[FEATURE] Ajouter une validation de l'email dans les liens de l'email d'avertissement de connexion après un an d'inactivité (PIX-16127)

api/db/seeds/data/team-acces/build-users.js

@@ -48,6 +48,15 @@ function _buildUsers(databaseBuilder) {
     email: '[email protected]',
     createdAt: new Date('2000-12-31'),
   });
+
+  // user with an old last logged-at date (>1 year) and no email confirmation date
+  const userWithOldLastLoggedAt = databaseBuilder.factory.buildUser.withRawPassword({
+    firstName: 'Old',
+    lastName: 'Connexion',
+    email: '[email protected]',
+    emailConfirmedAt: null,
+  });
+  databaseBuilder.factory.buildUserLogin({ userId: userWithOldLastLoggedAt.id, lastLoggedAt: new Date('1970-01-01') });
 }
 
 export function buildUsers(databaseBuilder) {

api/src/identity-access-management/domain/emails/create-warning-connection.email.js

@@ -10,12 +10,20 @@ import { mailer } from '../../../shared/mail/infrastructure/services/mailer.js';
  * @param {string} params.locale - The locale for the email.
  * @param {string} params.email - The recipient's email address.
  * @param {string} params.firstName - The recipient's first name.
+ * @param {string} params.validationToken - The token for email validation.
  * @returns {Email} The email object.
  */
-export function createWarningConnectionEmail({ locale, email, firstName }) {
+export function createWarningConnectionEmail({ locale, email, firstName, validationToken }) {
   locale = locale || LOCALE.FRENCH_FRANCE;
   const lang = new Intl.Locale(locale).language;
-  const factory = new EmailFactory({ app: 'pix-app', locale });
+  let localeSupport;
+  if (locale.toLowerCase() === LOCALE.FRENCH_FRANCE) {
+    localeSupport = LOCALE.FRENCH_FRANCE;
+  } else {
+    localeSupport = lang;
+  }
+
+  const factory = new EmailFactory({ app: 'pix-app', locale: localeSupport });
 
   const { i18n, defaultVariables } = factory;
   const pixAppUrl = urlBuilder.getPixAppBaseUrl(locale);
@@ -28,7 +36,11 @@ export function createWarningConnectionEmail({ locale, email, firstName }) {
     variables: {
       homeName: defaultVariables.homeName,
       homeUrl: defaultVariables.homeUrl,
-      helpDeskUrl: defaultVariables.helpdeskUrl,
+      helpDeskUrl: urlBuilder.getEmailValidationUrl({
+        locale: localeSupport,
+        redirectUrl: defaultVariables.helpdeskUrl,
+        token: validationToken,
+      }),
       displayNationalLogo: defaultVariables.displayNationalLogo,
       contactUs: i18n.__('common.email.contactUs'),
       doNotAnswer: i18n.__('common.email.doNotAnswer'),
@@ -39,7 +51,11 @@ export function createWarningConnectionEmail({ locale, email, firstName }) {
       disclaimer: i18n.__('warning-connection-email.params.disclaimer'),
       warningMessage: i18n.__('warning-connection-email.params.warningMessage'),
       resetMyPassword: i18n.__('warning-connection-email.params.resetMyPassword'),
-      resetUrl,
+      resetUrl: urlBuilder.getEmailValidationUrl({
+        locale: localeSupport,
+        redirectUrl: resetUrl,
+        token: validationToken,
+      }),
       supportContact: i18n.__('warning-connection-email.params.supportContact'),
       thanks: i18n.__('warning-connection-email.params.thanks'),
       signing: i18n.__('warning-connection-email.params.signing'),

api/src/identity-access-management/domain/usecases/authenticate-user.js

@@ -17,6 +17,7 @@ const authenticateUser = async function ({
   userLoginRepository,
   adminMemberRepository,
   emailRepository,
+  emailValidationDemandRepository,
   audience,
 }) {
   try {
@@ -49,11 +50,13 @@ const authenticateUser = async function ({
 
     const userLogin = await userLoginRepository.findByUserId(foundUser.id);
     if (foundUser.email && userLogin?.shouldSendConnectionWarning()) {
+      const validationToken = await emailValidationDemandRepository.save(foundUser.id);
       await emailRepository.sendEmailAsync(
         createWarningConnectionEmail({
           locale: foundUser.locale,
           email: foundUser.email,
           firstName: foundUser.firstName,
+          validationToken,
         }),
       );
     }

api/tests/identity-access-management/unit/domain/emails/create-warning-connection.email.test.js

@@ -9,6 +9,7 @@ describe('Unit | Identity Access Management | Domain | Email | create-warning-co
       email: '[email protected]',
       locale: 'fr',
       firstName: 'John',
+      validationToken: 'token',
     };
 
     const email = createWarningConnectionEmail(emailParams);
@@ -40,56 +41,100 @@ describe('Unit | Identity Access Management | Domain | Email | create-warning-co
   });
 
   describe('when the locale is en', function () {
-    it('provides the correct reset password URL', function () {
+    it('provides the correct urls', function () {
       // given
       const emailParams = {
         email: '[email protected]',
         locale: 'en',
         firstName: 'John',
+        validationToken: 'token',
       };
 
       // when
       const email = createWarningConnectionEmail(emailParams);
 
       // then
-      const resetUrl = email.variables.resetUrl;
-      expect(resetUrl).to.equal('https://test.app.pix.org/mot-de-passe-oublie?lang=en');
+      const { helpDeskUrl, resetUrl } = email.variables;
+      const expectedSupportUrl =
+        'https://test.app.pix.org/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Fpix.org%2Fen%2Fsupport';
+
+      const expectedResetUrl =
+        'https://test.app.pix.org/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Ftest.app.pix.org%2Fmot-de-passe-oublie%3Flang%3Den';
+      expect(resetUrl).to.equal(expectedResetUrl);
+      expect(helpDeskUrl).to.equal(expectedSupportUrl);
     });
   });
 
   describe('when the locale is fr-fr', function () {
-    it('provides the correct reset password URL', function () {
+    it('provides the correct urls', function () {
       // given
       const emailParams = {
         email: '[email protected]',
         locale: 'fr-fr',
         firstName: 'John',
+        validationToken: 'token',
       };
 
       // when
       const email = createWarningConnectionEmail(emailParams);
 
       // then
-      const resetUrl = email.variables.resetUrl;
-      expect(resetUrl).to.equal('https://test.app.pix.fr/mot-de-passe-oublie?lang=fr');
+      const { helpDeskUrl, resetUrl } = email.variables;
+      const expectedSupportUrl =
+        'https://test.app.pix.fr/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Fpix.fr%2Fsupport';
+      const expectedResetUrl =
+        'https://test.app.pix.fr/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Ftest.app.pix.fr%2Fmot-de-passe-oublie%3Flang%3Dfr';
+      expect(resetUrl).to.equal(expectedResetUrl);
+      expect(helpDeskUrl).to.equal(expectedSupportUrl);
+    });
+  });
+
+  describe('when the locale is fr', function () {
+    it('provides the correct urls', function () {
+      // given
+      const emailParams = {
+        email: '[email protected]',
+        locale: 'fr',
+        firstName: 'John',
+        validationToken: 'token',
+      };
+
+      // when
+      const email = createWarningConnectionEmail(emailParams);
+
+      // then
+      const { helpDeskUrl, resetUrl } = email.variables;
+      const expectedSupportUrl =
+        'https://test.app.pix.org/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Fpix.org%2Ffr%2Fsupport';
+      const expectedResetUrl =
+        'https://test.app.pix.org/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Ftest.app.pix.org%2Fmot-de-passe-oublie%3Flang%3Dfr';
+      expect(resetUrl).to.equal(expectedResetUrl);
+      expect(helpDeskUrl).to.equal(expectedSupportUrl);
     });
   });
 
   describe('when the locale is nl-BE', function () {
-    it('provides the correct reset password URL', function () {
+    it('provides the correct urls', function () {
       // given
       const emailParams = {
         email: '[email protected]',
         locale: 'nl-BE',
         firstName: 'John',
+        validationToken: 'token',
       };
 
       // when
       const email = createWarningConnectionEmail(emailParams);
 
       // then
-      const resetUrl = email.variables.resetUrl;
-      expect(resetUrl).to.equal('https://test.app.pix.org/mot-de-passe-oublie?lang=nl');
+      const { resetUrl, helpDeskUrl } = email.variables;
+      const expectedResetUrl =
+        'https://test.app.pix.org/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Ftest.app.pix.org%2Fmot-de-passe-oublie%3Flang%3Dnl';
+
+      const expectedSupportUrl =
+        'https://test.app.pix.org/api/users/validate-email?token=token&redirect_url=https%3A%2F%2Fpix.org%2Fnl-be%2Fsupport';
+      expect(resetUrl).to.equal(expectedResetUrl);
+      expect(helpDeskUrl).to.equal(expectedSupportUrl);
     });
   });
 });

api/tests/identity-access-management/unit/domain/usecases/authenticate-user_test.js

@@ -20,6 +20,7 @@ describe('Unit | Identity Access Management | Domain | UseCases | authenticate-u
   let adminMemberRepository;
   let pixAuthenticationService;
   let emailRepository;
+  let emailValidationDemandRepository;
   let clock;
 
   const userEmail = '[email protected]';
@@ -51,7 +52,7 @@ describe('Unit | Identity Access Management | Domain | UseCases | authenticate-u
     pixAuthenticationService = {
       getUserByUsernameAndPassword: sinon.stub(),
     };
-
+    emailValidationDemandRepository = { save: sinon.stub() };
     emailRepository = { sendEmailAsync: sinon.stub() };
   });
 
@@ -387,21 +388,21 @@ describe('Unit | Identity Access Management | Domain | UseCases | authenticate-u
           userId: user.id,
           lastLoggedAt: '2020-01-01',
         });
-
+        const validationToken = 'token';
         const expectedEmail = createWarningConnectionEmail({
           email: user.email,
           firstName: user.firstName,
           locale: user.locale,
+          validationToken,
         });
 
         pixAuthenticationService.getUserByUsernameAndPassword.resolves(user);
         tokenService.createAccessTokenFromUser
           .withArgs({ userId: user.id, source, audience })
           .resolves({ accessToken, expirationDelaySeconds });
-
+        emailValidationDemandRepository.save.withArgs(user.id).resolves(validationToken);
         userLoginRepository.findByUserId.resolves(userLogins);
 
-        // when
         await authenticateUser({
           username: userEmail,
           password,
@@ -413,6 +414,7 @@ describe('Unit | Identity Access Management | Domain | UseCases | authenticate-u
           userRepository,
           userLoginRepository,
           emailRepository,
+          emailValidationDemandRepository,
           audience,
         });