Do not 500 when resetting password for account with an unconfirmed email address that has since been confirmed by another account

app/forms/reset_password_form.rb

@@ -30,7 +30,7 @@ def valid_token
       # If the user is not saved in the database, that means looking them up by
       # their token failed
       errors.add(:reset_password_token, 'invalid_token', type: :invalid_token)
-    elsif !user.reset_password_period_valid?
+    elsif !user.reset_password_period_valid? || invalid_account?
       errors.add(:reset_password_token, 'token_expired', type: :token_expired)
     end
   end
@@ -56,6 +56,21 @@ def mark_profile_inactive
     user.proofing_component&.destroy
   end
 
+  # It is possible for an account that is resetting their password to be "invalid".
+  # If an unconfirmed account (which must have one unconfirmed email address) resets their
+  # password and a different account then adds and confirms that same email address,
+  # the initial account is no longer able to confirm their email address and is effectively invalid.
+  #
+  # They may still have a valid forgot password link for the initial account, which would normally
+  # mark their email as confirmed when they set a new password, but we do not want to allow it
+  # because we only allow an email address to be confirmed on one account.
+  def invalid_account?
+    !user.confirmed? &&
+      EmailAddress.confirmed.exists?(
+        email_fingerprint: user.email_addresses.map(&:email_fingerprint),
+      )
+  end
+
   def extra_analytics_attributes
     {
       user_id: user.uuid,

spec/forms/reset_password_form_spec.rb

@@ -150,6 +150,25 @@
       end
     end
 
+    context 'when the unconfirmed email address has been confirmed by another account' do
+      it 'does not raise an error and is not successful' do
+        user = create(:user, :unconfirmed)
+        user.update(reset_password_sent_at: Time.zone.now)
+        user2 = create(:user)
+        create(
+          :email_address, email: user.email_addresses.first.email, user_id: user2.id,
+                          confirmed_at: Time.zone.now
+        )
+
+        form = ResetPasswordForm.new(user)
+
+        result = form.submit(password: 'a good and powerful password')
+
+        expect(result.success?).to eq(false)
+        expect(result.errors).to eq({ reset_password_token: ['token_expired'] })
+      end
+    end
+
     it_behaves_like 'strong password', 'ResetPasswordForm'
   end
 end