Bind the registration confirmation token to the address it was mailed to

owner_email stays editable after the confirmation link goes out, and
clean_params deep-merges, so the token survived an address change - which
let a registrant point their own link at someone else's account and be
signed in as them. The token now records the address it was minted for and
reads as absent for any other, so the next send mints a fresh one.

Also from the review:

- Confirm an existing unconfirmed account, like sign_in_with_magic_link
  does. Without it the auth cookie was set for a user current_user won't
  resolve, so the registrant got "Logged in!" and then
  please_confirm_email, with the single-use token already spent.
- flash[:notice] rather than flash[:info], which isn't a
  UI::Alerts::Base::Component kind (it raised when rendered).
- bin/rake prepare_translations, for the i18n normalization spec.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sethherr

app/components/emails/register_confirmation/component.en.yml

@@ -3,13 +3,13 @@ en:
   components:
     emails:
       register_confirmation:
-        click_below_to_pick_up_where_you_left_off: >-
-          Click below to confirm this email address and pick up where you left off.
+        click_below_to_pick_up_where_you_left_off: Click below to confirm this email
+          address and pick up where you left off.
         confirm_and_continue: Confirm my email
         confirm_your_email: Confirm your email
         link_signs_you_in: >-
           This link signs you in to Bike Index, so don't forward it. It works for
           %{days} days.
         we_saved_your_registration_html: >-
-          We saved your registration for a <strong>%{color_and_brand}</strong> on the
-          world's most comprehensive bike registry.
+          We saved your registration for a <strong>%{color_and_brand}</strong> on
+          the world's most comprehensive bike registry.

app/controllers/register_controller.rb

@@ -124,7 +124,7 @@ def confirm_email
     # Someone else's session stays theirs - the registration is still finished for the
     # address that was emailed, it just isn't that account's own
     if current_user.present?
-      flash[:info] = translation(:signed_in_as_other, email: current_user.email) unless @b_param.self_made?(current_user)
+      flash[:notice] = translation(:signed_in_as_other, email: current_user.email) unless @b_param.self_made?(current_user)
     elsif sign_in_confirmed_user.blank?
       return redirect_to_current_step
     end
@@ -166,6 +166,8 @@ def sign_in_confirmed_user
       return nil
     end
 
+    # The link proved the address, so an account that had never confirmed it now has
+    user.confirm(user.confirmation_token) unless user.confirmed?
     sign_in_user(user)
     set_sign_in_flash(user, signed_up)
     @current_user = user

app/models/b_param.rb

@@ -455,14 +455,20 @@ def confirm_email!(creator_id: nil)
 
     update(creator_id: self.creator_id || creator_id,
       params: params.merge("email_confirmed_at" => Time.current)
-        .except("email_confirmation_token"))
+        .except("email_confirmation_token", "email_confirmation_email"))
   end
 
   # The emailed link's credential. Distinct from id_token, which is in the registrant's
   # own URL before any email goes out - only a secret that lived solely in the email
-  # proves the address received it
+  # proves the address received it. Nil once owner_email is edited to a different
+  # address, since all the token proves is that the one it was mailed to received it
   def email_confirmation_token
-    params["email_confirmation_token"]
+    params["email_confirmation_token"] if email_confirmation_email == EmailNormalizer.normalize(owner_email)
+  end
+
+  # The address the token in hand was mailed to
+  def email_confirmation_email
+    params["email_confirmation_email"]
   end
 
   def email_confirmation_token_matches?(token)
@@ -481,6 +487,7 @@ def email_confirmation_token_expired?
   def generate_email_confirmation_token!
     token = email_confirmation_token_expired? ? SecurityTokenizer.new_token : email_confirmation_token
     update(params: params.merge("email_confirmation_token" => token,
+      "email_confirmation_email" => EmailNormalizer.normalize(owner_email),
       "email_confirmation_sent_at" => Time.current))
     token
   end

config/locales/en.yml

@@ -1921,8 +1921,8 @@ en:
       acknowledge:
         acknowledge_everything: Check every box to agree to these rules
       confirm_email:
-        confirmation_link_expired: >-
-          That confirmation link has expired — check your email for a new one
+        confirmation_link_expired: That confirmation link has expired — check your
+          email for a new one
         signed_in_as_other: >-
           You're signed in as %{email}, so we kept you in that account. The registration
           is still saved to the address we emailed.
@@ -1931,10 +1931,11 @@ en:
         manufacturer_required: Manufacturer is required to register
         unable_to_save: We're unable to save that registration, please try again
       find_b_param:
-        registration_not_found: We couldn't find that registration — start a new one below
+        registration_not_found: We couldn't find that registration — start a new one
+          below
       sign_in_confirmed_user:
-        unable_to_sign_in: >-
-          We confirmed your email, but couldn't sign you in to that account
+        unable_to_sign_in: We confirmed your email, but couldn't sign you in to that
+          account
       update:
         name_required: Owner name is required to register
     search:

spec/models/b_param_spec.rb

@@ -906,7 +906,10 @@ def acparams(hash)
 
     context "expired token" do
       let(:expired_token) { SecurityTokenizer.new_token(Time.current - BParam::TOKEN_EXPIRATION - 1.day) }
-      before { b_param.update(params: b_param.params.merge("email_confirmation_token" => expired_token)) }
+      before do
+        b_param.update(params: b_param.params.merge("email_confirmation_token" => expired_token,
+          "email_confirmation_email" => b_param.owner_email))
+      end
 
       it "doesn't match, and mints a new token" do
         expect(b_param.email_confirmation_token_expired?).to be_truthy
@@ -916,5 +919,24 @@ def acparams(hash)
         expect(b_param.email_confirmation_token_expired?).to be_falsey
       end
     end
+
+    context "owner_email edited after the link went out" do
+      let!(:token) { b_param.generate_email_confirmation_token! }
+
+      it "drops the token - it only proves the address it was mailed to" do
+        b_param.clean_params({bike: {owner_email: "someone-else@example.com"}}.as_json)
+        b_param.save!
+        expect(b_param.reload.email_confirmation_token_matches?(token)).to be_falsey
+
+        # A link for the new address is a new token
+        expect(b_param.generate_email_confirmation_token!).to_not eq token
+      end
+
+      it "keeps the token when only the address's casing changes" do
+        b_param.clean_params({bike: {owner_email: "Owner@Example.com"}}.as_json)
+        b_param.save!
+        expect(b_param.reload.email_confirmation_token_matches?(token)).to be_truthy
+      end
+    end
   end
 end

spec/requests/register_request_spec.rb

@@ -1028,10 +1028,44 @@ def address_street_field
           # No account for the confirmed address - they're still signed in as themselves
           expect(User.count).to eq 1
           expect(Bike.last).to have_attributes(owner_email:, creator_id: current_user.id)
-          expect(flash[:info]).to be_present
           expect(response).to redirect_to step_path.call("finished")
+          follow_redirect!
+          expect(response.body).to include "signed in as #{current_user.email}"
         end
       end
     end
+
+    context "owner_email edited after the link went out" do
+      let!(:other_user) { FactoryBot.create(:user_confirmed, email: "someone-else@example.com") }
+      let(:step_1_params) { {b_param: {manufacturer_id: "Trek", cycle_type: "cargo", owner_email: other_user.email}} }
+
+      it "doesn't confirm the address the token was never mailed to" do
+        post base_url, params: step_1_params.merge(b_param_token: b_param.id_token)
+        expect(b_param.reload.owner_email).to eq other_user.email
+
+        expect { post "#{base_url}/confirm_email", params: confirm_params }
+          .to_not change(User, :count)
+        expect(b_param.reload.email_confirmed?).to be_falsey
+        expect(flash[:error]).to be_present
+        # Nobody signed in - the link only ever proved the address it was mailed to
+        get "/my_account"
+        expect(response.status).to eq 302
+      end
+    end
+
+    context "unconfirmed account for the address" do
+      let!(:unconfirmed_user) { FactoryBot.create(:user, email: owner_email) }
+
+      it "confirms it, since the link proved the address" do
+        expect { post "#{base_url}/confirm_email", params: confirm_params }
+          .to_not change(User, :count)
+        expect(unconfirmed_user.reload.confirmed).to be_truthy
+        expect(response).to redirect_to step_path.call("2")
+
+        # Actually signed in, rather than bounced to please_confirm_email
+        get "/my_account"
+        expect(response.status).to eq 200
+      end
+    end
   end
 end