Remove all email tokens on email change (#2132)

remove all email tokens regardless of whether token was used to change email
bluesky-social · Feb 3, 2024 · dd021b8 · dd021b8
1 parent b6b854a
commit dd021b8
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 13 deletions.
diff --git a/packages/pds/src/account-manager/index.ts b/packages/pds/src/account-manager/index.ts
@@ -321,18 +321,14 @@ export class AccountManager {
     )
   }
 
-  async updateEmail(opts: { did: string; email: string; token?: string }) {
-    const { did, email, token } = opts
-    if (token) {
-      await this.db.transaction((dbTxn) =>
-        Promise.all([
-          account.updateEmail(dbTxn, did, email),
-          emailToken.deleteAllEmailTokens(dbTxn, did),
-        ]),
-      )
-    } else {
-      return account.updateEmail(this.db, did, email)
-    }
+  async updateEmail(opts: { did: string; email: string }) {
+    const { did, email } = opts
+    await this.db.transaction((dbTxn) =>
+      Promise.all([
+        account.updateEmail(dbTxn, did, email),
+        emailToken.deleteAllEmailTokens(dbTxn, did),
+      ]),
+    )
   }
 
   async resetPassword(opts: { password: string; token: string }) {

diff --git a/packages/pds/src/api/com/atproto/server/updateEmail.ts b/packages/pds/src/api/com/atproto/server/updateEmail.ts
@@ -45,7 +45,7 @@ export default function (server: Server, ctx: AppContext) {
       }
 
       try {
-        await ctx.accountManager.updateEmail({ did, email, token })
+        await ctx.accountManager.updateEmail({ did, email })
       } catch (err) {
         if (err instanceof UserAlreadyExistsError) {
           throw new InvalidRequestError(