Merge pull request #574 from code0-tech/559-setup-email-verification

Setup email verification

Author: Taucher2003

app/graphql/mutations/users/email_verification.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Users
+    class EmailVerification < BaseMutation
+      description 'Verify your email when changing it or signing up'
+
+      field :user, Types::UserType, null: true, description: 'The user whose email was verified'
+
+      argument :token, String, required: true, description: 'The email verification token'
+
+      def resolve(token:)
+        ::Users::EmailVerificationService.new(
+          current_authentication,
+          token
+        ).execute.to_mutation_response(success_key: :user)
+      end
+    end
+  end
+end

app/graphql/types/mutation_type.rb

@@ -35,6 +35,7 @@ class MutationType < Types::BaseObject
     mount_mutation Mutations::Users::Mfa::BackupCodes::Rotate
     mount_mutation Mutations::Users::Mfa::Totp::GenerateSecret
     mount_mutation Mutations::Users::Mfa::Totp::ValidateSecret
+    mount_mutation Mutations::Users::EmailVerification
     mount_mutation Mutations::Users::Login
     mount_mutation Mutations::Users::Logout
     mount_mutation Mutations::Users::Register

app/mailers/user_mailer.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class UserMailer < ApplicationMailer
+  def email_verification
+    @user = params[:user]
+    @verification_code = params[:verification_code]
+
+    mail(to: @user.email, subject: 'Email verification')
+  end
+end

app/models/audit_event.rb

@@ -35,6 +35,8 @@ class AuditEvent < ApplicationRecord
     flow_created: 31,
     flow_updated: 32,
     flow_deleted: 33,
+    email_verification_sent: 34,
+    email_verified: 35,
   }.with_indifferent_access
 
   # rubocop:disable Lint/StructNewOverride

app/models/user.rb

@@ -55,4 +55,8 @@ def validate_mfa!(mfa)
     end
     [mfa_passed, mfa_type]
   end
+
+  generates_token_for :email_verification, expires_in: 15.minutes do
+    email
+  end
 end

app/policies/user_policy.rb

@@ -17,5 +17,7 @@ class UserPolicy < BasePolicy
     enable :manage_mfa
     enable :update_user
     enable :update_attachment_avatar
+    enable :verify_email
+    enable :send_verification_email
   end
 end

app/services/users/email_verification_send_service.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Users
+  class EmailVerificationSendService
+    include Sagittarius::Database::Transactional
+
+    attr_reader :current_authentication, :user
+
+    def initialize(current_authentication, user)
+      @current_authentication = current_authentication
+      @user = user
+    end
+
+    def execute
+      unless Ability.allowed?(current_authentication, :send_verification_email, user)
+        return ServiceResponse.error(message: 'Missing permission', payload: :missing_permission)
+      end
+
+      transactional do |t|
+        user.email_verified_at = nil
+        unless user.save
+          t.rollback_and_return! ServiceResponse.error(message: 'Failed to set email to unverified',
+                                                       payload: user.errors)
+        end
+
+        UserMailer.with(
+          user: user,
+          verification_code: user.generate_token_for(:email_verification)
+        ).email_verification.deliver_later
+
+        AuditService.audit(
+          :email_verification_sent,
+          author_id: current_authentication.user.id,
+          entity: user,
+          target: user,
+          details: {
+            email: user.email,
+          }
+        )
+
+        ServiceResponse.success(message: 'Successfully sent email verification', payload: user)
+      end
+    end
+  end
+end

app/services/users/email_verification_service.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Users
+  class EmailVerificationService
+    include Sagittarius::Database::Transactional
+
+    attr_reader :current_authentication, :verification_code
+
+    def initialize(current_authentication, verification_code)
+      @current_authentication = current_authentication
+      @verification_code = verification_code
+    end
+
+    def execute
+      user = User.find_by_token_for(:email_verification, verification_code)
+
+      unless Ability.allowed?(current_authentication, :verify_email, user)
+        return ServiceResponse.error(message: 'Missing permission', payload: :missing_permission)
+      end
+
+      transactional do |t|
+        user.email_verified_at = Time.zone.now
+        unless user.save
+          t.rollback_and_return! ServiceResponse.error(message: 'Failed to set email to verified', payload: user.errors)
+        end
+
+        AuditService.audit(
+          :email_verified,
+          author_id: current_authentication.user.id,
+          entity: user,
+          target: user,
+          details: {
+            email: user.email,
+          }
+        )
+
+        ServiceResponse.success(message: 'Successfully verified email', payload: user)
+      end
+    end
+  end
+end

app/services/users/register_service.rb

@@ -28,6 +28,16 @@ def execute
                                                        payload: user_session.errors)
         end
 
+        email_verification_response = EmailVerificationSendService.new(
+          Sagittarius::Authentication.new(:session, user_session),
+          user
+        ).execute
+
+        unless email_verification_response.success?
+          t.rollback_and_return! ServiceResponse.error(message: 'Failed to send verification email',
+                                                       payload: email_verification_response.payload)
+        end
+
         AuditService.audit(
           :user_registered,
           author_id: user.id,

app/services/users/update_service.rb

@@ -60,6 +60,15 @@ def execute
           )
         end
 
+        if params.key?(:email)
+          response = EmailVerificationSendService.new(current_authentication, user).execute
+
+          unless response.success?
+            t.rollback_and_return! ServiceResponse.error(message: 'Failed to send verification email',
+                                                         payload: response.payload)
+          end
+        end
+
         AuditService.audit(
           :user_updated,
           author_id: current_authentication.user.id,