count with same email and ip address

waisy-app · Dec 21, 2023 · 3b1df36 · 3b1df36
1 parent 1755025
commit 3b1df36
Show file tree

Hide file tree

Showing 4 changed files with 96 additions and 81 deletions.
diff --git a/src/email-verification/email-verification-sending-limit.service.ts b/src/email-verification/email-verification-sending-limit.service.ts
@@ -37,7 +37,10 @@ export class EmailVerificationSendingLimitService {
   private async getSendingAttemptsCount(senderIp: string, email: string): Promise<number> {
     const timeThreshold = new Date(Date.now() - this.lifetimeMilliseconds)
     const sendingAttemptsCount = await this.sendingAttemptRepository.count({
-      where: {senderIp, createdAt: MoreThan(timeThreshold)},
+      where: [
+        {senderIp, createdAt: MoreThan(timeThreshold)},
+        {email, createdAt: MoreThan(timeThreshold)},
+      ],
       take: this.maxSendingAttempts,
       cache: false,
     })

diff --git a/src/interceptors/timeout.interceptor.spec.ts b/src/interceptors/timeout.interceptor.spec.ts
diff --git a/test/email-verification/gql-send-verification-code-to-email.e2e-spec.ts b/test/email-verification/gql-send-verification-code-to-email.e2e-spec.ts
@@ -130,7 +130,7 @@ describe('sendVerificationCodeToEmail', () => {
       })
     })
 
-    it('should throw an error if sending attempts limit exceeded', async () => {
+    it('should throw an error if sending attempts limit exceeded with same ip', async () => {
       const emailVerificationCodeSendingAttemptRepository = app.get(
         getRepositoryToken(EmailVerificationCodeSendingAttempt),
       )
@@ -175,6 +175,96 @@ describe('sendVerificationCodeToEmail', () => {
       expect(emailVerificationCodeSendingAttempts).toEqual([attempt1, attempt2, attempt3])
     })
 
+    it('should throw an error if sending attempts limit exceeded with same email', async () => {
+      const email = '[email protected]'
+
+      const emailVerificationCodeSendingAttemptRepository = app.get(
+        getRepositoryToken(EmailVerificationCodeSendingAttempt),
+      )
+      const attempt1 = await emailVerificationCodeSendingAttemptRepository.save({
+        email,
+        senderIp: '::ffff:127.0.0.2',
+      })
+      const attempt2 = await emailVerificationCodeSendingAttemptRepository.save({
+        email,
+        senderIp: '::ffff:127.0.0.3',
+      })
+      const attempt3 = await emailVerificationCodeSendingAttemptRepository.save({
+        email,
+        senderIp: '::ffff:127.0.0.4',
+      })
+
+      const result = await gqlService.sendRequest({
+        queryType: 'mutation',
+        query: {
+          operation: 'sendVerificationCodeToEmail',
+          variables: {email: {type: 'String!', value: email}},
+        },
+      })
+
+      expect(result.body).toEqual({
+        errors: [
+          {
+            message:
+              'You have exceeded the limit of email verification requests for the last 10 minutes.',
+            locations: [{line: 2, column: 7}],
+            path: ['sendVerificationCodeToEmail'],
+            code: 'FORBIDDEN',
+          },
+        ],
+        data: null,
+      })
+
+      const emailVerificationCodeSendingAttempts =
+        await emailVerificationCodeSendingAttemptRepository.find({order: {createdAt: 'ASC'}})
+      expect(emailVerificationCodeSendingAttempts).toHaveLength(3)
+      expect(emailVerificationCodeSendingAttempts).toEqual([attempt1, attempt2, attempt3])
+    })
+
+    it('should throw an error if sending attempts limit exceeded with same email and ip', async () => {
+      const emailVerificationCodeSendingAttemptRepository = app.get(
+        getRepositoryToken(EmailVerificationCodeSendingAttempt),
+      )
+      const attempt1 = await emailVerificationCodeSendingAttemptRepository.save({
+        email: '[email protected]',
+        senderIp: '::ffff:127.0.0.1',
+      })
+      const attempt2 = await emailVerificationCodeSendingAttemptRepository.save({
+        email: '[email protected]',
+        senderIp: '::ffff:127.0.0.2',
+      })
+      const attempt3 = await emailVerificationCodeSendingAttemptRepository.save({
+        email: '[email protected]',
+        senderIp: '::ffff:127.0.0.1',
+      })
+
+      const result = await gqlService.sendRequest({
+        queryType: 'mutation',
+        query: {
+          operation: 'sendVerificationCodeToEmail',
+          variables: {email: {type: 'String!', value: '[email protected]'}},
+        },
+      })
+
+      expect(result.body).toEqual({
+        errors: [
+          {
+            message:
+              'You have exceeded the limit of email verification requests for the last 10 minutes.',
+            locations: [{line: 2, column: 7}],
+            path: ['sendVerificationCodeToEmail'],
+            code: 'FORBIDDEN',
+          },
+        ],
+        data: null,
+      })
+
+      const emailVerificationCodeSendingAttempts =
+        await emailVerificationCodeSendingAttemptRepository.find({order: {createdAt: 'ASC'}})
+      expect(emailVerificationCodeSendingAttempts).toHaveLength(3)
+      expect(emailVerificationCodeSendingAttempts).toEqual([attempt1, attempt2, attempt3])
+    })
+
     it('should throw InternalServerError', async () => {
       const emailVerificationSendingLimitService = app.get(EmailVerificationSendingLimitService)
       jest

diff --git a/test/email-verification/gql-verify-email-code.e2e-spec.ts b/test/email-verification/gql-verify-email-code.e2e-spec.ts
@@ -890,11 +890,6 @@ describe('VerifyEmailCode', () => {
         )
         jest
           .spyOn(inputLimitService, 'enforceEmailVerificationInputLimit')
-          .mockImplementation(async () => {})
-
-        const emailVerificationService = app.get(EmailVerificationService)
-        jest
-          .spyOn(emailVerificationService, 'verifyEmail')
           .mockImplementation(() => new Promise(resolve => setTimeout(resolve, 1)))
 
         const result = await gqlService.sendRequest({
@@ -1018,6 +1013,7 @@ describe('VerifyEmailCode', () => {
         app.get(getRepositoryToken(EmailVerificationCodeInputAttempt))
       const emailVerificationCodeInputAttempts =
         await emailVerificationCodeInputAttemptRepository.find()
+      expect(emailVerificationCodeInputAttempts.length).toEqual(1)
       expect(emailVerificationCodeInputAttempts).toEqual([
         {
           id: expect.any(String),