При попытке запроса смены E-mail теперь происходит проверка, как давно был выполнен предыдущий запрос

2025-05-31 14:11:46 +05:30 · 2016-07-17 20:46:04 +03:00
parent e756dbacd6
commit 681996740d
11 changed files with 85 additions and 34 deletions
--- a/api/components/User/Component.php
+++ b/api/components/User/Component.php
@@ -20,6 +20,9 @@ use yii\web\User as YiiUserComponent;

 /**
 * @property AccountSession|null $activeSession
+ * @property AccountIdentity|null $identity
+ *
+ * @method AccountIdentity|null getIdentity()
 */
 class Component extends YiiUserComponent {

--- a/api/controllers/AccountsController.php
+++ b/api/controllers/AccountsController.php
@@ -7,6 +7,7 @@ use api\models\profile\ChangeEmail\NewEmailForm;
 use api\models\profile\ChangeLanguageForm;
 use api\models\profile\ChangePasswordForm;
 use api\models\profile\ChangeUsernameForm;
+use common\helpers\Error as E;
 use common\models\Account;
 use Yii;
 use yii\filters\AccessControl;
@@ -59,7 +60,6 @@ class AccountsController extends Controller {
    }

    public function actionCurrent() {
-        /** @var Account $account */
        $account = Yii::$app->user->identity;

        return [
@@ -76,7 +76,6 @@ class AccountsController extends Controller {
    }

    public function actionChangePassword() {
-        /** @var Account $account */
        $account = Yii::$app->user->identity;
        $model = new ChangePasswordForm($account);
        $model->load(Yii::$app->request->post());
@@ -108,15 +107,24 @@ class AccountsController extends Controller {
    }

    public function actionChangeEmailInitialize() {
-        /** @var Account $account */
        $account = Yii::$app->user->identity;
        $model = new InitStateForm($account);
        $model->load(Yii::$app->request->post());
        if (!$model->sendCurrentEmailConfirmation()) {
-            return [
+            $data = [
                'success' => false,
                'errors' => $this->normalizeModelErrors($model->getErrors()),
            ];
+
+            if (ArrayHelper::getValue($data['errors'], 'email') === E::RECENTLY_SENT_MESSAGE) {
+                $emailActivation = $model->getEmailActivation();
+                $data['data'] = [
+                    'canRepeatIn' => $emailActivation->canRepeatIn(),
+                    'repeatFrequency' => $emailActivation->repeatTimeout,
+                ];
+            }
+
+            return $data;
        }

        return [
@@ -125,7 +133,6 @@ class AccountsController extends Controller {
    }

    public function actionChangeEmailSubmitNewEmail() {
-        /** @var Account $account */
        $account = Yii::$app->user->identity;
        $model = new NewEmailForm($account);
        $model->load(Yii::$app->request->post());
@@ -142,7 +149,6 @@ class AccountsController extends Controller {
    }

    public function actionChangeEmailConfirmNewEmail() {
-        /** @var Account $account */
        $account = Yii::$app->user->identity;
        $model = new ConfirmNewEmailForm($account);
        $model->load(Yii::$app->request->post());
@@ -162,7 +168,6 @@ class AccountsController extends Controller {
    }

    public function actionChangeLang() {
-        /** @var Account $account */
        $account = Yii::$app->user->identity;
        $model = new ChangeLanguageForm($account);
        $model->load(Yii::$app->request->post());
--- a/api/controllers/Controller.php
+++ b/api/controllers/Controller.php
@@ -2,12 +2,9 @@
 namespace api\controllers;

 use api\traits\ApiNormalize;
-use Yii;
 use yii\filters\auth\HttpBearerAuth;

 /**
- * @property \common\models\Account|null $account
- *
 * Поведения:
 * @mixin \yii\filters\ContentNegotiator
 * @mixin \yii\filters\VerbFilter
@@ -31,11 +28,4 @@ class Controller extends \yii\rest\Controller {
        return $parentBehaviors;
    }

-    /**
-     * @return \common\models\Account|null
-     */
-    public function getAccount() {
-        return Yii::$app->getUser()->getIdentity();
-    }
-
 }
--- a/api/controllers/OauthController.php
+++ b/api/controllers/OauthController.php
@@ -116,7 +116,7 @@ class OauthController extends Controller {
        $grant = $this->getGrantType();
        try {
            $authParams = $grant->checkAuthorizeParams();
-            $account = $this->getAccount();
+            $account = Yii::$app->user->identity;
            /** @var \League\OAuth2\Server\Entity\ClientEntity $client */
            $client = $authParams['client'];
            /** @var \common\models\OauthClient $clientModel */
--- a/api/models/profile/ChangeEmail/InitStateForm.php
+++ b/api/models/profile/ChangeEmail/InitStateForm.php
@@ -2,6 +2,7 @@
 namespace api\models\profile\ChangeEmail;

 use api\models\base\PasswordProtectedForm;
+use common\helpers\Error as E;
 use common\models\Account;
 use common\models\confirmations\CurrentEmailConfirmation;
 use common\models\EmailActivation;
@@ -18,6 +19,7 @@ class InitStateForm extends PasswordProtectedForm {

    public function __construct(Account $account, array $config = []) {
        $this->account = $account;
+        $this->email = $account->email;
        parent::__construct($config);
    }

@@ -26,12 +28,20 @@ class InitStateForm extends PasswordProtectedForm {
    }

    public function rules() {
-        // TODO: поверить наличие уже отправленных подтверждений смены E-mail
        return array_merge(parent::rules(), [
-
+            ['email', 'validateFrequency'],
        ]);
    }

+    public function validateFrequency($attribute) {
+        if (!$this->hasErrors()) {
+            $emailConfirmation = $this->getEmailActivation();
+            if ($emailConfirmation !== null && !$emailConfirmation->canRepeat()) {
+                $this->addError($attribute, E::RECENTLY_SENT_MESSAGE);
+            }
+        }
+    }
+
    public function sendCurrentEmailConfirmation() : bool {
        if (!$this->validate()) {
            return false;
@@ -39,6 +49,7 @@ class InitStateForm extends PasswordProtectedForm {

        $transaction = Yii::$app->db->beginTransaction();
        try {
+            $this->removeOldCode();
            $activation = $this->createCode();
            $this->sendCode($activation);

@@ -66,6 +77,18 @@ class InitStateForm extends PasswordProtectedForm {
        return $emailActivation;
    }

+    /**
+     * Удаляет старый ключ активации, если он существует
+     */
+    public function removeOldCode() {
+        $emailActivation = $this->getEmailActivation();
+        if ($emailActivation === null) {
+            return;
+        }
+
+        $emailActivation->delete();
+    }
+
    public function sendCode(EmailActivation $code) {
        /** @var \yii\swiftmailer\Mailer $mailer */
        $mailer = Yii::$app->mailer;
@@ -91,4 +114,24 @@ class InitStateForm extends PasswordProtectedForm {
        }
    }

+    /**
+     * Возвращает E-mail активацию, которая использовалась внутри процесса для перехода на следующий шаг.
+     * Метод предназначен для проверки, не слишком ли часто отправляются письма о смене E-mail.
+     * Проверяем тип подтверждения нового E-mail, поскольку при переходе на этот этап, активация предыдущего
+     * шага удаляется.
+     * @return EmailActivation|null
+     * @throws ErrorException
+     */
+    public function getEmailActivation() {
+        return $this->getAccount()
+            ->getEmailActivations()
+            ->andWhere([
+                'type' => [
+                    EmailActivation::TYPE_CURRENT_EMAIL_CONFIRMATION,
+                    EmailActivation::TYPE_NEW_EMAIL_CONFIRMATION,
+                ],
+            ])
+            ->one();
+    }
+
 }
--- a/autocompletion.php
+++ b/autocompletion.php
@@ -30,6 +30,8 @@ abstract class BaseApplication extends yii\base\Application {
 * @property \api\components\User\Component $user User component.
 * @property \api\components\ReCaptcha\Component $reCaptcha
 * @property \common\components\oauth\Component $oauth
+ *
+ * @method \api\components\User\Component getUser()
 */
 class WebApplication extends yii\web\Application {
 }
--- a/common/models/EmailActivation.php
+++ b/common/models/EmailActivation.php
@@ -4,7 +4,6 @@ namespace common\models;
 use common\behaviors\DataBehavior;
 use common\behaviors\EmailActivationExpirationBehavior;
 use common\components\UserFriendlyRandomKey;
-use Yii;
 use yii\base\InvalidConfigException;
 use yii\behaviors\TimestampBehavior;
 use yii\db\ActiveRecord;
@@ -45,7 +44,7 @@ class EmailActivation extends ActiveRecord {
            ],
            'expirationBehavior' => [
                'class' => EmailActivationExpirationBehavior::class,
-                'repeatTimeout' => 5 * 60,
+                'repeatTimeout' => 5 * 60, // 5m
                'expirationTimeout' => -1,
            ],
            'dataBehavior' => [
--- a/common/models/confirmations/CurrentEmailConfirmation.php
+++ b/common/models/confirmations/CurrentEmailConfirmation.php
@@ -9,8 +9,8 @@ class CurrentEmailConfirmation extends EmailActivation {
    public function behaviors() {
        return ArrayHelper::merge(parent::behaviors(), [
            'expirationBehavior' => [
-                'repeatTimeout' => 6 * 60 * 60,
-                'expirationTimeout' => 1 * 60 * 60,
+                'repeatTimeout' => 6 * 60 * 60, // 6h
+                'expirationTimeout' => 1 * 60 * 60, // 1h
            ],
        ]);
    }
--- a/tests/codeception/api/functional/AccountsChangeEmailInitializeCest.php
+++ b/tests/codeception/api/functional/AccountsChangeEmailInitializeCest.php
@@ -1,7 +1,6 @@
 <?php
 namespace tests\codeception\api\functional;

-use Codeception\Specify;
 use tests\codeception\api\_pages\AccountsRoute;
 use tests\codeception\api\FunctionalTester;

@@ -28,4 +27,19 @@ class AccountsChangeEmailInitializeCest {
        ]);
    }

+    public function testChangeEmailInitializeFrequencyError(FunctionalTester $I) {
+        $I->wantTo('see change email request frequency error');
+        $I->loggedInAsActiveAccount('ILLIMUNATI', 'password_0');
+
+        $this->route->changeEmailInitialize('password_0');
+        $I->canSeeResponseContainsJson([
+            'success' => false,
+            'errors' => [
+                'email' => 'error.recently_sent_message',
+            ],
+        ]);
+        $I->canSeeResponseJsonMatchesJsonPath('$.data.canRepeatIn');
+        $I->canSeeResponseJsonMatchesJsonPath('$.data.repeatFrequency');
+    }
+
 }
--- a/tests/codeception/api/unit/models/profile/ChangeEmail/NewEmailFormTest.php
+++ b/tests/codeception/api/unit/models/profile/ChangeEmail/NewEmailFormTest.php
@@ -62,14 +62,15 @@ class NewEmailFormTest extends DbTestCase {
    public function testSendNewEmailConfirmation() {
        $this->specify('send email', function() {
            /** @var Account $account */
-            $account = Account::findOne($this->accounts['admin']['id']);
+            $account = Account::findOne($this->accounts['account-with-change-email-init-state']['id']);
            /** @var NewEmailForm $model */
+            $key = $this->emailActivations['currentChangeEmailConfirmation']['key'];
            $model = new NewEmailForm($account, [
-                'key' => $this->emailActivations['currentEmailConfirmation']['key'],
+                'key' => $key,
                'email' => 'my-new-email@ely.by',
            ]);
            expect($model->sendNewEmailConfirmation())->true();
-            expect(EmailActivation::findOne($this->emailActivations['currentEmailConfirmation']['key']))->null();
+            expect(EmailActivation::findOne($key))->null();
            expect(EmailActivation::findOne([
                'account_id' => $account->id,
                'type' => EmailActivation::TYPE_NEW_EMAIL_CONFIRMATION,
--- a/tests/codeception/common/fixtures/data/email-activations.php
+++ b/tests/codeception/common/fixtures/data/email-activations.php
@@ -24,12 +24,6 @@ return [
        'type' => \common\models\EmailActivation::TYPE_FORGOT_PASSWORD_KEY,
        'created_at' => time() - (new \common\models\confirmations\ForgotPassword())->repeatTimeout - 10,
    ],
-    'currentEmailConfirmation' => [
-        'key' => 'H26HBDCHHAG2HGHGHS',
-        'account_id' => 1,
-        'type' => \common\models\EmailActivation::TYPE_CURRENT_EMAIL_CONFIRMATION,
-        'created_at' => time() - 10,
-    ],
    'currentChangeEmailConfirmation' => [
        'key' => 'H27HBDCHHAG2HGHGHS',
        'account_id' => 7,