feat: add ability to force email verification (#1837)

backend/internal/appconfig/legacy.go

@@ -2,19 +2,13 @@ package appconfig
 
 import "encoding/json"
 
-const (
-	LoginNotificationDisabled           = "disabled"
-	LoginNotificationAlways             = "always"
-	LoginNotificationIPAndUserAgent     = "ipAndUserAgent"
-	LoginNotificationBrowserRecognition = "browserRecognition"
-)
-
-// UnmarshalJSON preserves the notification policy when loading state written before notification modes existed
+// UnmarshalJSON preserves settings stored in actor state before boolean toggles were replaced by modes
 func (m *AppConfigModel) UnmarshalJSON(data []byte) error {
 	type config AppConfigModel
 	value := struct {
 		*config
-		LegacyNotificationEnabled AppConfigValue `json:"emailLoginNotificationEnabled"`
+		LegacyNotificationEnabled      AppConfigValue `json:"emailLoginNotificationEnabled"`
+		LegacyEmailVerificationEnabled AppConfigValue `json:"emailVerificationEnabled"`
 	}{config: (*config)(m)}
 	if err := json.Unmarshal(data, &value); err != nil {
 		return err
@@ -22,6 +16,9 @@ func (m *AppConfigModel) UnmarshalJSON(data []byte) error {
 	if m.EmailLoginNotificationMode == "" && value.LegacyNotificationEnabled != "" {
 		m.EmailLoginNotificationMode = legacyLoginNotificationMode(value.LegacyNotificationEnabled)
 	}
+	if m.EmailVerification == "" && value.LegacyEmailVerificationEnabled != "" {
+		m.EmailVerification = legacyEmailVerification(value.LegacyEmailVerificationEnabled)
+	}
 	return nil
 }
 
@@ -31,3 +28,10 @@ func legacyLoginNotificationMode(enabled AppConfigValue) AppConfigValue {
 	}
 	return LoginNotificationDisabled
 }
+
+func legacyEmailVerification(enabled AppConfigValue) AppConfigValue {
+	if enabled.IsTrue() {
+		return EmailVerificationOptional
+	}
+	return EmailVerificationDisabled
+}

backend/internal/appconfig/migration.go

@@ -62,6 +62,9 @@ func fromLegacyConfig(legacyCfg map[string]string) (*AppConfigModel, error) {
 	if legacyCfg["emailLoginNotificationMode"] == "" {
 		dest.EmailLoginNotificationMode = legacyLoginNotificationMode(AppConfigValue(legacyCfg["emailLoginNotificationEnabled"]))
 	}
+	if legacyCfg["emailVerification"] == "" {
+		dest.EmailVerification = legacyEmailVerification(AppConfigValue(legacyCfg["emailVerificationEnabled"]))
+	}
 
 	rt := reflect.ValueOf(dest).Elem().Type()
 	rv := reflect.ValueOf(dest).Elem()

backend/internal/appconfig/model.go

@@ -13,6 +13,19 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/dto"
 )
 
+const (
+	LoginNotificationDisabled           = "disabled"
+	LoginNotificationAlways             = "always"
+	LoginNotificationIPAndUserAgent     = "ipAndUserAgent"
+	LoginNotificationBrowserRecognition = "browserRecognition"
+)
+
+const (
+	EmailVerificationDisabled = "disabled"
+	EmailVerificationOptional = "optional"
+	EmailVerificationRequired = "required"
+)
+
 type AppConfigModel struct {
 	// General
 	AppName             AppConfigValue `json:"appName" env:"APP_NAME" public:"true"`
@@ -39,7 +52,7 @@ type AppConfigModel struct {
 	EmailOneTimeAccessAsUnauthenticatedEnabled AppConfigValue `json:"emailOneTimeAccessAsUnauthenticatedEnabled" env:"EMAIL_ONE_TIME_ACCESS_AS_UNAUTHENTICATED_ENABLED" type:"bool" public:"true"`
 	EmailOneTimeAccessAsAdminEnabled           AppConfigValue `json:"emailOneTimeAccessAsAdminEnabled" env:"EMAIL_ONE_TIME_ACCESS_AS_ADMIN_ENABLED" type:"bool" public:"true"`
 	EmailApiKeyExpirationEnabled               AppConfigValue `json:"emailApiKeyExpirationEnabled" env:"EMAIL_API_KEY_EXPIRATION_ENABLED" type:"bool"`
-	EmailVerificationEnabled                   AppConfigValue `json:"emailVerificationEnabled" env:"EMAIL_VERIFICATION_ENABLED" type:"bool" public:"true"`
+	EmailVerification                          AppConfigValue `json:"emailVerification" env:"EMAIL_VERIFICATION" public:"true"`
 	// LDAP
 	LdapEnabled                        AppConfigValue `json:"ldapEnabled" env:"LDAP_ENABLED" type:"bool" public:"true"`
 	LdapUrl                            AppConfigValue `json:"ldapUrl" env:"LDAP_URL"`
@@ -145,7 +158,7 @@ func getDefaultConfig() *AppConfigModel {
 		EmailOneTimeAccessAsUnauthenticatedEnabled: "false",
 		EmailOneTimeAccessAsAdminEnabled:           "false",
 		EmailApiKeyExpirationEnabled:               "false",
-		EmailVerificationEnabled:                   "false",
+		EmailVerification:                          EmailVerificationDisabled,
 		// LDAP
 		LdapEnabled:                        "false",
 		LdapUrl:                            "",

backend/internal/appconfig/model_test.go

@@ -1,6 +1,7 @@
 package appconfig
 
 import (
+	"encoding/json"
 	"errors"
 	"reflect"
 	"strings"
@@ -300,3 +301,27 @@ func TestAppConfigModel_Update(t *testing.T) {
 		assert.Equal(t, "thisKeyDoesNotExist", notFound.field)
 	})
 }
+
+func TestAppConfigModel_UnmarshalJSON(t *testing.T) {
+	t.Run("maps the legacy email verification toggle to a mode", func(t *testing.T) {
+		tests := map[string]AppConfigValue{
+			"true":  EmailVerificationOptional,
+			"false": EmailVerificationDisabled,
+		}
+		for enabled, expected := range tests {
+			var m AppConfigModel
+			err := json.Unmarshal([]byte(`{"emailVerificationEnabled":"`+enabled+`"}`), &m)
+			require.NoError(t, err)
+
+			assert.Equal(t, expected, m.EmailVerification)
+		}
+	})
+
+	t.Run("an explicit email verification mode wins over the legacy toggle", func(t *testing.T) {
+		var m AppConfigModel
+		err := json.Unmarshal([]byte(`{"emailVerification":"required","emailVerificationEnabled":"false"}`), &m)
+		require.NoError(t, err)
+
+		assert.Equal(t, AppConfigValue(EmailVerificationRequired), m.EmailVerification)
+	})
+}

backend/internal/appconfig/service.go

@@ -247,6 +247,17 @@ func (s *AppConfigService) loadDbConfigFromEnv() (*AppConfigModel, error) {
 		}
 	}
 
+	// TODO: Remove in next major version (v3)
+	// Preserve the old environment setting unless an explicit email verification mode replaces it
+	if _, ok := os.LookupEnv("EMAIL_VERIFICATION"); !ok {
+		if enabled, exists := os.LookupEnv("EMAIL_VERIFICATION_ENABLED"); exists {
+			if enabled != "true" && enabled != "false" {
+				return nil, errors.New("EMAIL_VERIFICATION_ENABLED must be true or false")
+			}
+			dest.EmailVerification = legacyEmailVerification(AppConfigValue(enabled))
+		}
+	}
+
 	// Validate the resolved configuration before exposing values to the rest of the application
 	err := validateEnvConfig(dest)
 	if err != nil {

backend/internal/appconfig/service_test.go

@@ -462,6 +462,37 @@ func TestService_CIMDURLAllowlist(t *testing.T) {
 }
 
 func TestService_LoadDbConfigFromEnv(t *testing.T) {
+	t.Run("required verification rejects conflicting settings", func(t *testing.T) {
+		for _, setting := range []struct{ name, value string }{
+			{"EMAILS_VERIFIED", "true"},
+			{"REQUIRE_USER_EMAIL", "false"},
+			{"SMTP_HOST", ""},
+			{"SMTP_FROM", ""},
+		} {
+			t.Run(setting.name, func(t *testing.T) {
+				t.Setenv("EMAIL_VERIFICATION", "required")
+				t.Setenv("EMAILS_VERIFIED", "false")
+				t.Setenv("REQUIRE_USER_EMAIL", "true")
+				t.Setenv("SMTP_HOST", "smtp.example.com")
+				t.Setenv("SMTP_FROM", "pocket-id@example.com")
+				t.Setenv(setting.name, setting.value)
+
+				_, err := (&AppConfigService{}).loadDbConfigFromEnv()
+				require.ErrorContains(t, err, "EMAIL_VERIFICATION requires user emails, an SMTP host and sender address, and forbids emails verified by default")
+			})
+		}
+	})
+
+	t.Run("required verification accepts consistent settings", func(t *testing.T) {
+		t.Setenv("EMAIL_VERIFICATION", "required")
+		t.Setenv("SMTP_HOST", "smtp.example.com")
+		t.Setenv("SMTP_FROM", "pocket-id@example.com")
+
+		cfg, err := (&AppConfigService{}).loadDbConfigFromEnv()
+		require.NoError(t, err)
+		assert.Equal(t, AppConfigValue(EmailVerificationRequired), cfg.EmailVerification)
+	})
+
 	// writeSecretFile writes content to a file in a temporary directory that is removed when the test ends, returning its path
 	writeSecretFile := func(t *testing.T, content string) string {
 		t.Helper()

backend/internal/appconfig/testing_unit.go

@@ -3,6 +3,8 @@
 // This file contains utils for unit tests and it's only built when the "unit" tag is set
 package appconfig
 
+import "context"
+
 // NewTestAppConfigService is a function used by tests to create AppConfigService objects with pre-defined configuration values
 func NewTestAppConfigService(config *AppConfigModel) *AppConfigService {
 	if config == nil {
@@ -25,3 +27,12 @@ func NewTestConfig(config *AppConfigModel) *AppConfigModel {
 
 	return config
 }
+
+// StaticResolver is an AppConfigResolver for tests that always returns the same configuration, or the default one when none is set
+type StaticResolver struct {
+	Config *AppConfigModel
+}
+
+func (r StaticResolver) GetConfig(context.Context) (*AppConfigModel, error) {
+	return NewTestConfig(r.Config), nil
+}