fix(config): Add config for unverified account to exist before second…

…ary email can be create with the same email (#1845) r=vladikoff
mozilla · Apr 20, 2017 · d0b5976 · d0b5976
1 parent 3d80e82
commit d0b5976
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 3 deletions.
diff --git a/config/dev.json b/config/dev.json
@@ -27,5 +27,8 @@
     "ipProfiling": {
       "allowedRecency": 0
     }
+  },
+  "secondaryEmail": {
+    "enabled": true
   }
 }
diff --git a/config/index.js b/config/index.js
@@ -755,6 +755,12 @@ var conf = convict({
       default: false,
       format: Boolean,
       env: 'SECONDARY_EMAIL_ENABLED'
+    },
+    minUnverifiedAccountTime: {
+      doc: 'The minimum amount of time an account can be unverified before another account can use it for secondary email',
+      default: '1 day',
+      format: 'duration',
+      env: 'SECONDARY_EMAIL_MIN_UNVERIFIED_ACCOUNT_TIME'
     }
   }
 })

diff --git a/lib/routes/account.js b/lib/routes/account.js
@@ -2092,8 +2092,9 @@ module.exports = (
               // a day, if so, delete account so another user can add it as a
               // secondary email
               const msSinceCreated = Date.now() - emailRecord.createdAt
-              if (msSinceCreated >= MS_ONE_DAY) {
-                return db.deleteAccount(emailRecord.uid)
+              const minUnverifiedAccountTime = config.secondaryEmail.minUnverifiedAccountTime
+              if (msSinceCreated >= minUnverifiedAccountTime) {
+                return db.deleteAccount(emailRecord)
               } else {
                 throw error.unverifiedPrimaryEmailNewlyCreated()
               }

diff --git a/test/local/routes/recovery_email.js b/test/local/routes/recovery_email.js
@@ -615,7 +615,8 @@ describe('/recovery_email', () => {
       },
       config: {
         secondaryEmail: {
-          enabled: true
+          enabled: true,
+          minUnverifiedAccountTime: MS_IN_DAY
         }
       },
       customs: mockCustoms,