feat: add ability to force email verification (#1837)

backend/internal/bootstrap/route_coverage_test.go

@@ -45,7 +45,7 @@ func TestEveryAPIRouteDeclaresItsAccess(t *testing.T) {
 	}
 
 	engine := gin.New()
-	auth := middleware.NewAuthorization(nil, nil, nil)
+	auth := middleware.NewAuthorization(nil, nil, nil, nil)
 	require.NoError(t, registerRoutes(engine, nil, svc, auth, nil))
 
 	// Collect every API route that bypassed the authz routers

backend/internal/bootstrap/router_bootstrap.go

@@ -40,7 +40,7 @@ func initRouter(db *gorm.DB, svc *services, rateLimitServices map[string]*rateli
 	if err != nil {
 		return nil, err
 	}
-	auth := middleware.NewAuthorization(svc.apiKeyModule, svc.userService, svc.jwtService)
+	auth := middleware.NewAuthorization(svc.apiKeyModule, svc.userService, svc.jwtService, svc.appConfigService)
 	err = registerRoutes(r, db, svc, auth, rateLimitServices)
 	if err != nil {
 		return nil, err
@@ -171,7 +171,7 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, auth *authz.Middl
 		rateLimitMiddleware.Add(middleware.RateLimitDeviceLoginVerification),
 	)
 	controller.NewOidcController(apiRouter, fileSizeLimitMiddleware, svc.oidcService, svc.appConfigService)
-	controller.NewUserController(apiRouter, fileSizeLimitMiddleware, svc.appConfigService, svc.userService, svc.webauthnModule, rateLimitMiddleware.Add(middleware.RateLimitUpdateOwnAccount))
+	controller.NewUserController(apiRouter, fileSizeLimitMiddleware, svc.appConfigService, svc.userService, svc.webauthnModule, rateLimitMiddleware.Add(middleware.RateLimitSendEmailVerification))
 	controller.NewAppConfigController(apiRouter, svc.appConfigService, svc.emailModule)
 	svc.ldapSyncModule.RegisterRoutes(apiRouter)
 	controller.NewAppImagesController(apiRouter, fileSizeLimitMiddleware, svc.appImagesService)

backend/internal/bootstrap/services_bootstrap.go

@@ -175,6 +175,7 @@ func initServices(
 		Reauth:       svc.webauthnModule,
 		AuditLog:     svc.auditLogsModule,
 		APIAccess:    svc.apiModule,
+		AppConfig:    svc.appConfigService,
 		// Disable in test environment
 		CleanupDisabled: common.EnvConfig.AppEnv.IsTest(),
 	})
@@ -193,7 +194,20 @@ func initServices(
 	}
 
 	svc.userGroupService = service.NewUserGroupService(db, svc.scimSyncModule, backchannelLogoutService)
-	svc.userService = service.NewUserService(db, svc.jwtService, svc.customClaimService, svc.appImagesService, svc.scimSyncModule, backchannelLogoutService, fileStorage)
+	// The user service sends verification links through this module, so it's created first and never depends on the user service itself
+	svc.emailVerificationModule, err = emailverification.New(emailverification.Dependencies{
+		DB:          db,
+		Actors:      actors,
+		EmailSender: svc.emailModule,
+		ScimSync:    svc.scimSyncModule,
+		AppConfig:   svc.appConfigService,
+		AppURL:      common.EnvConfig.AppURL,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create email verification module: %w", err)
+	}
+
+	svc.userService = service.NewUserService(db, svc.jwtService, svc.customClaimService, svc.appImagesService, svc.scimSyncModule, backchannelLogoutService, fileStorage, svc.emailVerificationModule)
 
 	svc.ldapSyncModule, err = ldapsync.New(ldapsync.Dependencies{
 		DB:                db,
@@ -225,13 +239,17 @@ func initServices(
 	}
 
 	svc.userSignUpModule, err = usersignup.New(usersignup.Dependencies{
-		DB:          db,
-		Actors:      actors,
-		Signer:      svc.jwtService,
-		AuditLog:    svc.auditLogsModule,
-		UserCreator: svc.userService,
-		AppConfig:   svc.appConfigService,
-		ScimSync:    svc.scimSyncModule,
+		DB:                db,
+		Actors:            actors,
+		Signer:            svc.jwtService,
+		AuditLog:          svc.auditLogsModule,
+		UserCreator:       svc.userService,
+		AppConfig:         svc.appConfigService,
+		ScimSync:          svc.scimSyncModule,
+		UserDeleter:       svc.userService,
+		EmailVerification: svc.emailVerificationModule,
+		// Disable in test environment
+		CleanupDisabled: common.EnvConfig.AppEnv.IsTest(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create user signup module: %w", err)
@@ -250,18 +268,6 @@ func initServices(
 		return nil, fmt.Errorf("failed to create one-time access module: %w", err)
 	}
 
-	svc.emailVerificationModule, err = emailverification.New(emailverification.Dependencies{
-		DB:          db,
-		Actors:      actors,
-		Users:       svc.userService,
-		EmailSender: svc.emailModule,
-		AppConfig:   svc.appConfigService,
-		AppURL:      common.EnvConfig.AppURL,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to create email verification module: %w", err)
-	}
-
 	svc.environmentModule = environment.New(environment.Dependencies{
 		HTTPClient:                  httpClient,
 		SQLiteOnNetworkedFilesystem: sqliteOnNetworkedFilesystem,