "didWebDescription": "独自ドメインでホストされる DID アイデンティティを使用します。", 772 772 - "didWebToggle": "外部 did:web を使用", 773 772 "externalDid": "あなたの did:web", 774 773 "externalDidPlaceholder": "did:web:yourdomain.com", 775 775 - "dnsVerificationInstructions": "ドメインを確認するには、この TXT レコードを追加してください:", 776 776 - "copyDid": "DID をコピー", 777 774 "createButton": "アカウントを作成", 778 775 "creating": "作成中...", 779 776 "alreadyHaveAccount": "すでにアカウントをお持ちですか？", ··· 896 893 "delegation": { 897 894 "title": "アカウント委任", 898 895 "controllers": "コントローラー", 899 899 - "controllersDescription": "コントローラーはあなたのアカウントの管理者として行動できます。あなたが許可した操作を実行し、あなたの代わりに投稿を作成し、リポジトリを変更できます。", 900 896 "controlledAccounts": "管理アカウント", 901 901 - "controlledAccountsDescription": "これらはあなたがコントローラーとして追加されているアカウントです。これらのアカウントで許可されたアクションを実行できます。", 902 897 "noControllers": "コントローラーはまだいません", 903 898 "noControlledAccounts": "管理アカウントはありません", 904 899 "addController": "コントローラーを追加", 905 905 - "revokeAccess": "アクセスを取り消す", 906 906 - "revokeConfirm": "このコントローラーのアクセスを取り消しますか？あなたのアカウントで操作できなくなります。", 907 900 "handle": "ハンドル", 908 908 - "handlePlaceholder": "@user.bsky.social", 909 901 "did": "DID", 910 910 - "didPlaceholder": "did:plc:...", 911 911 - "scopes": "権限レベル", 912 902 "scopeOwner": "オーナー", 913 913 - "scopeOwnerDesc": "完全な管理（すべてのアクションを実行可能）", 914 914 - "scopeAdmin": "管理者", 915 915 - "scopeAdminDesc": "投稿、アプリパスワード、設定の管理", 916 916 - "scopeEditor": "編集者", 917 917 - "scopeEditorDesc": "投稿、いいね、フォローの作成・管理", 918 903 "scopeViewer": "閲覧者", 919 919 - "scopeViewerDesc": "リポジトリと設定の読み取り専用アクセス", 920 904 "scopeCustom": "カスタム", 921 921 - "scopeCustomDesc": "個別の権限を選択", 922 922 - "grantedAt": "許可日時", 923 923 - "expiresAt": "有効期限", 924 924 - "noExpiration": "無期限", 925 905 "actAs": "として行動", 926 906 "auditLog": "監査ログ", 927 907 "auditLogTitle": "委任監査ログ", ··· 944 924 "showing": "{start}～{end} / {total}件", 945 925 "refresh": "更新", 946 926 "failedToLoadAuditLog": "監査ログの読み込みに失敗しました", 947 947 - "addControllerTitle": "コントローラーを追加", 948 948 - "addControllerDescription": "このアカウントに対して指定した権限で操作できるユーザーを追加します。", 949 949 - "controllerIdentifier": "コントローラーのハンドルまたはDID", 950 950 - "selectScopes": "権限レベルを選択", 951 951 - "add": "追加", 952 927 "adding": "追加中...", 953 953 - "cancel": "キャンセル", 954 928 "accessLevel": "アクセスレベル", 955 929 "addControllerButton": "+ コントローラーを追加", 956 930 "auditLogDesc": "すべての委任アクティビティを表示", ··· 974 948 "remove": "削除", 975 949 "removeConfirm": "このコントローラーを削除しますか？", 976 950 "viewAuditLog": "監査ログを表示", 977 977 - "yourAccessLevel": "あなたのアクセスレベル" 951 951 + "yourAccessLevel": "あなたのアクセスレベル", 952 952 + "accountCreated": "委任アカウントを作成しました: {handle}" 978 953 }, 979 954 "actAs": { 980 955 "title": "として行動",

+16 -41

frontend/src/locales/ko.json

··· 234 234 "deleting": "삭제 중...", 235 235 "messages": { 236 236 "emailCodeSent": "알림 채널로 인증 코드를 보냈습니다", 237 237 + "emailCodeSentToCurrent": "현재 이메일 주소로 인증 코드를 보냈습니다", 237 238 "emailUpdated": "이메일이 업데이트되었습니다", 238 239 "emailUpdateFailed": "이메일 업데이트에 실패했습니다", 239 240 "handleUpdated": "핸들이 업데이트되었습니다", ··· 671 672 "noPending": "보류 중인 인증이 없습니다.", 672 673 "noPendingInfo": "최근에 계정을 만들고 인증이 필요한 경우 새 계정을 만들어야 합니다. 이미 계정을 인증한 경우 로그인할 수 있습니다.", 673 674 "createAccount": "계정 만들기", 674 674 - "signIn": "로그인" 675 675 + "signIn": "로그인", 676 676 + "backToSettings": "설정으로 돌아가기", 677 677 + "emailUpdateCodeHelp": "코드가 현재 이메일 주소로 전송되었습니다", 678 678 + "emailUpdateFailed": "이메일 주소 업데이트 실패", 679 679 + "emailUpdateRequiresAuth": "이메일 주소를 업데이트하려면 로그인해야 합니다.", 680 680 + "emailUpdateSubtitle": "새 이메일 주소와 현재 이메일로 전송된 인증 코드를 입력하세요.", 681 681 + "emailUpdateTitle": "이메일 주소 업데이트", 682 682 + "emailUpdated": "이메일 주소가 성공적으로 업데이트되었습니다.", 683 683 + "emailUpdatedInfo": "새 이메일 주소를 인증해야 할 수 있습니다.", 684 684 + "newEmailLabel": "새 이메일 주소", 685 685 + "newEmailPlaceholder": "new@example.com", 686 686 + "updateEmail": "이메일 업데이트", 687 687 + "updating": "업데이트 중..." 675 688 }, 676 689 "resetPassword": { 677 690 "title": "비밀번호 재설정", ··· 754 767 "verificationMethod": "인증 방법", 755 768 "email": "이메일 주소", 756 769 "emailPlaceholder": "you@example.com", 757 757 - "discord": "Discord", 758 758 - "discordId": "Discord 사용자 ID", 759 759 - "discordIdPlaceholder": "Discord 사용자 ID", 760 760 - "discordIdHint": "숫자 Discord 사용자 ID (개발자 모드를 활성화하여 찾기)", 761 761 - "telegram": "Telegram", 762 762 - "telegramUsername": "Telegram 사용자 이름", 763 763 - "telegramUsernamePlaceholder": "@yourusername", 764 764 - "signal": "Signal", 765 765 - "signalNumber": "Signal 전화번호", 766 766 - "signalNumberPlaceholder": "+821012345678", 767 767 - "signalNumberHint": "국가 코드 포함 (예: 한국 +82)", 768 770 "inviteCode": "초대 코드", 769 771 "inviteCodePlaceholder": "초대 코드 입력", 770 770 - "inviteCodeRequired": "필수", 771 771 - "didWebDescription": "자체 도메인에서 호스팅되는 DID 아이덴티티를 사용합니다.", 772 772 - "didWebToggle": "외부 did:web 사용", 773 772 "externalDid": "귀하의 did:web", 774 773 "externalDidPlaceholder": "did:web:yourdomain.com", 775 775 - "dnsVerificationInstructions": "도메인을 인증하려면 이 TXT 레코드를 추가하세요:", 776 776 - "copyDid": "DID 복사", 777 774 "createButton": "계정 만들기", 778 775 "creating": "생성 중...", 779 776 "alreadyHaveAccount": "이미 계정이 있으신가요?", ··· 896 893 "delegation": { 897 894 "title": "계정 위임", 898 895 "controllers": "컨트롤러", 899 899 - "controllersDescription": "컨트롤러는 귀하의 계정 관리자로서 행동할 수 있습니다. 귀하가 허용한 작업을 수행하고, 귀하를 대신하여 게시물을 생성하고, 저장소를 수정할 수 있습니다.", 900 896 "controlledAccounts": "관리 계정", 901 901 - "controlledAccountsDescription": "귀하가 컨트롤러로 추가된 계정들입니다. 이 계정들에서 허용된 작업을 수행할 수 있습니다.", 902 897 "noControllers": "아직 컨트롤러가 없습니다", 903 898 "noControlledAccounts": "관리 계정이 없습니다", 904 899 "addController": "컨트롤러 추가", 905 905 - "revokeAccess": "액세스 취소", 906 906 - "revokeConfirm": "이 컨트롤러의 액세스를 취소하시겠습니까? 귀하의 계정에서 더 이상 작업을 수행할 수 없습니다.", 907 900 "handle": "핸들", 908 908 - "handlePlaceholder": "@user.bsky.social", 909 901 "did": "DID", 910 910 - "didPlaceholder": "did:plc:...", 911 911 - "scopes": "권한 수준", 912 902 "scopeOwner": "소유자", 913 913 - "scopeOwnerDesc": "전체 관리(모든 작업 수행 가능)", 914 914 - "scopeAdmin": "관리자", 915 915 - "scopeAdminDesc": "게시물, 앱 비밀번호, 설정 관리", 916 916 - "scopeEditor": "편집자", 917 917 - "scopeEditorDesc": "게시물, 좋아요, 팔로우 생성 및 관리", 918 903 "scopeViewer": "뷰어", 919 919 - "scopeViewerDesc": "저장소 및 설정 읽기 전용 액세스", 920 904 "scopeCustom": "사용자 정의", 921 921 - "scopeCustomDesc": "개별 권한 선택", 922 922 - "grantedAt": "허용 일시", 923 923 - "expiresAt": "만료", 924 924 - "noExpiration": "무기한", 925 905 "actAs": "로 활동", 926 906 "auditLog": "감사 로그", 927 907 "auditLogTitle": "위임 감사 로그", ··· 944 924 "showing": "{start}~{end} / {total}개", 945 925 "refresh": "새로고침", 946 926 "failedToLoadAuditLog": "감사 로그를 불러오지 못했습니다", 947 947 - "addControllerTitle": "컨트롤러 추가", 948 948 - "addControllerDescription": "이 계정에서 지정된 권한으로 작업할 수 있는 사용자를 추가합니다.", 949 949 - "controllerIdentifier": "컨트롤러 핸들 또는 DID", 950 950 - "selectScopes": "권한 수준 선택", 951 951 - "add": "추가", 952 927 "adding": "추가 중...", 953 953 - "cancel": "취소", 954 928 "accessLevel": "액세스 수준", 955 929 "addControllerButton": "+ 컨트롤러 추가", 956 930 "auditLogDesc": "모든 위임 활동 보기", ··· 974 948 "remove": "제거", 975 949 "removeConfirm": "이 컨트롤러를 제거하시겠습니까?", 976 950 "viewAuditLog": "감사 로그 보기", 977 977 - "yourAccessLevel": "귀하의 액세스 수준" 951 951 + "yourAccessLevel": "귀하의 액세스 수준", 952 952 + "accountCreated": "위임 계정이 생성되었습니다: {handle}" 978 953 }, 979 954 "actAs": { 980 955 "title": "로 활동",

+16 -41

frontend/src/locales/sv.json

··· 234 234 "deleting": "Raderar...", 235 235 "messages": { 236 236 "emailCodeSent": "Verifieringskod skickad till din meddelandekanal", 237 237 + "emailCodeSentToCurrent": "Verifieringskod skickad till din nuvarande e-postadress", 237 238 "emailUpdated": "E-post uppdaterad", 238 239 "emailUpdateFailed": "Kunde inte uppdatera e-post", 239 240 "handleUpdated": "Användarnamn uppdaterat", ··· 671 672 "noPending": "Ingen väntande verifiering hittades.", 672 673 "noPendingInfo": "Om du nyligen skapade ett konto och behöver verifiera det kan du behöva skapa ett nytt konto. Om du redan verifierat ditt konto kan du logga in.", 673 674 "createAccount": "Skapa konto", 674 674 - "signIn": "Logga in" 675 675 + "signIn": "Logga in", 676 676 + "backToSettings": "Tillbaka till inställningar", 677 677 + "emailUpdateCodeHelp": "Koden skickades till din nuvarande e-postadress", 678 678 + "emailUpdateFailed": "Kunde inte uppdatera e-postadress", 679 679 + "emailUpdateRequiresAuth": "Du måste vara inloggad för att uppdatera din e-postadress.", 680 680 + "emailUpdateSubtitle": "Ange din nya e-postadress och verifieringskoden som skickades till din nuvarande e-post.", 681 681 + "emailUpdateTitle": "Uppdatera e-postadress", 682 682 + "emailUpdated": "Din e-postadress har uppdaterats.", 683 683 + "emailUpdatedInfo": "Du kan behöva verifiera din nya e-postadress.", 684 684 + "newEmailLabel": "Ny e-postadress", 685 685 + "newEmailPlaceholder": "ny@exempel.se", 686 686 + "updateEmail": "Uppdatera e-post", 687 687 + "updating": "Uppdaterar..." 675 688 }, 676 689 "resetPassword": { 677 690 "title": "Återställ lösenord", ··· 754 767 "verificationMethod": "Verifieringsmetod", 755 768 "email": "E-postadress", 756 769 "emailPlaceholder": "du@exempel.se", 757 757 - "discord": "Discord", 758 758 - "discordId": "Discord användar-ID", 759 759 - "discordIdPlaceholder": "Ditt Discord användar-ID", 760 760 - "discordIdHint": "Ditt numeriska Discord användar-ID (aktivera Utvecklarläge för att hitta det)", 761 761 - "telegram": "Telegram", 762 762 - "telegramUsername": "Telegram-användarnamn", 763 763 - "telegramUsernamePlaceholder": "@dittanvändarnamn", 764 764 - "signal": "Signal", 765 765 - "signalNumber": "Signal-telefonnummer", 766 766 - "signalNumberPlaceholder": "+46701234567", 767 767 - "signalNumberHint": "Inkludera landskod (t.ex. +46 för Sverige)", 768 770 "inviteCode": "Inbjudningskod", 769 771 "inviteCodePlaceholder": "Ange din inbjudningskod", 770 770 - "inviteCodeRequired": "krävs", 771 771 - "didWebDescription": "Använd en DID-identitet som är lagrad på din egen domän.", 772 772 - "didWebToggle": "Använd extern did:web", 773 772 "externalDid": "Din did:web", 774 773 "externalDidPlaceholder": "did:web:dindomän.se", 775 775 - "dnsVerificationInstructions": "För att verifiera din domän, lägg till denna TXT-post:", 776 776 - "copyDid": "Kopiera DID", 777 774 "createButton": "Skapa konto", 778 775 "creating": "Skapar...", 779 776 "alreadyHaveAccount": "Har du redan ett konto?", ··· 896 893 "delegation": { 897 894 "title": "Kontodelegering", 898 895 "controllers": "Kontrollanter", 899 899 - "controllersDescription": "Kontrollanter kan agera som administratörer för ditt konto. De kan utföra åtgärder du tillåter, skapa inlägg för din räkning och modifiera din dataförvaring.", 900 896 "controlledAccounts": "Kontrollerade konton", 901 901 - "controlledAccountsDescription": "Detta är konton där du har lagts till som kontrollant. Du kan utföra tillåtna åtgärder på dessa konton.", 902 897 "noControllers": "Inga kontrollanter ännu", 903 898 "noControlledAccounts": "Inga kontrollerade konton", 904 899 "addController": "Lägg till kontrollant", 905 905 - "revokeAccess": "Återkalla åtkomst", 906 906 - "revokeConfirm": "Återkalla denna kontrollants åtkomst? De kommer inte längre kunna utföra åtgärder på ditt konto.", 907 900 "handle": "Användarnamn", 908 908 - "handlePlaceholder": "@user.bsky.social", 909 901 "did": "DID", 910 910 - "didPlaceholder": "did:plc:...", 911 911 - "scopes": "Behörighetsnivå", 912 902 "scopeOwner": "Ägare", 913 913 - "scopeOwnerDesc": "Fullständig kontroll (kan utföra alla åtgärder)", 914 914 - "scopeAdmin": "Administratör", 915 915 - "scopeAdminDesc": "Hantera inlägg, applösenord, inställningar", 916 916 - "scopeEditor": "Redaktör", 917 917 - "scopeEditorDesc": "Skapa och hantera inlägg, gillningar, följningar", 918 903 "scopeViewer": "Läsare", 919 919 - "scopeViewerDesc": "Endast läsåtkomst till dataförvaring och inställningar", 920 904 "scopeCustom": "Anpassad", 921 921 - "scopeCustomDesc": "Välj individuella behörigheter", 922 922 - "grantedAt": "Beviljad", 923 923 - "expiresAt": "Upphör", 924 924 - "noExpiration": "Ingen utgång", 925 905 "actAs": "Agera som", 926 906 "auditLog": "Granskningslogg", 927 907 "auditLogTitle": "Delegerings-granskningslogg", ··· 944 924 "showing": "{start}–{end} av {total}", 945 925 "refresh": "Uppdatera", 946 926 "failedToLoadAuditLog": "Kunde inte ladda granskningsloggen", 947 947 - "addControllerTitle": "Lägg till kontrollant", 948 948 - "addControllerDescription": "Lägg till en användare som kan utföra åtgärder på detta konto med specificerade behörigheter.", 949 949 - "controllerIdentifier": "Kontrollantens användarnamn eller DID", 950 950 - "selectScopes": "Välj behörighetsnivå", 951 951 - "add": "Lägg till", 952 927 "adding": "Lägger till...", 953 953 - "cancel": "Avbryt", 954 928 "accessLevel": "Åtkomstnivå", 955 929 "addControllerButton": "+ Lägg till kontrollant", 956 930 "auditLogDesc": "Visa all delegeringsaktivitet", ··· 974 948 "remove": "Ta bort", 975 949 "removeConfirm": "Vill du ta bort denna kontrollant?", 976 950 "viewAuditLog": "Visa granskningslogg", 977 977 - "yourAccessLevel": "Din åtkomstnivå" 951 951 + "yourAccessLevel": "Din åtkomstnivå", 952 952 + "accountCreated": "Skapade delegerat konto: {handle}" 978 953 }, 979 954 "actAs": { 980 955 "title": "Agera som",

+16 -25

frontend/src/locales/zh.json

··· 234 234 "deleting": "删除中...", 235 235 "messages": { 236 236 "emailCodeSent": "验证码已发送到您的通知渠道", 237 237 + "emailCodeSentToCurrent": "验证码已发送到您当前的邮箱地址", 237 238 "emailUpdated": "邮箱更新成功", 238 239 "emailUpdateFailed": "邮箱更新失败", 239 240 "handleUpdated": "用户名更新成功", ··· 671 672 "continue": "继续", 672 673 "identifierLabel": "邮箱或标识符", 673 674 "identifierPlaceholder": "you@example.com", 674 674 - "identifierHelp": "接收验证码的邮箱地址或标识符" 675 675 + "identifierHelp": "接收验证码的邮箱地址或标识符", 676 676 + "backToSettings": "返回设置", 677 677 + "emailUpdateCodeHelp": "验证码已发送到您当前的邮箱地址", 678 678 + "emailUpdateFailed": "更新邮箱地址失败", 679 679 + "emailUpdateRequiresAuth": "您需要登录才能更新邮箱地址。", 680 680 + "emailUpdateSubtitle": "输入您的新邮箱地址和发送到当前邮箱的验证码。", 681 681 + "emailUpdateTitle": "更新邮箱地址", 682 682 + "emailUpdated": "您的邮箱地址已成功更新。", 683 683 + "emailUpdatedInfo": "您可能需要验证新的邮箱地址。", 684 684 + "newEmailLabel": "新邮箱地址", 685 685 + "newEmailPlaceholder": "new@example.com", 686 686 + "updateEmail": "更新邮箱", 687 687 + "updating": "更新中..." 675 688 }, 676 689 "resetPassword": { 677 690 "title": "重置密码", ··· 821 834 "passkeysNotSupported": "此浏览器不支持通行密钥。请使用其他浏览器或使用密码注册。", 822 835 "passkeyCancelled": "通行密钥创建已取消", 823 836 "passkeyFailed": "通行密钥注册失败" 824 824 - } 837 837 + }, 838 838 + "didWebWarning1Detail": "您的身份将是 {did}。" 825 839 }, 826 840 "trustedDevices": { 827 841 "title": "受信任设备", ··· 879 893 "delegation": { 880 894 "title": "账户委托", 881 895 "controllers": "控制者", 882 882 - "controllersDescription": "控制者可以作为您账户的管理员。他们可以执行您允许的操作，代表您发布帖子，以及修改您的数据仓库。", 883 896 "controlledAccounts": "受控账户", 884 884 - "controlledAccountsDescription": "这些是您被添加为控制者的账户。您可以在这些账户上执行允许的操作。", 885 897 "noControllers": "暂无控制者", 886 898 "noControlledAccounts": "无受控账户", 887 899 "addController": "添加控制者", 888 888 - "revokeAccess": "撤销访问", 889 889 - "revokeConfirm": "撤销此控制者的访问权限？他们将无法再在您的账户上执行操作。", 890 900 "handle": "用户名", 891 891 - "handlePlaceholder": "@user.bsky.social", 892 901 "did": "DID", 893 893 - "didPlaceholder": "did:plc:...", 894 894 - "scopes": "权限级别", 895 902 "scopeOwner": "所有者", 896 896 - "scopeOwnerDesc": "完全控制（可执行所有操作）", 897 897 - "scopeAdmin": "管理员", 898 898 - "scopeAdminDesc": "管理帖子、应用专用密码、设置", 899 899 - "scopeEditor": "编辑者", 900 900 - "scopeEditorDesc": "创建和管理帖子、点赞、关注", 901 903 "scopeViewer": "查看者", 902 902 - "scopeViewerDesc": "只读访问数据仓库和设置", 903 904 "scopeCustom": "自定义", 904 904 - "scopeCustomDesc": "选择单独的权限", 905 905 - "grantedAt": "授权时间", 906 906 - "expiresAt": "过期时间", 907 907 - "noExpiration": "永不过期", 908 905 "actAs": "代理操作", 909 906 "auditLog": "审计日志", 910 907 "auditLogTitle": "委托审计日志", ··· 928 925 "showing": "{start}–{end} / 共{total}条", 929 926 "refresh": "刷新", 930 927 "failedToLoadAuditLog": "加载审计日志失败", 931 931 - "addControllerTitle": "添加控制者", 932 932 - "addControllerDescription": "添加一个可以在此账户上执行指定权限操作的用户。", 933 933 - "controllerIdentifier": "控制者用户名或 DID", 934 934 - "selectScopes": "选择权限级别", 935 935 - "add": "添加", 936 928 "adding": "添加中...", 937 937 - "cancel": "取消", 938 929 "accessLevel": "访问级别", 939 930 "addControllerButton": "+ 添加控制者", 940 931 "auditLogDesc": "查看所有委托活动",

+17 -23

frontend/src/routes/Settings.svelte

··· 56 56 if (message?.text === text) message = null 57 57 }, 5000) 58 58 } 59 59 - async function handleRequestEmailUpdate(e: Event) { 60 60 - e.preventDefault() 61 61 - if (!auth.session || !newEmail) return 59 59 + async function handleRequestEmailUpdate() { 60 60 + if (!auth.session) return 62 61 emailLoading = true 63 62 message = null 64 63 try { 65 65 - const result = await api.requestEmailUpdate(auth.session.accessJwt, newEmail) 64 64 + const result = await api.requestEmailUpdate(auth.session.accessJwt) 66 65 emailTokenRequired = result.tokenRequired 67 66 if (emailTokenRequired) { 68 68 - showMessage('success', $_('settings.messages.emailCodeSent')) 67 67 + showMessage('success', $_('settings.messages.emailCodeSentToCurrent')) 69 68 } else { 70 70 - await api.updateEmail(auth.session.accessJwt, newEmail) 71 71 - await refreshSession() 72 72 - showMessage('success', $_('settings.messages.emailUpdated')) 73 73 - newEmail = '' 69 69 + emailTokenRequired = true 74 70 } 75 71 } catch (e) { 76 72 showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.emailUpdateFailed')) ··· 244 240 required 245 241 /> 246 242 </div> 247 247 - <div class="actions"> 248 248 - <button type="submit" disabled={emailLoading || !emailToken}> 249 249 - {emailLoading ? $_('settings.updating') : $_('settings.confirmEmailChange')} 250 250 - </button> 251 251 - <button type="button" class="secondary" onclick={() => { emailTokenRequired = false; emailToken = '' }}> 252 252 - {$_('common.cancel')} 253 253 - </button> 254 254 - </div> 255 255 - </form> 256 256 - {:else} 257 257 - <form onsubmit={handleRequestEmailUpdate}> 258 243 <div class="field"> 259 244 <label for="new-email">{$_('settings.newEmail')}</label> 260 245 <input ··· 266 251 required 267 252 /> 268 253 </div> 269 269 - <button type="submit" disabled={emailLoading || !newEmail}> 270 270 - {emailLoading ? $_('settings.requesting') : $_('settings.changeEmailButton')} 271 271 - </button> 254 254 + <div class="actions"> 255 255 + <button type="submit" disabled={emailLoading || !emailToken || !newEmail}> 256 256 + {emailLoading ? $_('settings.updating') : $_('settings.confirmEmailChange')} 257 257 + </button> 258 258 + <button type="button" class="secondary" onclick={() => { emailTokenRequired = false; emailToken = ''; newEmail = '' }}> 259 259 + {$_('common.cancel')} 260 260 + </button> 261 261 + </div> 272 262 </form> 263 263 + {:else} 264 264 + <button onclick={handleRequestEmailUpdate} disabled={emailLoading}> 265 265 + {emailLoading ? $_('settings.requesting') : $_('settings.changeEmailButton')} 266 266 + </button> 273 267 {/if} 274 268 </section> 275 269 <section>

+94 -3

frontend/src/routes/Verify.svelte

··· 13 13 channel: string 14 14 } 15 15 16 16 - type VerificationMode = 'signup' | 'token' 16 16 + type VerificationMode = 'signup' | 'token' | 'email-update' 17 17 18 18 let mode = $state<VerificationMode>('signup') 19 19 + let newEmail = $state('') 19 20 let pendingVerification = $state<PendingVerification | null>(null) 20 21 let verificationCode = $state('') 21 22 let identifier = $state('') ··· 50 51 onMount(async () => { 51 52 const params = parseQueryParams() 52 53 53 53 - if (params.token) { 54 54 + if (params.type === 'email-update') { 55 55 + mode = 'email-update' 56 56 + if (params.token) { 57 57 + verificationCode = params.token 58 58 + } 59 59 + } else if (params.token) { 54 60 mode = 'token' 55 61 verificationCode = params.token 56 62 if (params.identifier) { ··· 134 140 } 135 141 } 136 142 143 143 + async function handleEmailUpdate() { 144 144 + if (!verificationCode.trim() || !newEmail.trim()) return 145 145 + 146 146 + if (!auth.session) { 147 147 + error = $_('verify.emailUpdateRequiresAuth') 148 148 + return 149 149 + } 150 150 + 151 151 + submitting = true 152 152 + error = null 153 153 + 154 154 + try { 155 155 + await api.updateEmail(auth.session.accessJwt, newEmail.trim(), verificationCode.trim()) 156 156 + success = true 157 157 + successPurpose = 'email-update' 158 158 + successChannel = 'email' 159 159 + } catch (e: any) { 160 160 + if (e instanceof ApiError) { 161 161 + error = e.message 162 162 + } else { 163 163 + error = $_('verify.emailUpdateFailed') 164 164 + } 165 165 + } finally { 166 166 + submitting = false 167 167 + } 168 168 + } 169 169 + 137 170 async function handleResendCode() { 138 171 if (mode === 'signup') { 139 172 if (!pendingVerification || resendingCode) return ··· 198 231 {:else if success} 199 232 <div class="success-container"> 200 233 <h1>{$_('verify.verified')}</h1> 201 201 - {#if successPurpose === 'migration' || successPurpose === 'signup'} 234 234 + {#if successPurpose === 'email-update'} 235 235 + <p class="subtitle">{$_('verify.emailUpdated')}</p> 236 236 + <p class="info-text">{$_('verify.emailUpdatedInfo')}</p> 237 237 + <div class="actions"> 238 238 + <a href="#/settings" class="btn">{$_('verify.backToSettings')}</a> 239 239 + </div> 240 240 + {:else if successPurpose === 'migration' || successPurpose === 'signup'} 202 241 <p class="subtitle">{$_('verify.channelVerified', { values: { channel: channelLabel(successChannel || '') } })}</p> 203 242 <p class="info-text">{$_('verify.canNowSignIn')}</p> 204 243 <div class="actions"> ··· 213 252 </div> 214 253 {/if} 215 254 </div> 255 255 + {:else if mode === 'email-update'} 256 256 + <h1>{$_('verify.emailUpdateTitle')}</h1> 257 257 + <p class="subtitle">{$_('verify.emailUpdateSubtitle')}</p> 258 258 + 259 259 + {#if !auth.session} 260 260 + <div class="message warning">{$_('verify.emailUpdateRequiresAuth')}</div> 261 261 + <div class="actions"> 262 262 + <a href="#/login" class="btn">{$_('verify.signIn')}</a> 263 263 + </div> 264 264 + {:else} 265 265 + {#if error} 266 266 + <div class="message error">{error}</div> 267 267 + {/if} 268 268 + 269 269 + <form onsubmit={(e) => { e.preventDefault(); handleEmailUpdate(); }}> 270 270 + <div class="field"> 271 271 + <label for="new-email">{$_('verify.newEmailLabel')}</label> 272 272 + <input 273 273 + id="new-email" 274 274 + type="email" 275 275 + bind:value={newEmail} 276 276 + placeholder={$_('verify.newEmailPlaceholder')} 277 277 + disabled={submitting} 278 278 + required 279 279 + autocomplete="email" 280 280 + /> 281 281 + </div> 282 282 + 283 283 + <div class="field"> 284 284 + <label for="verification-code">{$_('verify.codeLabel')}</label> 285 285 + <input 286 286 + id="verification-code" 287 287 + type="text" 288 288 + bind:value={verificationCode} 289 289 + placeholder={$_('verify.codePlaceholder')} 290 290 + disabled={submitting} 291 291 + required 292 292 + autocomplete="off" 293 293 + class="token-input" 294 294 + /> 295 295 + <p class="field-help">{$_('verify.emailUpdateCodeHelp')}</p> 296 296 + </div> 297 297 + 298 298 + <button type="submit" disabled={submitting || !verificationCode.trim() || !newEmail.trim()}> 299 299 + {submitting ? $_('verify.updating') : $_('verify.updateEmail')} 300 300 + </button> 301 301 + </form> 302 302 + 303 303 + <p class="link-text"> 304 304 + <a href="#/settings">{$_('verify.backToSettings')}</a> 305 305 + </p> 306 306 + {/if} 216 307 {:else if mode === 'token'} 217 308 <h1>{$_('verify.tokenTitle')}</h1> 218 309 <p class="subtitle">{$_('verify.tokenSubtitle')}</p>

+200 -175

src/api/server/email.rs

··· 1 1 use crate::api::ApiError; 2 2 + use crate::auth::BearerAuth; 2 3 use crate::state::{AppState, RateLimitKind}; 3 4 use axum::{ 4 5 Json, ··· 10 11 use serde_json::json; 11 12 use tracing::{error, info, warn}; 12 13 13 13 - #[derive(Deserialize)] 14 14 - #[serde(rename_all = "camelCase")] 15 15 - pub struct RequestEmailUpdateInput { 16 16 - pub email: String, 17 17 - } 18 18 - 19 14 pub async fn request_email_update( 20 15 State(state): State<AppState>, 21 16 headers: axum::http::HeaderMap, 22 22 - Json(input): Json<RequestEmailUpdateInput>, 17 17 + auth: BearerAuth, 23 18 ) -> Response { 24 19 let client_ip = crate::rate_limit::extract_client_ip(&headers, None); 25 20 if !state ··· 37 32 .into_response(); 38 33 } 39 34 40 40 - let token = match crate::auth::extract_bearer_token_from_header( 41 41 - headers.get("Authorization").and_then(|h| h.to_str().ok()), 42 42 - ) { 43 43 - Some(t) => t, 44 44 - None => { 45 45 - return ( 46 46 - StatusCode::UNAUTHORIZED, 47 47 - Json(json!({"error": "AuthenticationRequired"})), 48 48 - ) 49 49 - .into_response(); 50 50 - } 51 51 - }; 52 52 - 53 53 - let auth_result = crate::auth::validate_bearer_token(&state.db, &token).await; 54 54 - let auth_user = match auth_result { 55 55 - Ok(user) => user, 56 56 - Err(e) => return ApiError::from(e).into_response(), 57 57 - }; 58 58 - 59 35 if let Err(e) = crate::auth::scope_check::check_account_scope( 60 60 - auth_user.is_oauth, 61 61 - auth_user.scope.as_deref(), 36 36 + auth.0.is_oauth, 37 37 + auth.0.scope.as_deref(), 62 38 crate::oauth::scopes::AccountAttr::Email, 63 39 crate::oauth::scopes::AccountAction::Manage, 64 40 ) { 65 41 return e; 66 42 } 67 43 68 68 - let did = auth_user.did.clone(); 69 69 - let user = match sqlx::query!("SELECT id, handle, email FROM users WHERE did = $1", did) 70 70 - .fetch_optional(&state.db) 71 71 - .await 44 44 + let did = auth.0.did.clone(); 45 45 + let user = match sqlx::query!( 46 46 + "SELECT id, handle, email, email_verified FROM users WHERE did = $1", 47 47 + did 48 48 + ) 49 49 + .fetch_optional(&state.db) 50 50 + .await 72 51 { 73 52 Ok(Some(row)) => row, 74 74 - _ => { 53 53 + Ok(None) => { 54 54 + return ( 55 55 + StatusCode::BAD_REQUEST, 56 56 + Json(json!({"error": "InvalidRequest", "message": "account not found"})), 57 57 + ) 58 58 + .into_response(); 59 59 + } 60 60 + Err(e) => { 61 61 + error!("DB error: {:?}", e); 75 62 return ( 76 63 StatusCode::INTERNAL_SERVER_ERROR, 77 64 Json(json!({"error": "InternalError"})), ··· 80 67 } 81 68 }; 82 69 83 83 - let user_id = user.id; 84 84 - let handle = user.handle; 85 85 - let current_email = user.email; 86 86 - let email = input.email.trim().to_lowercase(); 70 70 + let current_email: String = match user.email { 71 71 + Some(e) => e, 72 72 + None => { 73 73 + return ( 74 74 + StatusCode::BAD_REQUEST, 75 75 + Json(json!({"error": "InvalidRequest", "message": "account does not have an email address"})), 76 76 + ) 77 77 + .into_response(); 78 78 + } 79 79 + }; 87 80 88 88 - if !crate::api::validation::is_valid_email(&email) { 89 89 - return ( 90 90 - StatusCode::BAD_REQUEST, 91 91 - Json(json!({"error": "InvalidEmail", "message": "Invalid email format"})), 92 92 - ) 93 93 - .into_response(); 94 94 - } 81 81 + let token_required = user.email_verified; 95 82 96 96 - if current_email.as_ref().map(|e| e.to_lowercase()) == Some(email.clone()) { 97 97 - return (StatusCode::OK, Json(json!({ "tokenRequired": false }))).into_response(); 98 98 - } 99 99 - 100 100 - let exists = sqlx::query!( 101 101 - "SELECT 1 as one FROM users WHERE LOWER(email) = $1 AND id != $2", 102 102 - email, 103 103 - user_id 104 104 - ) 105 105 - .fetch_optional(&state.db) 106 106 - .await; 107 107 - 108 108 - if let Ok(Some(_)) = exists { 109 109 - return ( 110 110 - StatusCode::BAD_REQUEST, 111 111 - Json(json!({"error": "EmailTaken", "message": "Email already taken"})), 112 112 - ) 113 113 - .into_response(); 114 114 - } 83 83 + if token_required { 84 84 + let code = crate::auth::verification_token::generate_channel_update_token( 85 85 + &did, 86 86 + "email_update", 87 87 + &current_email.to_lowercase(), 88 88 + ); 89 89 + let formatted_code = 90 90 + crate::auth::verification_token::format_token_for_display(&code); 115 91 116 116 - if let Err(e) = crate::api::notification_prefs::request_channel_verification( 117 117 - &state.db, 118 118 - user_id, 119 119 - &did, 120 120 - "email", 121 121 - &email, 122 122 - Some(&handle), 123 123 - ) 124 124 - .await 125 125 - { 126 126 - error!("Failed to request email verification: {}", e); 127 127 - return ( 128 128 - StatusCode::INTERNAL_SERVER_ERROR, 129 129 - Json(json!({"error": "InternalError"})), 92 92 + let hostname = 93 93 + std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string()); 94 94 + if let Err(e) = crate::comms::enqueue_email_update_token( 95 95 + &state.db, 96 96 + user.id, 97 97 + &formatted_code, 98 98 + &hostname, 130 99 ) 131 131 - .into_response(); 100 100 + .await 101 101 + { 102 102 + warn!("Failed to enqueue email update notification: {:?}", e); 103 103 + } 132 104 } 133 105 134 134 - info!("Email update requested for user {}", user_id); 135 135 - (StatusCode::OK, Json(json!({ "tokenRequired": true }))).into_response() 106 106 + info!("Email update requested for user {}", user.id); 107 107 + (StatusCode::OK, Json(json!({ "tokenRequired": token_required }))).into_response() 136 108 } 137 109 138 110 #[derive(Deserialize)] ··· 145 117 pub async fn confirm_email( 146 118 State(state): State<AppState>, 147 119 headers: axum::http::HeaderMap, 120 120 + auth: BearerAuth, 148 121 Json(input): Json<ConfirmEmailInput>, 149 122 ) -> Response { 150 123 let client_ip = crate::rate_limit::extract_client_ip(&headers, None); 151 124 if !state 152 152 - .check_rate_limit(RateLimitKind::AppPassword, &client_ip) 125 125 + .check_rate_limit(RateLimitKind::EmailUpdate, &client_ip) 153 126 .await 154 127 { 155 128 warn!(ip = %client_ip, "Confirm email rate limit exceeded"); ··· 163 136 .into_response(); 164 137 } 165 138 166 166 - let token = match crate::auth::extract_bearer_token_from_header( 167 167 - headers.get("Authorization").and_then(|h| h.to_str().ok()), 168 168 - ) { 169 169 - Some(t) => t, 170 170 - None => { 171 171 - return ( 172 172 - StatusCode::UNAUTHORIZED, 173 173 - Json(json!({"error": "AuthenticationRequired"})), 174 174 - ) 175 175 - .into_response(); 176 176 - } 177 177 - }; 178 178 - 179 179 - let auth_result = crate::auth::validate_bearer_token(&state.db, &token).await; 180 180 - let auth_user = match auth_result { 181 181 - Ok(user) => user, 182 182 - Err(e) => return ApiError::from(e).into_response(), 183 183 - }; 184 184 - 185 139 if let Err(e) = crate::auth::scope_check::check_account_scope( 186 186 - auth_user.is_oauth, 187 187 - auth_user.scope.as_deref(), 140 140 + auth.0.is_oauth, 141 141 + auth.0.scope.as_deref(), 188 142 crate::oauth::scopes::AccountAttr::Email, 189 143 crate::oauth::scopes::AccountAction::Manage, 190 144 ) { 191 145 return e; 192 146 } 193 147 194 194 - let did = auth_user.did; 195 195 - let user_id = match sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did) 196 196 - .fetch_one(&state.db) 197 197 - .await 148 148 + let did = auth.0.did; 149 149 + let user = match sqlx::query!( 150 150 + "SELECT id, email, email_verified FROM users WHERE did = $1", 151 151 + did 152 152 + ) 153 153 + .fetch_optional(&state.db) 154 154 + .await 198 155 { 199 199 - Ok(id) => id, 200 200 - Err(_) => { 156 156 + Ok(Some(row)) => row, 157 157 + Ok(None) => { 158 158 + return ( 159 159 + StatusCode::BAD_REQUEST, 160 160 + Json(json!({"error": "AccountNotFound", "message": "user not found"})), 161 161 + ) 162 162 + .into_response(); 163 163 + } 164 164 + Err(e) => { 165 165 + error!("DB error: {:?}", e); 201 166 return ( 202 167 StatusCode::INTERNAL_SERVER_ERROR, 203 168 Json(json!({"error": "InternalError"})), ··· 206 171 } 207 172 }; 208 173 209 209 - let email = input.email.trim().to_lowercase(); 174 174 + let current_email = match &user.email { 175 175 + Some(e) => e.to_lowercase(), 176 176 + None => { 177 177 + return ( 178 178 + StatusCode::BAD_REQUEST, 179 179 + Json(json!({"error": "InvalidEmail", "message": "account does not have an email address"})), 180 180 + ) 181 181 + .into_response(); 182 182 + } 183 183 + }; 184 184 + 185 185 + let provided_email = input.email.trim().to_lowercase(); 186 186 + if provided_email != current_email { 187 187 + return ( 188 188 + StatusCode::BAD_REQUEST, 189 189 + Json(json!({"error": "InvalidEmail", "message": "invalid email"})), 190 190 + ) 191 191 + .into_response(); 192 192 + } 193 193 + 194 194 + if user.email_verified { 195 195 + return (StatusCode::OK, Json(json!({}))).into_response(); 196 196 + } 197 197 + 210 198 let confirmation_code = 211 199 crate::auth::verification_token::normalize_token_input(input.token.trim()); 212 200 213 213 - let verified = crate::auth::verification_token::verify_channel_update_token( 201 201 + let verified = crate::auth::verification_token::verify_signup_token( 214 202 &confirmation_code, 215 203 "email", 216 216 - &email, 204 204 + &provided_email, 217 205 ); 218 206 219 207 match verified { ··· 245 233 } 246 234 247 235 let update = sqlx::query!( 248 248 - "UPDATE users SET email = $1, email_verified = TRUE, updated_at = NOW() WHERE id = $2", 249 249 - email, 250 250 - user_id 236 236 + "UPDATE users SET email_verified = TRUE, updated_at = NOW() WHERE id = $1", 237 237 + user.id 251 238 ) 252 239 .execute(&state.db) 253 240 .await; 254 241 255 242 if let Err(e) = update { 256 256 - error!("DB error finalizing email update: {:?}", e); 257 257 - if e.as_database_error() 258 258 - .map(|db_err| db_err.is_unique_violation()) 259 259 - .unwrap_or(false) 260 260 - { 261 261 - return ( 262 262 - StatusCode::BAD_REQUEST, 263 263 - Json(json!({"error": "EmailTaken", "message": "Email already taken"})), 264 264 - ) 265 265 - .into_response(); 266 266 - } 243 243 + error!("DB error confirming email: {:?}", e); 267 244 return ( 268 245 StatusCode::INTERNAL_SERVER_ERROR, 269 246 Json(json!({"error": "InternalError"})), ··· 271 248 .into_response(); 272 249 } 273 250 274 274 - info!("Email updated for user {}", user_id); 251 251 + info!("Email confirmed for user {}", user.id); 275 252 (StatusCode::OK, Json(json!({}))).into_response() 276 253 } 277 254 ··· 289 266 headers: axum::http::HeaderMap, 290 267 Json(input): Json<UpdateEmailInput>, 291 268 ) -> Response { 292 292 - let token = match crate::auth::extract_bearer_token_from_header( 269 269 + let bearer_token = match crate::auth::extract_bearer_token_from_header( 293 270 headers.get("Authorization").and_then(|h| h.to_str().ok()), 294 271 ) { 295 272 Some(t) => t, ··· 302 279 } 303 280 }; 304 281 305 305 - let auth_result = crate::auth::validate_bearer_token(&state.db, &token).await; 282 282 + let auth_result = crate::auth::validate_bearer_token(&state.db, &bearer_token).await; 306 283 let auth_user = match auth_result { 307 284 Ok(user) => user, 308 285 Err(e) => return ApiError::from(e).into_response(), ··· 318 295 } 319 296 320 297 let did = auth_user.did; 321 321 - let user = match sqlx::query!("SELECT id, email FROM users WHERE did = $1", did) 322 322 - .fetch_optional(&state.db) 323 323 - .await 298 298 + let user = match sqlx::query!( 299 299 + "SELECT id, email, email_verified FROM users WHERE did = $1", 300 300 + did 301 301 + ) 302 302 + .fetch_optional(&state.db) 303 303 + .await 324 304 { 325 305 Ok(Some(row)) => row, 326 326 - _ => { 306 306 + Ok(None) => { 307 307 + return ( 308 308 + StatusCode::BAD_REQUEST, 309 309 + Json(json!({"error": "InvalidRequest", "message": "account not found"})), 310 310 + ) 311 311 + .into_response(); 312 312 + } 313 313 + Err(e) => { 314 314 + error!("DB error: {:?}", e); 327 315 return ( 328 316 StatusCode::INTERNAL_SERVER_ERROR, 329 317 Json(json!({"error": "InternalError"})), ··· 333 321 }; 334 322 335 323 let user_id = user.id; 336 336 - let current_email = user.email; 324 324 + let current_email = user.email.clone(); 325 325 + let email_verified = user.email_verified; 337 326 let new_email = input.email.trim().to_lowercase(); 338 327 339 328 if !crate::api::validation::is_valid_email(&new_email) { 340 329 return ( 341 330 StatusCode::BAD_REQUEST, 342 342 - Json(json!({"error": "InvalidEmail", "message": "Invalid email format"})), 331 331 + Json(json!({ 332 332 + "error": "InvalidRequest", 333 333 + "message": "This email address is not supported, please use a different email." 334 334 + })), 343 335 ) 344 336 .into_response(); 345 337 } ··· 350 342 return (StatusCode::OK, Json(json!({}))).into_response(); 351 343 } 352 344 353 353 - let confirmation_token = match &input.token { 354 354 - Some(t) => crate::auth::verification_token::normalize_token_input(t.trim()), 355 355 - None => { 356 356 - return ( 357 357 - StatusCode::BAD_REQUEST, 358 358 - Json(json!({"error": "TokenRequired", "message": "Token required. Call requestEmailUpdate first."})), 359 359 - ) 360 360 - .into_response(); 361 361 - } 362 362 - }; 345 345 + if email_verified { 346 346 + let confirmation_token = match &input.token { 347 347 + Some(t) => crate::auth::verification_token::normalize_token_input(t.trim()), 348 348 + None => { 349 349 + return ( 350 350 + StatusCode::BAD_REQUEST, 351 351 + Json(json!({ 352 352 + "error": "TokenRequired", 353 353 + "message": "confirmation token required" 354 354 + })), 355 355 + ) 356 356 + .into_response(); 357 357 + } 358 358 + }; 359 359 + 360 360 + let current_email_lower = current_email 361 361 + .as_ref() 362 362 + .map(|e| e.to_lowercase()) 363 363 + .unwrap_or_default(); 363 364 364 364 - let verified = crate::auth::verification_token::verify_channel_update_token( 365 365 - &confirmation_token, 366 366 - "email", 367 367 - &new_email, 368 368 - ); 365 365 + let verified = crate::auth::verification_token::verify_channel_update_token( 366 366 + &confirmation_token, 367 367 + "email_update", 368 368 + &current_email_lower, 369 369 + ); 369 370 370 370 - match verified { 371 371 - Ok(token_data) => { 372 372 - if token_data.did != did { 371 371 + match verified { 372 372 + Ok(token_data) => { 373 373 + if token_data.did != did { 374 374 + return ( 375 375 + StatusCode::BAD_REQUEST, 376 376 + Json( 377 377 + json!({"error": "InvalidToken", "message": "Token does not match account"}), 378 378 + ), 379 379 + ) 380 380 + .into_response(); 381 381 + } 382 382 + } 383 383 + Err(crate::auth::verification_token::VerifyError::Expired) => { 384 384 + return ( 385 385 + StatusCode::BAD_REQUEST, 386 386 + Json(json!({"error": "ExpiredToken", "message": "Token has expired"})), 387 387 + ) 388 388 + .into_response(); 389 389 + } 390 390 + Err(_) => { 373 391 return ( 374 392 StatusCode::BAD_REQUEST, 375 375 - Json( 376 376 - json!({"error": "InvalidToken", "message": "Token does not match account"}), 377 377 - ), 393 393 + Json(json!({"error": "InvalidToken", "message": "Invalid token"})), 378 394 ) 379 395 .into_response(); 380 396 } 381 397 } 382 382 - Err(crate::auth::verification_token::VerifyError::Expired) => { 383 383 - return ( 384 384 - StatusCode::BAD_REQUEST, 385 385 - Json(json!({"error": "ExpiredToken", "message": "Token has expired"})), 386 386 - ) 387 387 - .into_response(); 388 388 - } 389 389 - Err(_) => { 390 390 - return ( 391 391 - StatusCode::BAD_REQUEST, 392 392 - Json(json!({"error": "InvalidToken", "message": "Invalid token"})), 393 393 - ) 394 394 - .into_response(); 395 395 - } 396 398 } 397 399 398 400 let exists = sqlx::query!( ··· 406 408 if let Ok(Some(_)) = exists { 407 409 return ( 408 410 StatusCode::BAD_REQUEST, 409 409 - Json(json!({"error": "InvalidRequest", "message": "Email already in use"})), 411 411 + Json(json!({ 412 412 + "error": "InvalidRequest", 413 413 + "message": "This email address is already in use, please use a different email." 414 414 + })), 410 415 ) 411 416 .into_response(); 412 417 } 413 418 414 414 - let update = sqlx::query!( 415 415 - "UPDATE users SET email = $1, email_verified = TRUE, updated_at = NOW() WHERE id = $2", 419 419 + let update: Result<sqlx::postgres::PgQueryResult, sqlx::Error> = sqlx::query!( 420 420 + "UPDATE users SET email = $1, email_verified = FALSE, updated_at = NOW() WHERE id = $2", 416 421 new_email, 417 422 user_id 418 423 ) ··· 420 425 .await; 421 426 422 427 if let Err(e) = update { 423 423 - error!("DB error finalizing email update: {:?}", e); 428 428 + error!("DB error updating email: {:?}", e); 424 429 if e.as_database_error() 425 425 - .map(|db_err| db_err.is_unique_violation()) 430 430 + .map(|db_err: &dyn sqlx::error::DatabaseError| db_err.is_unique_violation()) 426 431 .unwrap_or(false) 427 432 { 428 433 return ( 429 434 StatusCode::BAD_REQUEST, 430 430 - Json(json!({"error": "InvalidRequest", "message": "Email already in use"})), 435 435 + Json(json!({ 436 436 + "error": "InvalidRequest", 437 437 + "message": "This email address is already in use, please use a different email." 438 438 + })), 431 439 ) 432 440 .into_response(); 433 441 } ··· 436 444 Json(json!({"error": "InternalError"})), 437 445 ) 438 446 .into_response(); 447 447 + } 448 448 + 449 449 + let verification_token = 450 450 + crate::auth::verification_token::generate_signup_token(&did, "email", &new_email); 451 451 + let formatted_token = 452 452 + crate::auth::verification_token::format_token_for_display(&verification_token); 453 453 + if let Err(e) = crate::comms::enqueue_signup_verification( 454 454 + &state.db, 455 455 + user_id, 456 456 + "email", 457 457 + &new_email, 458 458 + &formatted_token, 459 459 + None, 460 460 + ) 461 461 + .await 462 462 + { 463 463 + warn!("Failed to send verification email to new address: {:?}", e); 439 464 } 440 465 441 466 match sqlx::query!(

+3 -3

src/comms/mod.rs

··· 10 10 11 11 pub use service::{ 12 12 CommsService, channel_display_name, enqueue_2fa_code, enqueue_account_deletion, enqueue_comms, 13 13 - enqueue_email_update, enqueue_migration_verification, enqueue_passkey_recovery, 14 14 - enqueue_password_reset, enqueue_plc_operation, enqueue_signup_verification, enqueue_welcome, 15 15 - queue_legacy_login_notification, 13 13 + enqueue_email_update, enqueue_email_update_token, enqueue_migration_verification, 14 14 + enqueue_passkey_recovery, enqueue_password_reset, enqueue_plc_operation, 15 15 + enqueue_signup_verification, enqueue_welcome, queue_legacy_login_notification, 16 16 }; 17 17 18 18 pub use types::{CommsChannel, CommsStatus, CommsType, NewComms, QueuedComms};

+38

src/comms/service.rs

··· 380 380 .await 381 381 } 382 382 383 383 + pub async fn enqueue_email_update_token( 384 384 + db: &PgPool, 385 385 + user_id: Uuid, 386 386 + code: &str, 387 387 + hostname: &str, 388 388 + ) -> Result<Uuid, sqlx::Error> { 389 389 + let prefs = get_user_comms_prefs(db, user_id).await?; 390 390 + let strings = get_strings(&prefs.locale); 391 391 + let current_email = prefs.email.clone().unwrap_or_default(); 392 392 + let verify_page = format!("https://{}/#/verify?type=email-update", hostname); 393 393 + let verify_link = format!( 394 394 + "https://{}/#/verify?type=email-update&token={}", 395 395 + hostname, 396 396 + urlencoding::encode(code) 397 397 + ); 398 398 + let body = format_message( 399 399 + strings.email_update_body, 400 400 + &[ 401 401 + ("handle", &prefs.handle), 402 402 + ("code", code), 403 403 + ("verify_page", &verify_page), 404 404 + ("verify_link", &verify_link), 405 405 + ], 406 406 + ); 407 407 + let subject = format_message(strings.email_update_subject, &[("hostname", hostname)]); 408 408 + enqueue_comms( 409 409 + db, 410 410 + NewComms::email( 411 411 + user_id, 412 412 + super::types::CommsType::EmailUpdate, 413 413 + current_email, 414 414 + subject, 415 415 + body, 416 416 + ), 417 417 + ) 418 418 + .await 419 419 + } 420 420 + 383 421 pub async fn enqueue_account_deletion( 384 422 db: &PgPool, 385 423 user_id: Uuid,

+255 -158

tests/email_update.rs

··· 63 63 } 64 64 65 65 #[tokio::test] 66 66 - async fn test_email_update_flow_success() { 66 66 + async fn test_request_email_update_returns_token_required() { 67 67 + let client = common::client(); 68 68 + let base_url = common::base_url().await; 69 69 + let handle = format!("emailreq-{}", uuid::Uuid::new_v4()); 70 70 + let email = format!("{}@example.com", handle); 71 71 + let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 72 72 + 73 73 + let res = client 74 74 + .post(format!( 75 75 + "{}/xrpc/com.atproto.server.requestEmailUpdate", 76 76 + base_url 77 77 + )) 78 78 + .bearer_auth(&access_jwt) 79 79 + .send() 80 80 + .await 81 81 + .expect("Failed to request email update"); 82 82 + assert_eq!(res.status(), StatusCode::OK); 83 83 + let body: Value = res.json().await.expect("Invalid JSON"); 84 84 + assert_eq!(body["tokenRequired"], true); 85 85 + } 86 86 + 87 87 + #[tokio::test] 88 88 + async fn test_update_email_flow_success() { 67 89 let client = common::client(); 68 90 let base_url = common::base_url().await; 69 91 let pool = get_pool().await; ··· 71 93 let email = format!("{}@example.com", handle); 72 94 let (access_jwt, did) = create_verified_account(&client, &base_url, &handle, &email).await; 73 95 let new_email = format!("new_{}@example.com", handle); 96 96 + 74 97 let res = client 75 98 .post(format!( 76 99 "{}/xrpc/com.atproto.server.requestEmailUpdate", 77 100 base_url 78 101 )) 79 102 .bearer_auth(&access_jwt) 80 80 - .json(&json!({"email": new_email})) 81 103 .send() 82 104 .await 83 105 .expect("Failed to request email update"); ··· 86 108 assert_eq!(body["tokenRequired"], true); 87 109 88 110 let code = get_email_update_token(&pool, &did).await; 111 111 + 89 112 let res = client 90 90 - .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url)) 113 113 + .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 91 114 .bearer_auth(&access_jwt) 92 115 .json(&json!({ 93 116 "email": new_email, ··· 95 118 })) 96 119 .send() 97 120 .await 98 98 - .expect("Failed to confirm email"); 121 121 + .expect("Failed to update email"); 99 122 assert_eq!(res.status(), StatusCode::OK); 100 100 - let user = sqlx::query!("SELECT email FROM users WHERE did = $1", did) 123 123 + 124 124 + let user_email: Option<String> = sqlx::query_scalar!("SELECT email FROM users WHERE did = $1", did) 101 125 .fetch_one(&pool) 102 126 .await 103 127 .expect("User not found"); 104 104 - assert_eq!(user.email, Some(new_email)); 128 128 + assert_eq!(user_email, Some(new_email)); 105 129 } 106 130 107 131 #[tokio::test] 108 108 - async fn test_request_email_update_taken_email() { 132 132 + async fn test_update_email_requires_token_when_verified() { 109 133 let client = common::client(); 110 134 let base_url = common::base_url().await; 111 111 - let handle1 = format!("emailup-taken1-{}", uuid::Uuid::new_v4()); 112 112 - let email1 = format!("{}@example.com", handle1); 113 113 - let (_, _) = create_verified_account(&client, &base_url, &handle1, &email1).await; 114 114 - let handle2 = format!("emailup-taken2-{}", uuid::Uuid::new_v4()); 115 115 - let email2 = format!("{}@example.com", handle2); 116 116 - let (access_jwt2, _) = create_verified_account(&client, &base_url, &handle2, &email2).await; 135 135 + let handle = format!("emailup-direct-{}", uuid::Uuid::new_v4()); 136 136 + let email = format!("{}@example.com", handle); 137 137 + let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 138 138 + let new_email = format!("direct_{}@example.com", handle); 139 139 + 117 140 let res = client 118 118 - .post(format!( 119 119 - "{}/xrpc/com.atproto.server.requestEmailUpdate", 120 120 - base_url 121 121 - )) 122 122 - .bearer_auth(&access_jwt2) 123 123 - .json(&json!({"email": email1})) 141 141 + .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 142 142 + .bearer_auth(&access_jwt) 143 143 + .json(&json!({ "email": new_email })) 124 144 .send() 125 145 .await 126 126 - .expect("Failed to request email update"); 146 146 + .expect("Failed to update email"); 127 147 assert_eq!(res.status(), StatusCode::BAD_REQUEST); 128 148 let body: Value = res.json().await.expect("Invalid JSON"); 129 129 - assert_eq!(body["error"], "EmailTaken"); 149 149 + assert_eq!(body["error"], "TokenRequired"); 130 150 } 131 151 132 152 #[tokio::test] 133 133 - async fn test_confirm_email_invalid_token() { 153 153 + async fn test_update_email_same_email_noop() { 134 154 let client = common::client(); 135 155 let base_url = common::base_url().await; 136 136 - let handle = format!("emailup-inv-{}", uuid::Uuid::new_v4()); 156 156 + let handle = format!("emailup-same-{}", uuid::Uuid::new_v4()); 137 157 let email = format!("{}@example.com", handle); 138 158 let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 139 139 - let new_email = format!("new_{}@example.com", handle); 140 140 - let res = client 141 141 - .post(format!( 142 142 - "{}/xrpc/com.atproto.server.requestEmailUpdate", 143 143 - base_url 144 144 - )) 145 145 - .bearer_auth(&access_jwt) 146 146 - .json(&json!({"email": new_email})) 147 147 - .send() 148 148 - .await 149 149 - .expect("Failed to request email update"); 150 150 - assert_eq!(res.status(), StatusCode::OK); 159 159 + 151 160 let res = client 152 152 - .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url)) 161 161 + .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 153 162 .bearer_auth(&access_jwt) 154 154 - .json(&json!({ 155 155 - "email": new_email, 156 156 - "token": "wrong-token" 157 157 - })) 163 163 + .json(&json!({ "email": email })) 158 164 .send() 159 165 .await 160 160 - .expect("Failed to confirm email"); 161 161 - assert_eq!(res.status(), StatusCode::BAD_REQUEST); 162 162 - let body: Value = res.json().await.expect("Invalid JSON"); 163 163 - assert_eq!(body["error"], "InvalidToken"); 166 166 + .expect("Failed to update email"); 167 167 + assert_eq!( 168 168 + res.status(), 169 169 + StatusCode::OK, 170 170 + "Updating to same email should succeed as no-op" 171 171 + ); 164 172 } 165 173 166 174 #[tokio::test] 167 167 - async fn test_confirm_email_wrong_email() { 175 175 + async fn test_update_email_invalid_token() { 168 176 let client = common::client(); 169 177 let base_url = common::base_url().await; 170 170 - let pool = get_pool().await; 171 171 - let handle = format!("emailup-wrong-{}", uuid::Uuid::new_v4()); 178 178 + let handle = format!("emailup-badtok-{}", uuid::Uuid::new_v4()); 172 179 let email = format!("{}@example.com", handle); 173 173 - let (access_jwt, did) = create_verified_account(&client, &base_url, &handle, &email).await; 174 174 - let new_email = format!("new_{}@example.com", handle); 180 180 + let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 181 181 + let new_email = format!("badtok_{}@example.com", handle); 182 182 + 175 183 let res = client 176 184 .post(format!( 177 185 "{}/xrpc/com.atproto.server.requestEmailUpdate", 178 186 base_url 179 187 )) 180 188 .bearer_auth(&access_jwt) 181 181 - .json(&json!({"email": new_email})) 182 189 .send() 183 190 .await 184 191 .expect("Failed to request email update"); 185 192 assert_eq!(res.status(), StatusCode::OK); 186 186 - let code = get_email_update_token(&pool, &did).await; 193 193 + 187 194 let res = client 188 188 - .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url)) 195 195 + .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 189 196 .bearer_auth(&access_jwt) 190 197 .json(&json!({ 191 191 - "email": "another_random@example.com", 192 192 - "token": code 198 198 + "email": new_email, 199 199 + "token": "wrong-token-12345" 193 200 })) 194 201 .send() 195 202 .await 196 196 - .expect("Failed to confirm email"); 203 203 + .expect("Failed to attempt email update"); 197 204 assert_eq!(res.status(), StatusCode::BAD_REQUEST); 198 205 let body: Value = res.json().await.expect("Invalid JSON"); 199 199 - assert!( 200 200 - body["message"].as_str().unwrap().contains("mismatch") || body["error"] == "InvalidToken" 201 201 - ); 206 206 + assert_eq!(body["error"], "InvalidToken"); 202 207 } 203 208 204 209 #[tokio::test] 205 205 - async fn test_update_email_requires_token() { 210 210 + async fn test_update_email_no_auth() { 206 211 let client = common::client(); 207 212 let base_url = common::base_url().await; 208 208 - let handle = format!("emailup-direct-{}", uuid::Uuid::new_v4()); 209 209 - let email = format!("{}@example.com", handle); 210 210 - let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 211 211 - let new_email = format!("direct_{}@example.com", handle); 213 213 + 212 214 let res = client 213 215 .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 214 214 - .bearer_auth(&access_jwt) 215 215 - .json(&json!({ "email": new_email })) 216 216 + .json(&json!({ "email": "test@example.com" })) 216 217 .send() 217 218 .await 218 218 - .expect("Failed to update email"); 219 219 - assert_eq!(res.status(), StatusCode::BAD_REQUEST); 219 219 + .expect("Failed to send request"); 220 220 + assert_eq!(res.status(), StatusCode::UNAUTHORIZED); 220 221 let body: Value = res.json().await.expect("Invalid JSON"); 221 221 - assert_eq!(body["error"], "TokenRequired"); 222 222 + assert_eq!(body["error"], "AuthenticationRequired"); 222 223 } 223 224 224 225 #[tokio::test] 225 225 - async fn test_update_email_same_email_noop() { 226 226 + async fn test_update_email_invalid_format() { 226 227 let client = common::client(); 227 228 let base_url = common::base_url().await; 228 228 - let handle = format!("emailup-same-{}", uuid::Uuid::new_v4()); 229 229 + let handle = format!("emailup-fmt-{}", uuid::Uuid::new_v4()); 229 230 let email = format!("{}@example.com", handle); 230 231 let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 232 232 + 231 233 let res = client 232 234 .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 233 235 .bearer_auth(&access_jwt) 234 234 - .json(&json!({ "email": email })) 236 236 + .json(&json!({ "email": "not-an-email" })) 235 237 .send() 236 238 .await 237 237 - .expect("Failed to update email"); 238 238 - assert_eq!( 239 239 - res.status(), 240 240 - StatusCode::OK, 241 241 - "Updating to same email should succeed as no-op" 242 242 - ); 239 239 + .expect("Failed to send request"); 240 240 + assert_eq!(res.status(), StatusCode::BAD_REQUEST); 243 241 } 244 242 245 243 #[tokio::test] 246 246 - async fn test_update_email_requires_token_after_pending() { 244 244 + async fn test_confirm_email_confirms_existing_email() { 247 245 let client = common::client(); 248 246 let base_url = common::base_url().await; 249 249 - let handle = format!("emailup-token-{}", uuid::Uuid::new_v4()); 247 247 + let pool = get_pool().await; 248 248 + let handle = format!("emailconfirm-{}", uuid::Uuid::new_v4()); 250 249 let email = format!("{}@example.com", handle); 251 251 - let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 252 252 - let new_email = format!("pending_{}@example.com", handle); 250 250 + 253 251 let res = client 254 252 .post(format!( 255 255 - "{}/xrpc/com.atproto.server.requestEmailUpdate", 253 253 + "{}/xrpc/com.atproto.server.createAccount", 256 254 base_url 257 255 )) 258 258 - .bearer_auth(&access_jwt) 259 259 - .json(&json!({"email": new_email})) 256 256 + .json(&json!({ 257 257 + "handle": handle, 258 258 + "email": email, 259 259 + "password": "Testpass123!" 260 260 + })) 260 261 .send() 261 262 .await 262 262 - .expect("Failed to request email update"); 263 263 + .expect("Failed to create account"); 263 264 assert_eq!(res.status(), StatusCode::OK); 265 265 + let body: Value = res.json().await.expect("Invalid JSON"); 266 266 + let did = body["did"].as_str().expect("No did").to_string(); 267 267 + let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string(); 268 268 + 269 269 + let body_text: String = sqlx::query_scalar!( 270 270 + "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1", 271 271 + did 272 272 + ) 273 273 + .fetch_one(&pool) 274 274 + .await 275 275 + .expect("Verification email not found"); 276 276 + 277 277 + let code = body_text 278 278 + .lines() 279 279 + .find(|line| line.trim().starts_with("MX") && line.contains('-')) 280 280 + .map(|s| s.trim().to_string()) 281 281 + .unwrap_or_default(); 282 282 + 264 283 let res = client 265 265 - .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 284 284 + .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url)) 266 285 .bearer_auth(&access_jwt) 267 267 - .json(&json!({ "email": new_email })) 286 286 + .json(&json!({ 287 287 + "email": email, 288 288 + "token": code 289 289 + })) 268 290 .send() 269 291 .await 270 270 - .expect("Failed to attempt email update"); 271 271 - assert_eq!(res.status(), StatusCode::BAD_REQUEST); 272 272 - let body: Value = res.json().await.expect("Invalid JSON"); 273 273 - assert_eq!(body["error"], "TokenRequired"); 292 292 + .expect("Failed to confirm email"); 293 293 + assert_eq!(res.status(), StatusCode::OK); 294 294 + 295 295 + let verified: bool = sqlx::query_scalar!( 296 296 + "SELECT email_verified FROM users WHERE did = $1", 297 297 + did 298 298 + ) 299 299 + .fetch_one(&pool) 300 300 + .await 301 301 + .expect("User not found"); 302 302 + assert!(verified); 274 303 } 275 304 276 305 #[tokio::test] 277 277 - async fn test_update_email_with_valid_token() { 306 306 + async fn test_confirm_email_rejects_wrong_email() { 278 307 let client = common::client(); 279 308 let base_url = common::base_url().await; 280 309 let pool = get_pool().await; 281 281 - let handle = format!("emailup-valid-{}", uuid::Uuid::new_v4()); 310 310 + let handle = format!("emailconf-wrong-{}", uuid::Uuid::new_v4()); 282 311 let email = format!("{}@example.com", handle); 283 283 - let (access_jwt, did) = create_verified_account(&client, &base_url, &handle, &email).await; 284 284 - let new_email = format!("valid_{}@example.com", handle); 312 312 + 285 313 let res = client 286 314 .post(format!( 287 287 - "{}/xrpc/com.atproto.server.requestEmailUpdate", 315 315 + "{}/xrpc/com.atproto.server.createAccount", 288 316 base_url 289 317 )) 290 290 - .bearer_auth(&access_jwt) 291 291 - .json(&json!({"email": new_email})) 318 318 + .json(&json!({ 319 319 + "handle": handle, 320 320 + "email": email, 321 321 + "password": "Testpass123!" 322 322 + })) 292 323 .send() 293 324 .await 294 294 - .expect("Failed to request email update"); 325 325 + .expect("Failed to create account"); 295 326 assert_eq!(res.status(), StatusCode::OK); 296 296 - let code = get_email_update_token(&pool, &did).await; 327 327 + let body: Value = res.json().await.expect("Invalid JSON"); 328 328 + let did = body["did"].as_str().expect("No did").to_string(); 329 329 + let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string(); 330 330 + 331 331 + let body_text: String = sqlx::query_scalar!( 332 332 + "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1", 333 333 + did 334 334 + ) 335 335 + .fetch_one(&pool) 336 336 + .await 337 337 + .expect("Verification email not found"); 338 338 + 339 339 + let code = body_text 340 340 + .lines() 341 341 + .find(|line| line.trim().starts_with("MX") && line.contains('-')) 342 342 + .map(|s| s.trim().to_string()) 343 343 + .unwrap_or_default(); 344 344 + 297 345 let res = client 298 298 - .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 346 346 + .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url)) 299 347 .bearer_auth(&access_jwt) 300 348 .json(&json!({ 301 301 - "email": new_email, 349 349 + "email": "different@example.com", 302 350 "token": code 303 351 })) 304 352 .send() 305 353 .await 306 306 - .expect("Failed to update email"); 307 307 - assert_eq!(res.status(), StatusCode::OK); 308 308 - let user = sqlx::query!("SELECT email FROM users WHERE did = $1", did) 309 309 - .fetch_one(&pool) 310 310 - .await 311 311 - .expect("User not found"); 312 312 - assert_eq!(user.email, Some(new_email)); 354 354 + .expect("Failed to confirm email"); 355 355 + assert_eq!(res.status(), StatusCode::BAD_REQUEST); 356 356 + let body: Value = res.json().await.expect("Invalid JSON"); 357 357 + assert_eq!(body["error"], "InvalidEmail"); 313 358 } 314 359 315 360 #[tokio::test] 316 316 - async fn test_update_email_invalid_token() { 361 361 + async fn test_confirm_email_invalid_token() { 317 362 let client = common::client(); 318 363 let base_url = common::base_url().await; 319 319 - let handle = format!("emailup-badtok-{}", uuid::Uuid::new_v4()); 364 364 + let handle = format!("emailconf-inv-{}", uuid::Uuid::new_v4()); 320 365 let email = format!("{}@example.com", handle); 321 321 - let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 322 322 - let new_email = format!("badtok_{}@example.com", handle); 366 366 + 323 367 let res = client 324 368 .post(format!( 325 325 - "{}/xrpc/com.atproto.server.requestEmailUpdate", 369 369 + "{}/xrpc/com.atproto.server.createAccount", 326 370 base_url 327 371 )) 328 328 - .bearer_auth(&access_jwt) 329 329 - .json(&json!({"email": new_email})) 372 372 + .json(&json!({ 373 373 + "handle": handle, 374 374 + "email": email, 375 375 + "password": "Testpass123!" 376 376 + })) 330 377 .send() 331 378 .await 332 332 - .expect("Failed to request email update"); 379 379 + .expect("Failed to create account"); 333 380 assert_eq!(res.status(), StatusCode::OK); 381 381 + let body: Value = res.json().await.expect("Invalid JSON"); 382 382 + let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string(); 383 383 + 334 384 let res = client 335 335 - .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 385 385 + .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url)) 336 386 .bearer_auth(&access_jwt) 337 387 .json(&json!({ 338 338 - "email": new_email, 339 339 - "token": "wrong-token-12345" 388 388 + "email": email, 389 389 + "token": "wrong-token" 340 390 })) 341 391 .send() 342 392 .await 343 343 - .expect("Failed to attempt email update"); 393 393 + .expect("Failed to confirm email"); 344 394 assert_eq!(res.status(), StatusCode::BAD_REQUEST); 345 395 let body: Value = res.json().await.expect("Invalid JSON"); 346 396 assert_eq!(body["error"], "InvalidToken"); 347 397 } 348 398 349 399 #[tokio::test] 350 350 - async fn test_update_email_already_taken() { 400 400 + async fn test_unverified_account_can_update_email_without_token() { 351 401 let client = common::client(); 352 402 let base_url = common::base_url().await; 353 353 - let handle1 = format!("emailup-dup1-{}", uuid::Uuid::new_v4()); 354 354 - let email1 = format!("{}@example.com", handle1); 355 355 - let (_, _) = create_verified_account(&client, &base_url, &handle1, &email1).await; 356 356 - let handle2 = format!("emailup-dup2-{}", uuid::Uuid::new_v4()); 357 357 - let email2 = format!("{}@example.com", handle2); 358 358 - let (access_jwt2, _) = create_verified_account(&client, &base_url, &handle2, &email2).await; 403 403 + let pool = get_pool().await; 404 404 + let handle = format!("emailup-unverified-{}", uuid::Uuid::new_v4()); 405 405 + let email = format!("{}@example.com", handle); 406 406 + 359 407 let res = client 360 360 - .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 361 361 - .bearer_auth(&access_jwt2) 362 362 - .json(&json!({ "email": email1 })) 408 408 + .post(format!( 409 409 + "{}/xrpc/com.atproto.server.createAccount", 410 410 + base_url 411 411 + )) 412 412 + .json(&json!({ 413 413 + "handle": handle, 414 414 + "email": email, 415 415 + "password": "Testpass123!" 416 416 + })) 363 417 .send() 364 418 .await 365 365 - .expect("Failed to attempt email update"); 366 366 - assert_eq!(res.status(), StatusCode::BAD_REQUEST); 419 419 + .expect("Failed to create account"); 420 420 + assert_eq!(res.status(), StatusCode::OK); 367 421 let body: Value = res.json().await.expect("Invalid JSON"); 368 368 - assert!( 369 369 - body["error"] == "TokenRequired" 370 370 - || body["message"] 371 371 - .as_str() 372 372 - .unwrap_or("") 373 373 - .contains("already in use") 374 374 - || body["error"] == "InvalidRequest" 422 422 + let did = body["did"].as_str().expect("No did").to_string(); 423 423 + let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string(); 424 424 + 425 425 + let res = client 426 426 + .post(format!( 427 427 + "{}/xrpc/com.atproto.server.requestEmailUpdate", 428 428 + base_url 429 429 + )) 430 430 + .bearer_auth(&access_jwt) 431 431 + .send() 432 432 + .await 433 433 + .expect("Failed to request email update"); 434 434 + assert_eq!(res.status(), StatusCode::OK); 435 435 + let body: Value = res.json().await.expect("Invalid JSON"); 436 436 + assert_eq!( 437 437 + body["tokenRequired"], false, 438 438 + "Unverified account should not require token" 375 439 ); 376 376 - } 377 440 378 378 - #[tokio::test] 379 379 - async fn test_update_email_no_auth() { 380 380 - let client = common::client(); 381 381 - let base_url = common::base_url().await; 441 441 + let new_email = format!("new_{}@example.com", handle); 382 442 let res = client 383 443 .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 384 384 - .json(&json!({ "email": "test@example.com" })) 444 444 + .bearer_auth(&access_jwt) 445 445 + .json(&json!({ "email": new_email })) 385 446 .send() 386 447 .await 387 387 - .expect("Failed to send request"); 388 388 - assert_eq!(res.status(), StatusCode::UNAUTHORIZED); 389 389 - let body: Value = res.json().await.expect("Invalid JSON"); 390 390 - assert_eq!(body["error"], "AuthenticationRequired"); 448 448 + .expect("Failed to update email"); 449 449 + assert_eq!( 450 450 + res.status(), 451 451 + StatusCode::OK, 452 452 + "Unverified account should be able to update email without token" 453 453 + ); 454 454 + 455 455 + let user_email: Option<String> = 456 456 + sqlx::query_scalar!("SELECT email FROM users WHERE did = $1", did) 457 457 + .fetch_one(&pool) 458 458 + .await 459 459 + .expect("User not found"); 460 460 + assert_eq!(user_email, Some(new_email)); 391 461 } 392 462 393 463 #[tokio::test] 394 394 - async fn test_update_email_invalid_format() { 464 464 + async fn test_update_email_taken_by_another_user() { 395 465 let client = common::client(); 396 466 let base_url = common::base_url().await; 397 397 - let handle = format!("emailup-fmt-{}", uuid::Uuid::new_v4()); 398 398 - let email = format!("{}@example.com", handle); 399 399 - let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await; 467 467 + let pool = get_pool().await; 468 468 + 469 469 + let handle1 = format!("emailup-dup1-{}", uuid::Uuid::new_v4()); 470 470 + let email1 = format!("{}@example.com", handle1); 471 471 + let (_, _) = create_verified_account(&client, &base_url, &handle1, &email1).await; 472 472 + 473 473 + let handle2 = format!("emailup-dup2-{}", uuid::Uuid::new_v4()); 474 474 + let email2 = format!("{}@example.com", handle2); 475 475 + let (access_jwt2, did2) = create_verified_account(&client, &base_url, &handle2, &email2).await; 476 476 + 477 477 + let res = client 478 478 + .post(format!( 479 479 + "{}/xrpc/com.atproto.server.requestEmailUpdate", 480 480 + base_url 481 481 + )) 482 482 + .bearer_auth(&access_jwt2) 483 483 + .send() 484 484 + .await 485 485 + .expect("Failed to request email update"); 486 486 + assert_eq!(res.status(), StatusCode::OK); 487 487 + 488 488 + let code = get_email_update_token(&pool, &did2).await; 489 489 + 400 490 let res = client 401 491 .post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url)) 402 402 - .bearer_auth(&access_jwt) 403 403 - .json(&json!({ "email": "not-an-email" })) 492 492 + .bearer_auth(&access_jwt2) 493 493 + .json(&json!({ 494 494 + "email": email1, 495 495 + "token": code 496 496 + })) 404 497 .send() 405 498 .await 406 406 - .expect("Failed to send request"); 499 499 + .expect("Failed to update email"); 407 500 assert_eq!(res.status(), StatusCode::BAD_REQUEST); 408 501 let body: Value = res.json().await.expect("Invalid JSON"); 409 409 - assert_eq!(body["error"], "InvalidEmail"); 502 502 + assert_eq!(body["error"], "InvalidRequest"); 503 503 + assert!(body["message"] 504 504 + .as_str() 505 505 + .unwrap_or("") 506 506 + .contains("already in use")); 410 507 }