feat: require verified email to publish, to prevent spam (#6777)

* feat: require verified email to create projects, collections and organizations

* fix(labrinth): fix tests

* chore: fmt

* chore: intl

apps/labrinth/src/auth/checks.rs

@@ -15,6 +15,16 @@ use crate::routes::ApiError;
 use futures::TryStreamExt;
 use itertools::Itertools;
 
+pub fn require_verified_email(user: &User) -> Result<(), ApiError> {
+    if !user.email_verified.unwrap_or(false) {
+        return Err(ApiError::Auth(eyre::eyre!(
+            "Please verify your email before publishing!"
+        )));
+    }
+
+    Ok(())
+}
+
 pub trait ValidateAuthorized {
     fn validate_authorized(
         &self,

apps/labrinth/src/auth/mod.rs

@@ -5,7 +5,7 @@ pub mod validate;
 pub use checks::{
     filter_enlisted_projects_ids, filter_enlisted_version_ids,
     filter_visible_collections, filter_visible_project_ids,
-    filter_visible_projects,
+    filter_visible_projects, require_verified_email,
 };
 use serde::{Deserialize, Serialize};
 pub use validate::{

apps/labrinth/src/routes/v3/collections.rs

@@ -1,5 +1,7 @@
 use crate::auth::checks::is_visible_collection;
-use crate::auth::{filter_visible_collections, get_user_from_headers};
+use crate::auth::{
+    filter_visible_collections, get_user_from_headers, require_verified_email,
+};
 use crate::database::PgPool;
 use crate::database::models::{
     collection_item, generate_collection_id, project_item,
@@ -76,6 +78,8 @@ pub async fn collection_create(
     .await?
     .1;
 
+    require_verified_email(&current_user)?;
+
     let limits =
         UserLimits::get_for_collections(&current_user, &client).await?;
     if limits.current >= limits.max {

apps/labrinth/src/routes/v3/organizations.rs

@@ -2,7 +2,9 @@ use std::collections::HashMap;
 
 use super::ApiError;
 use crate::auth::checks::is_visible_organization;
-use crate::auth::{filter_visible_projects, get_user_from_headers};
+use crate::auth::{
+    filter_visible_projects, get_user_from_headers, require_verified_email,
+};
 use crate::database::PgPool;
 use crate::database::models::team_item::DBTeamMember;
 use crate::database::models::{
@@ -131,6 +133,8 @@ pub async fn organization_create(
     .await?
     .1;
 
+    require_verified_email(&current_user)?;
+
     let limits =
         UserLimits::get_for_organizations(&current_user, &pool).await?;
     if limits.current >= limits.max {

apps/labrinth/src/routes/v3/project_creation.rs

@@ -1,5 +1,7 @@
 use super::version_creation::{InitialVersionData, try_create_version_fields};
-use crate::auth::{AuthenticationError, get_user_from_headers};
+use crate::auth::{
+    AuthenticationError, get_user_from_headers, require_verified_email,
+};
 use crate::database::PgPool;
 use crate::database::PgTransaction;
 use crate::database::models::loader_fields::{
@@ -107,6 +109,9 @@ impl From<crate::routes::ApiError> for CreateError {
             crate::routes::ApiError::CustomAuthentication(err) => {
                 Self::CustomAuthenticationError(err)
             }
+            crate::routes::ApiError::Auth(err) => {
+                Self::CustomAuthenticationError(format!("{err:#}"))
+            }
             crate::routes::ApiError::InvalidInput(err)
             | crate::routes::ApiError::Validation(err) => {
                 Self::InvalidInput(err)
@@ -491,6 +496,8 @@ async fn project_create_inner(
     )
     .await?;
 
+    require_verified_email(&current_user)?;
+
     let limits = UserLimits::get_for_projects(&current_user, pool).await?;
     if limits.current >= limits.max {
         return Err(CreateError::LimitReached);

apps/labrinth/src/routes/v3/project_creation/new.rs

@@ -6,7 +6,7 @@ use serde::{Deserialize, Serialize};
 use validator::Validate;
 
 use crate::{
-    auth::get_user_from_headers,
+    auth::{get_user_from_headers, require_verified_email},
     database::{
         PgPool,
         models::{
@@ -140,6 +140,8 @@ pub async fn create(
     .await
     .map_err(ApiError::from)?;
 
+    require_verified_email(&user)?;
+
     let limits = UserLimits::get_for_projects(&user, &db)
         .await
         .map_err(ApiError::from)?;

apps/labrinth/src/test/db.rs

@@ -1,7 +1,7 @@
 use crate::database::Executor;
 use eyre::{Context, Result};
 
-use crate::database::PgPool;
+use crate::database::{PgPool, models::DBUserId};
 
 /// Static personal access token for use in [`AppendPat`].
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -33,6 +33,25 @@ impl AppendPat for actix_web::test::TestRequest {
     }
 }
 
+/// Mark a user's email as verified without using the email verification flow.
+///
+/// # Errors
+///
+/// Errors if the user does not exist or could not be updated.
+pub async fn mark_email_verified(db: &PgPool, user_id: DBUserId) -> Result<()> {
+    let result = sqlx::query!(
+        "UPDATE users SET email_verified = TRUE WHERE id = $1",
+        user_id.0,
+    )
+    .execute(db)
+    .await
+    .wrap_err("failed to mark user email as verified")?;
+
+    eyre::ensure!(result.rows_affected() == 1, "user does not exist");
+
+    Ok(())
+}
+
 /// Dummy [`DBUserId`]s.
 ///
 /// [`DBUserId`]: crate::database::models::DBUserId
@@ -79,5 +98,15 @@ pub async fn add_dummy_data(db: &PgPool) -> Result<()> {
     .await
     .wrap_err("failed to add dummy data")?;
 
+    for user_id in [
+        user_id::ADMIN,
+        user_id::MODERATOR,
+        user_id::USER,
+        user_id::FRIEND,
+        user_id::ENEMY,
+    ] {
+        mark_email_verified(db, user_id).await?;
+    }
+
     Ok(())
 }

apps/labrinth/src/test/dummy_data.rs

@@ -21,7 +21,7 @@ use super::{
 
 use super::{database::USER_USER_ID, get_json_val_str};
 
-pub const DUMMY_DATA_UPDATE: i64 = 7;
+pub const DUMMY_DATA_UPDATE: i64 = 8;
 
 pub const DUMMY_CATEGORIES: &[&str] = &[
     "combat",