Commit f18846ed2825e21ae697fa44397d56f2da714700

Thomas de Grivel 2021-12-28T07:13:44

email security notifications

diff --git a/lib/kmxgit/user_manager.ex b/lib/kmxgit/user_manager.ex
index 219b7d1..e09de07 100644
--- a/lib/kmxgit/user_manager.ex
+++ b/lib/kmxgit/user_manager.ex
@@ -75,11 +75,12 @@ defmodule Kmxgit.UserManager do
   end
 
   def update_user_email(user, token) do
+    old = user.email
     context = "change:#{user.email}"
-
     with {:ok, query} <- UserToken.verify_change_email_token_query(token, context),
          %UserToken{sent_to: email} <- Repo.one(query),
-         {:ok, _} <- Repo.transaction(user_email_multi(user, email, context)) do
+         {:ok, _} <- Repo.transaction(user_email_multi(user, email, context)),
+         _ <- UserNotifier.deliver_email_changed_email(old, email) do
       :ok
     else
       _ -> :error
@@ -117,8 +118,10 @@ defmodule Kmxgit.UserManager do
     |> Ecto.Multi.delete_all(:tokens, UserToken.user_and_contexts_query(user, :all))
     |> Repo.transaction()
     |> case do
-      {:ok, %{user: user}} -> {:ok, user}
-      {:error, :user, changeset, _} -> {:error, changeset}
+         {:ok, %{user: user}} ->
+           UserNotifier.deliver_password_changed_email(user)
+           {:ok, user}
+         {:error, :user, changeset, _} -> {:error, changeset}
     end
   end
 
@@ -202,9 +205,17 @@ defmodule Kmxgit.UserManager do
   end
 
   def update_user(%User{} = user, attrs) do
-    user
-    |> User.changeset(attrs)
-    |> Repo.update()
+    old_login = user.login
+    case user
+         |> User.changeset(attrs)
+         |> Repo.update() do
+      {:ok, u} ->
+        if u.login != old_login do
+          UserNotifier.deliver_login_changed_email(u, old_login, u.login)
+        end
+        {:ok, u}
+      x -> x
+    end
   end
 
   def admin_update_user(%User{} = user, attrs) do
diff --git a/lib/kmxgit/user_manager/user_notifier.ex b/lib/kmxgit/user_manager/user_notifier.ex
index c03bae7..a971577 100644
--- a/lib/kmxgit/user_manager/user_notifier.ex
+++ b/lib/kmxgit/user_manager/user_notifier.ex
@@ -22,9 +22,6 @@ defmodule Kmxgit.UserManager.UserNotifier do
   """
   def deliver_confirmation_instructions(user, url) do
     deliver(user.email, "Confirmation instructions", """
-
-    ==============================
-
     Hi #{user.email},
 
     You can confirm your account by visiting the URL below:
@@ -32,8 +29,6 @@ defmodule Kmxgit.UserManager.UserNotifier do
     #{url}
 
     If you didn't create an account with us, please ignore this.
-
-    ==============================
     """)
   end
 
@@ -42,9 +37,6 @@ defmodule Kmxgit.UserManager.UserNotifier do
   """
   def deliver_reset_password_instructions(user, url) do
     deliver(user.email, "Reset password instructions", """
-
-    ==============================
-
     Hi #{user.email},
 
     You can reset your password by visiting the URL below:
@@ -52,8 +44,6 @@ defmodule Kmxgit.UserManager.UserNotifier do
     #{url}
 
     If you didn't request this change, please ignore this.
-
-    ==============================
     """)
   end
 
@@ -62,9 +52,6 @@ defmodule Kmxgit.UserManager.UserNotifier do
   """
   def deliver_update_email_instructions(user, url) do
     deliver(user.email, "Update email instructions", """
-
-    ==============================
-
     Hi #{user.email},
 
     You can change your email by visiting the URL below:
@@ -72,8 +59,42 @@ defmodule Kmxgit.UserManager.UserNotifier do
     #{url}
 
     If you didn't request this change, please ignore this.
+    """)
+  end
+
+  def deliver_login_changed_email(user, old_login, new_login) do
+    deliver(user.email, "Your login was changed", """
+    Hi #{user.email},
+
+    Your login was changed from #{old_login} to #{new_login}.
+
+    If you didn't request this change, please reply to this e-mail.
+    """)
+  end
+
+  defp email_changed_email_body(email, old, new) do
+    """
+    Hi #{email},
+
+    Your e-mail address was changed from #{old} to #{new}.
+
+    If you didn't request this change, please reply to this e-mail.
+    """
+  end
+
+  def deliver_email_changed_email(old, new) do
+    subject = "Your email address was changed"
+    deliver(old, subject, email_changed_email_body(old, old, new))
+    deliver(new, subject, email_changed_email_body(new, old, new))
+  end
+
+  def deliver_password_changed_email(user) do
+    deliver(user.email, "Your password was changed", """
+    Hi #{user.email},
+
+    Your password was changed.
 
-    ==============================
+    If you didn't request this change, please reply to this e-mail.
     """)
   end
 end