feat: add verify process in change email progress (#4306)

Co-authored-by: Peng Xiao <pengxiao@outlook.com>

apps/server/src/modules/auth/mailer/mail.service.ts

@@ -160,6 +160,33 @@ export class MailService {
       html,
     });
   }
+  async sendVerifyChangeEmail(to: string, url: string) {
+    const html = emailTemplate({
+      title: 'Verify your new email address',
+      content:
+        'You recently requested to change the email address associated with your AFFiNE account. To complete this process, please click on the verification link below. This magic link will expire in 30 minutes.',
+      buttonContent: 'Verify your new email address',
+      buttonUrl: url,
+    });
+    return this.sendMail({
+      from: this.config.auth.email.sender,
+      to,
+      subject: `Verify your new email for AFFiNE`,
+      html,
+    });
+  }
+  async sendNotificationChangeEmail(to: string) {
+    const html = emailTemplate({
+      title: 'Email change successful',
+      content: `As per your request, we have changed your email. Please make sure you're using ${to} when you log in the next time. `,
+    });
+    return this.sendMail({
+      from: this.config.auth.email.sender,
+      to,
+      subject: `Your email has been changed`,
+      html,
+    });
+  }
   async sendAcceptedEmail(
     to: string,
     {

apps/server/src/modules/auth/resolver.ts

@@ -131,17 +131,19 @@ export class AuthResolver {
   @Auth()
   async changeEmail(
     @CurrentUser() user: UserType,
-    @Args('token') token: string,
-    @Args('email') email: string
+    @Args('token') token: string
   ) {
-    const id = await this.session.get(token);
-    if (!id || id !== user.id) {
+    // email has set token in `sendVerifyChangeEmail`
+    const [id, email] = (await this.session.get(token)).split(',');
+    if (!id || id !== user.id || !email) {
       throw new ForbiddenException('Invalid token');
     }
 
     await this.auth.changeEmail(id, email);
     await this.session.delete(token);
 
+    await this.auth.sendNotificationChangeEmail(email);
+
     return user;
   }
 
@@ -181,6 +183,13 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
+  // The change email step is:
+  // 1. send email to primitive email `sendChangeEmail`
+  // 2. user open change email page from email
+  // 3. send verify email to new email `sendVerifyChangeEmail`
+  // 4. user open confirm email page from new email
+  // 5. user click confirm button
+  // 6. send notification email
   @Throttle(5, 60)
   @Mutation(() => Boolean)
   @Auth()
@@ -198,4 +207,37 @@ export class AuthResolver {
     const res = await this.auth.sendChangeEmail(email, url.toString());
     return !res.rejected.length;
   }
+
+  @Throttle(5, 60)
+  @Mutation(() => Boolean)
+  @Auth()
+  async sendVerifyChangeEmail(
+    @CurrentUser() user: UserType,
+    @Args('token') token: string,
+    @Args('email') email: string,
+    @Args('callbackUrl') callbackUrl: string
+  ) {
+    const id = await this.session.get(token);
+    if (!id || id !== user.id) {
+      throw new ForbiddenException('Invalid token');
+    }
+
+    const hasRegistered = await this.auth.getUserByEmail(email);
+
+    if (hasRegistered) {
+      throw new BadRequestException(`Invalid user email`);
+    }
+
+    const withEmailToken = nanoid();
+    await this.session.set(withEmailToken, `${user.id},${email}`);
+
+    const url = new URL(callbackUrl, this.config.baseUrl);
+    url.searchParams.set('token', withEmailToken);
+
+    const res = await this.auth.sendVerifyChangeEmail(email, url.toString());
+
+    await this.session.delete(token);
+
+    return !res.rejected.length;
+  }
 }

apps/server/src/modules/auth/service.ts

@@ -251,4 +251,10 @@ export class AuthService {
   async sendChangeEmail(email: string, callbackUrl: string) {
     return this.mailer.sendChangeEmail(email, callbackUrl);
   }
+  async sendVerifyChangeEmail(email: string, callbackUrl: string) {
+    return this.mailer.sendVerifyChangeEmail(email, callbackUrl);
+  }
+  async sendNotificationChangeEmail(email: string) {
+    return this.mailer.sendNotificationChangeEmail(email);
+  }
 }