Merge pull request #14460 from overleaf/tm-prevent-checkout-unconfirmed-email

Restrict checkout page for users without confirmed primary email

GitOrigin-RevId: a02b0f64824f8adc8f15ae24b9132569bd1029f3

services/web/app/src/Features/Subscription/SubscriptionController.js

@@ -23,6 +23,7 @@ const OError = require('@overleaf/o-error')
 const SplitTestHandler = require('../SplitTests/SplitTestHandler')
 const SubscriptionHelper = require('./SubscriptionHelper')
 const Features = require('../../infrastructure/Features')
+const UserGetter = require('../User/UserGetter')
 
 const groupPlanModalOptions = Settings.groupPlanModalOptions
 const validGroupPlanModalOptions = {
@@ -193,6 +194,21 @@ async function paymentPage(req, res) {
         currency = recommendedCurrency
       }
 
+      // Prevent checkout for users without a confirmed primary email address
+      const userData = await UserGetter.promises.getUser(user._id, {
+        email: 1,
+        emails: 1,
+      })
+      const userPrimaryEmail = userData.emails.find(
+        emailEntry => emailEntry.email === userData.email
+      )
+      if (userPrimaryEmail?.confirmedAt == null) {
+        return res.render('subscriptions/unconfirmed-primary-email', {
+          title: 'confirm_email',
+          email: userData.email,
+        })
+      }
+
       // Block web sales to restricted countries
       if (['CU', 'IR', 'KP', 'RU', 'SY', 'VE'].includes(countryCode)) {
         return res.render('subscriptions/restricted-country', {

services/web/app/views/subscriptions/unconfirmed-primary-email.pug

@@ -0,0 +1,11 @@
+extends ../layout-marketing
+
+block content
+	main.content.content-alt#main-content
+		.container
+			.error-container
+				.error-details
+					p.error-status #{translate("confirm_email")}
+					p.error-description !{translate("please_confirm_email", {emailAddress: email})}
+					p.error-actions
+						a.error-btn(href="/user/settings") #{translate("account_settings")}