fix #712: check if token is already verified before sending email

controllers/user.js

@@ -38,10 +38,7 @@ async function add(req, res) {
 }
 
 
-async function verify(req, res) {
-  if (!req.query.token) {
-    throw new FluentError("user-verify-token-error");
-  }
+async function _verify(req) {
   const verifiedEmailHash = await DB.verifyEmailHash(req.query.token);
 
   let unsafeBreachesForEmail = [];
@@ -67,6 +64,20 @@ async function verify(req, res) {
       whichView: "email_partials/report",
     }
   );
+}
+
+
+async function verify(req, res) {
+  if (!req.query.token) {
+    throw new FluentError("user-verify-token-error");
+  }
+  const existingSubscriber = await DB.getSubscriberByToken(req.query.token);
+  if (!existingSubscriber) {
+    throw new FluentError("error-not-subscribed");
+  }
+  if (!existingSubscriber.verified) {
+    await _verify(req);
+  }
 
   res.render("subpage", {
     headline: req.fluentFormat("confirmation-headline"),

tests/controllers/user.test.js

@@ -15,6 +15,8 @@ require("../resetDB");
 jest.mock("../../email-utils");
 jest.mock("../../hibp");
 
+const mockRequest = { fluentFormat: jest.fn() };
+
 
 test("user add POST with email adds unverified subscriber and sends verification email", async () => {
     // Set up test context
@@ -84,6 +86,24 @@ test("user verify request with valid token verifies user", async () => {
 });
 
 
+test("user verify request for already verified user doesn't send extra email", async () => {
+  const alreadyVerifiedToken = "54010800-6c3c-4186-971a-76dc92874941";
+  // Set up mocks
+  EmailUtils.sendEmail = jest.fn();
+  mockRequest.query = { token: alreadyVerifiedToken };
+  mockRequest.app = { locals: { breaches: testBreaches } };
+  const resp = httpMocks.createResponse();
+
+  // Call code-under-test
+  await user.verify(mockRequest, resp);
+
+  expect(resp.statusCode).toEqual(200);
+  const subscriber = await DB.getSubscriberByToken(alreadyVerifiedToken);
+  expect(subscriber.verified).toBeTruthy();
+  expect(EmailUtils.sendEmail).not.toHaveBeenCalled();
+});
+
+
 test("user verify request with invalid token returns error", async () => {
   const invalidToken = "123456789";