From 85878cdd8b19bbb2da6d7f392b9e9bb56546d6b9 Mon Sep 17 00:00:00 2001
From: Antoine Clausse <antoine.clausse@overleaf.com>
Date: Thu, 31 Jul 2025 16:39:53 +0200
Subject: [PATCH] [web] Prevent 6-digits verification on SSO-emails (#27496)

* Rename token -> code

* Add test: don't verify SSO emails through the 6-digits verification

* Add a test on `/user/emails/resend-confirmation-code`

* Rename to `confirmationEmailMiddleware`

* Add `Modules.middleware('confirmationEmailMiddleware')` to `/user/emails/send-confirmation-code`

* Log attempted verifications of SAML emails

GitOrigin-RevId: ccc11831c860b219711cd57bba1a76ac975e71fb
---
 services/web/app/src/router.mjs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/web/app/src/router.mjs b/services/web/app/src/router.mjs
index 82b0bacbfa..8c98d97fbf 100644
--- a/services/web/app/src/router.mjs
+++ b/services/web/app/src/router.mjs
@@ -346,6 +346,7 @@ async function initialize(webRouter, privateApiRouter, publicApiRouter) {
     '/user/emails/send-confirmation-code',
     AuthenticationController.requireLogin(),
     RateLimiterMiddleware.rateLimit(rateLimiters.sendConfirmation),
+    await Modules.middleware('confirmationEmailMiddleware'),
     UserEmailsController.sendExistingEmailConfirmationCode
   )