diff --git a/app/models/user.rb b/app/models/user.rb index 835ed6d9b1a..0721acc7bc3 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -425,7 +425,10 @@ def has_devices? def authenticated_device?(cookie_uuid:) return false if cookie_uuid.blank? - devices.joins(:events).exists?(cookie_uuid:, events: { event_type: :sign_in_after_2fa }) + devices.joins(:events).exists?( + cookie_uuid:, + events: { event_type: [:account_created, :sign_in_after_2fa] }, + ) end # Returns the number of times the user has signed in, corresponding to the `sign_in_before_2fa` diff --git a/spec/features/new_device_tracking_spec.rb b/spec/features/new_device_tracking_spec.rb index a64a8e1179f..83fe171aca6 100644 --- a/spec/features/new_device_tracking_spec.rb +++ b/spec/features/new_device_tracking_spec.rb @@ -197,6 +197,26 @@ end end end + + context 'authenticating after new account creation from the same device' do + let(:user) do + user = sign_up_and_2fa_ial1_user + click_on t('links.sign_out') + user + end + + before do + user + reset_email + end + + it 'does not send a second user notification' do + visit new_user_session_path + sign_in_live_with_2fa(user) + + expect_delivered_email_count(0) + end + end end context 'user does not have existing devices' do diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 349819d5753..fa8143236da 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -1564,6 +1564,14 @@ def it_should_not_send_survey end it { expect(result).to eq(false) } + + context 'with account_created event' do + before do + create(:event, device:, event_type: :account_created) + end + + it { expect(result).to eq(true) } + end end context 'with existing device with sign_in_after_2fa event' do diff --git a/spec/support/features/session_helper.rb b/spec/support/features/session_helper.rb index 4658d9ef97a..d8dc562604b 100644 --- a/spec/support/features/session_helper.rb +++ b/spec/support/features/session_helper.rb @@ -137,9 +137,9 @@ def fill_in_password_and_submit(password) end def sign_up - user = create(:user, :unconfirmed) + email = Faker::Internet.safe_email + sign_up_with(email) confirm_last_user - user end def sign_up_and_set_password @@ -232,15 +232,18 @@ def user_with_piv_cac end def confirm_last_user + user = User.last @raw_confirmation_token, = Devise.token_generator.generate(EmailAddress, :confirmation_token) - User.last.email_addresses.first.update( + user.email_addresses.first.update( confirmation_token: @raw_confirmation_token, confirmation_sent_at: Time.zone.now, ) visit sign_up_create_email_confirmation_path( confirmation_token: @raw_confirmation_token, ) + + user end def click_send_one_time_code