[MM-33395] Invalidate email tokens (#17069)

* [MM-33395] Invalidate existing verify email tokens when creating a new one

* Update store layers

* Addressing review comments

* Fix linter

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

app/email.go

@@ -759,6 +759,35 @@ func (es *EmailService) sendMailWithEmbeddedFiles(to, subject, htmlBody string,
 	return mail.SendMailWithEmbeddedFilesUsingConfig(to, subject, htmlBody, embeddedFiles, mailConfig, license != nil && *license.Features.Compliance, "")
 }
 
+func (es *EmailService) InvalidateVerifyEmailTokensForUser(userID string) *model.AppError {
+	tokens, err := es.srv.Store.Token().GetAllTokensByType(TokenTypeVerifyEmail)
+	if err != nil {
+		return model.NewAppError("InvalidateVerifyEmailTokensForUser", "api.user.invalidate_verify_email_tokens.error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var appErr *model.AppError = nil
+	for _, token := range tokens {
+		tokenExtra := struct {
+			UserId string
+			Email  string
+		}{}
+		if err := json.Unmarshal([]byte(token.Extra), &tokenExtra); err != nil {
+			appErr = model.NewAppError("InvalidateVerifyEmailTokensForUser", "api.user.invalidate_verify_email_tokens_parse.error", nil, err.Error(), http.StatusInternalServerError)
+			continue
+		}
+
+		if tokenExtra.UserId != userID {
+			continue
+		}
+
+		if err := es.srv.Store.Token().Delete(token.Token); err != nil {
+			appErr = model.NewAppError("InvalidateVerifyEmailTokensForUser", "api.user.invalidate_verify_email_tokens_delete.error", nil, err.Error(), http.StatusInternalServerError)
+		}
+	}
+
+	return appErr
+}
+
 func (es *EmailService) CreateVerifyEmailToken(userID string, newEmail string) (*model.Token, *model.AppError) {
 	tokenExtra := struct {
 		UserId string
@@ -775,6 +804,10 @@ func (es *EmailService) CreateVerifyEmailToken(userID string, newEmail string) (
 
 	token := model.NewToken(TokenTypeVerifyEmail, string(jsonData))
 
+	if err := es.InvalidateVerifyEmailTokensForUser(userID); err != nil {
+		return nil, err
+	}
+
 	if err = es.srv.Store.Token().Save(token); err != nil {
 		var appErr *model.AppError
 		switch {

app/user.go

@@ -1301,7 +1301,6 @@ func (a *App) SendPasswordReset(email string, siteURL string) (bool, *model.AppE
 }
 
 func (a *App) CreatePasswordRecoveryToken(userID, email string) (*model.Token, *model.AppError) {
-
 	tokenExtra := struct {
 		UserId string
 		Email  string

app/user_test.go

@@ -488,6 +488,48 @@ func TestUpdateUserEmail(t *testing.T) {
 		assert.Equal(t, err.Id, "app.user.save.email_exists.app_error")
 		assert.Nil(t, user3)
 	})
+
+	t.Run("Only the last token works if verification is required", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.EmailSettings.RequireEmailVerification = true
+		})
+
+		// we update the email a first time and update. The first
+		// token is sent with the email
+		user.Email = th.MakeEmail()
+		_, appErr := th.App.UpdateUser(user, true)
+		require.Nil(t, appErr)
+
+		tokens := []*model.Token{}
+		require.Eventually(t, func() bool {
+			var err error
+			tokens, err = th.App.Srv().Store.Token().GetAllTokensByType(TokenTypeVerifyEmail)
+			return err == nil && len(tokens) == 1
+		}, 100*time.Millisecond, 10*time.Millisecond)
+
+		firstToken := tokens[0]
+
+		// without using the first token, we update the email a second
+		// time and another token gets sent. The first one should not
+		// work anymore and the second should work properly
+		user.Email = th.MakeEmail()
+		_, appErr = th.App.UpdateUser(user, true)
+		require.Nil(t, appErr)
+
+		require.Eventually(t, func() bool {
+			var err error
+			tokens, err = th.App.Srv().Store.Token().GetAllTokensByType(TokenTypeVerifyEmail)
+			return err == nil && len(tokens) == 1
+		}, 100*time.Millisecond, 10*time.Millisecond)
+		secondToken := tokens[0]
+
+		_, err := th.App.Srv().Store.Token().GetByToken(firstToken.Token)
+		require.Error(t, err)
+
+		require.NotNil(t, th.App.VerifyEmailFromToken(firstToken.Token))
+		require.Nil(t, th.App.VerifyEmailFromToken(secondToken.Token))
+		require.NotNil(t, th.App.VerifyEmailFromToken(firstToken.Token))
+	})
 }
 
 func getUserFromDB(a *App, id string, t *testing.T) *model.User {