Auth: Fix email verification bypass when using basic authentication (#83492)

pkg/services/temp_user/tempuserimpl/store_test.go

@@ -112,7 +112,32 @@ func TestIntegrationTempUserCommandsAndQueries(t *testing.T) {
 		require.False(t, queryResult[0].EmailSentOn.UTC().Before(queryResult[0].Created.UTC()))
 	})
 
-	t.Run("Should be able expire temp user", func(t *testing.T) {
+	t.Run("Should be able expire all pending verifications from a user", func(t *testing.T) {
+		userID := int64(99)
+		verifications := 5
+		cmd := tempuser.CreateTempUserCommand{
+			OrgID:           -1,
+			Name:            "email-update",
+			Code:            "asd",
+			Email:           "e@as.co",
+			Status:          tempuser.TmpUserEmailUpdateStarted,
+			InvitedByUserID: userID,
+		}
+		db := db.InitTestDB(t)
+		store = &xormStore{db: db, cfg: db.Cfg}
+
+		for i := 0; i < verifications; i++ {
+			tempUser, err = store.CreateTempUser(context.Background(), &cmd)
+			require.Nil(t, err)
+		}
+
+		cmd2 := tempuser.ExpirePreviousVerificationsCommand{InvitedByUserID: userID}
+		err := store.ExpirePreviousVerifications(context.Background(), &cmd2)
+		require.Nil(t, err)
+		require.Equal(t, int64(verifications), cmd2.NumExpired)
+	})
+
+	t.Run("Should be able expire temp user related to org invite", func(t *testing.T) {
 		setup(t)
 		createdAt := time.Unix(tempUser.Created, 0)
 		cmd2 := tempuser.ExpireTempUsersCommand{OlderThan: createdAt.Add(1 * time.Second)}
@@ -128,4 +153,34 @@ func TestIntegrationTempUserCommandsAndQueries(t *testing.T) {
 			require.Equal(t, int64(0), cmd2.NumExpired)
 		})
 	})
+
+	t.Run("Should be able expire temp user related to email verification", func(t *testing.T) {
+		cmd := tempuser.CreateTempUserCommand{
+			OrgID:           2256,
+			Name:            "email-update",
+			Code:            "asd",
+			Email:           "e@as.co",
+			Status:          tempuser.TmpUserEmailUpdateStarted,
+			InvitedByUserID: 99,
+		}
+		db := db.InitTestDB(t)
+		store = &xormStore{db: db, cfg: db.Cfg}
+
+		tempUser, err = store.CreateTempUser(context.Background(), &cmd)
+		require.Nil(t, err)
+
+		createdAt := time.Unix(tempUser.Created, 0)
+		cmd2 := tempuser.ExpireTempUsersCommand{OlderThan: createdAt.Add(1 * time.Second)}
+		err := store.ExpireOldVerifications(context.Background(), &cmd2)
+		require.Nil(t, err)
+		require.Equal(t, int64(1), cmd2.NumExpired)
+
+		t.Run("Should do nothing when no temp users to expire", func(t *testing.T) {
+			createdAt := time.Unix(tempUser.Created, 0)
+			cmd2 := tempuser.ExpireTempUsersCommand{OlderThan: createdAt.Add(1 * time.Second)}
+			err := store.ExpireOldVerifications(context.Background(), &cmd2)
+			require.Nil(t, err)
+			require.Equal(t, int64(0), cmd2.NumExpired)
+		})
+	})
 }