9
2
Fork
You've already forked platform
2

fix(api): throttle verification email sends #357

Manually merged
ryansquared merged 4 commits from fix/issue-334-email-verification-throttle into main 2026年07月09日 16:55:20 +02:00

Summary

  • Add a persisted email_verification_sent_at timestamp on users to track verification email sends.
  • Throttle repeated verification email sends for five minutes in the onboarding resend endpoint, using an atomic update guard so concurrent requests cannot mint/send multiple tokens.
  • Apply the same cooldown to profile email changes that generate verification tokens, and clear the throttle timestamp when an email is removed.
  • Add unit coverage for first send, recent-send blocking, and resend after the cooldown.

Test plan

  • git diff --check
  • cargo test -p api onboarding::tests::email_verification_throttle -- --nocapture
  • cargo test -p api
  • cargo clippy -p api --all-targets (passes; existing warnings remain)
  • cargo test --workspace

Closes #334

## Summary - Add a persisted `email_verification_sent_at` timestamp on users to track verification email sends. - Throttle repeated verification email sends for five minutes in the onboarding resend endpoint, using an atomic update guard so concurrent requests cannot mint/send multiple tokens. - Apply the same cooldown to profile email changes that generate verification tokens, and clear the throttle timestamp when an email is removed. - Add unit coverage for first send, recent-send blocking, and resend after the cooldown. ## Test plan - `git diff --check` - `cargo test -p api onboarding::tests::email_verification_throttle -- --nocapture` - `cargo test -p api` - `cargo clippy -p api --all-targets` (passes; existing warnings remain) - `cargo test --workspace` Closes #334
@ -86,6 +86,7 @@ CREATE TABLE users (
email_verified_atTIMESTAMP,
email_verification_tokenVARCHAR(255),
email_verification_token_expires_atTIMESTAMP,
email_verification_sent_atTIMESTAMPTZ,

create a new migration to add this column

create a new migration to add this column
@ -19,0 +21,4 @@
#[derive(Debug, PartialEq, Eq)]
pub(crate)enum EmailVerificationThrottle{
Allowed,
Throttled{retry_after_seconds: i64 },

this should be an std::time::Duration

this should be an std::time::Duration
@ -19,0 +33,4 @@
};
letelapsed=now.signed_duration_since(last_sent_at);
letretry_after_seconds=EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS-elapsed.num_seconds();

if EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS is a Duration, this should not need .num_seconds()

if EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS is a Duration, this should not need .num_seconds()
@ -19,0 +24,4 @@
Throttled{retry_after_seconds: i64 },
}
pub(crate)fn email_verification_throttle(

this should be an impl EmailVerificationThrottle::new()

this should be an impl EmailVerificationThrottle::new()
@ -92,2 +92,4 @@
}
});
ifnew_email.is_some(){

we have no way of conveying to the user that the reason the request didn't go through is because the email verification is being debounced. also query builder looks like nightmare fuel.

we have no way of conveying to the user that the reason the request didn't go through is because the email verification is being debounced. also query builder looks like nightmare fuel.
@ -139,0 +135,4 @@
.fetch_one(&state.db)
.await
}
Some(email_update)ifemail_update.trim().is_empty()=>{

Is it possible for a user to bypass rate limiting by setting the email, then unsetting the email? I'm not sure we should unset email_verification_sent_at here.

Is it possible for a user to bypass rate limiting by setting the email, then unsetting the email? I'm not sure we should unset email_verification_sent_at here.
@ -71,1 +72,3 @@
returnErr(StatusCode::BAD_REQUEST);
returnErr((
StatusCode::BAD_REQUEST,
Json(serde_json::json!({"error": "at least one field is required"})),

Adapt this JSON response to fit the same shape as send_verification_email, having a "success": "false" and error message. That way, it can be handled by frontend.

Adapt this JSON response to fit the same shape as send_verification_email, having a "success": "false" and error message. That way, it can be handled by frontend.
@ -139,0 +143,4 @@
email_verified_at=NULL,
email_verification_token=NULL,
email_verification_token_expires_at=NULL,
email_verification_sent_at=NULL

Remove email_verification_sent_at to avoid a potential denial of service by someone spamming multiple email requests.

Remove email_verification_sent_at to avoid a potential denial of service by someone spamming multiple email requests.
ryansquared manually merged commit 1af8cc7259 into main 2026年07月09日 16:55:20 +02:00
Sign in to join this conversation.
No reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Component/Enclave-Builder
This issue affects Enclave Builder (git-push and CLI)
Component/Infrastructure
This issue affects generic Caution hosted infra components
Deploy/BYOC
Relates to Caution Bring-your-own-compute
Deploy/Full-managed
Relates to Caution fully managed cloud
Deploy/Self-hosted
Relates to Caution deployed on self-hosted infra
Interface/API
This issue affects the API
Interface/CLI
This issue affects the command line interface
Interface/Git
This issue affects the Git `push` interface
Interface/Web
This issue affects the web dashboard
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
 The priority is critical
Priority
High
 The priority is high
Priority
Low
 The priority is low
Priority
Medium
 The priority is medium
Reviewed
Confirmed
 Issue has been confirmed
Reviewed
Duplicate
 This issue or pull request already exists
Reviewed
Invalid
 Invalid issue
Reviewed
Won't Fix
 This issue won't be fixed
Status
Abandoned
 Somebody has started to work on this but abandoned work
Status
Blocked
 Something is blocking this issue or pull request
Status
Need More Info
 Feedback is required to reproduce issue or to continue work
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
caution/platform!357
Reference in a new issue
caution/platform
No description provided.
Delete branch "fix/issue-334-email-verification-throttle"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?