LG-283 Fix password reset links sent to unconfirmed email address

app/mailers/user_mailer.rb

@@ -2,7 +2,8 @@ class UserMailer < ActionMailer::Base
   include Mailable
   include LocaleHelper
   before_action :attach_images
-  default from: email_with_name(Figaro.env.email_from, Figaro.env.email_from)
+  default from: email_with_name(Figaro.env.email_from, Figaro.env.email_from),
+          reply_to: email_with_name(Figaro.env.email_from, Figaro.env.email_from)
 
   def email_changed(old_email)
     mail(to: old_email, subject: t('mailer.email_change_notice.subject'))

spec/config/initializers/active_job_logger_patch_spec.rb

@@ -0,0 +1,36 @@
+require 'rails_helper'
+
+# Covers config/initializers/active_job_logger_patch.rb, which overrides
+# ActiveJob::Logging::LogSubscriber to standardize output and prevent sensitive
+# user data from being logged.
+describe ActiveJob::Logging::LogSubscriber do
+  it 'overrides the default job logger to output only specified parameters in JSON format' do
+    class FakeJob < ActiveJob::Base
+      def perform(sensitive_param:); end
+    end
+
+    # This list corresponds to the initializer's output
+    permitted_attributes = %w(
+      timestamp
+      event_type
+      job_class
+      job_queue
+      job_id
+      duration
+    )
+
+    # In this case, we need to assert before the action which logs, block-style to
+    # match the initializer
+    expect(Rails.logger).to receive(:info) do |&blk|
+      output = JSON.parse(blk.call)
+
+      # [Sidenote: The nested assertions don't seem to be reflected in the spec
+      # count--perhaps because of the uncommon block format?--but reversing them
+      # will show them failing as expected.]
+      output.keys.each { |k| expect(permitted_attributes).to include(k) }
+      expect(output.keys).to_not include('sensitive_param')
+    end
+
+    FakeJob.perform_later(sensitive_param: '111-22-3333')
+  end
+end

spec/features/users/user_edit_spec.rb

@@ -4,6 +4,8 @@
   let(:user) { create(:user, :signed_up) }
 
   context 'editing email' do
+    let(:new_email) { 'new_email@test.com' }
+
     before do
       sign_in_and_2fa_user(user)
       visit manage_email_path
@@ -15,6 +17,16 @@
 
       expect(page).to have_current_path manage_email_path
     end
+
+    scenario 'user receives confirmation message at new address' do
+      fill_in 'Email', with: new_email
+      click_button 'Update'
+
+      open_last_email
+      click_email_link_matching(/confirmation_token/)
+
+      expect(page).to have_content(new_email)
+    end
   end
 
   context 'editing 2FA phone number' do

spec/features/visitors/password_recovery_spec.rb

@@ -253,4 +253,29 @@
         to(include('style-src \'self\' \'unsafe-inline\''))
     end
   end
+
+  context 'user resets password with unconfirmed email address edit' do
+    let(:original_email) { 'original_email@test.com' }
+    let(:new_email) { 'new_email@test.com' }
+    let(:user) { create(:user, :signed_up, email: original_email) }
+
+    before do
+      sign_in_and_2fa_user(user)
+      visit manage_email_path
+    end
+
+    it 'receives password reset message at original address' do
+      fill_in 'Email', with: new_email
+      click_button 'Update'
+
+      expect(page).to have_content t('devise.registrations.email_update_needs_confirmation')
+
+      visit sign_out_url
+      click_link t('links.passwords.forgot')
+      fill_in 'password_reset_email_form_email', with: original_email
+      click_button t('forms.buttons.continue')
+
+      expect(open_last_email).to be_delivered_to(original_email)
+    end
+  end
 end