fix(auth): reject a weak claim password before sending the code (#1648)

fluxer_app/src/features/auth/components/modals/ClaimAccountModal.tsx

@@ -60,6 +60,7 @@ export const ClaimAccountModal = observer(() => {
 	const [stage, setStage] = useState<Stage>('collect');
 	const [ticket, setTicket] = useState<string | null>(null);
 	const [originalProof, setOriginalProof] = useState<string | null>(null);
+	const [emailToken, setEmailToken] = useState<string | null>(null);
 	const [resendNewAt, setResendNewAt] = useState<Date | null>(null);
 	const [submittingAction, setSubmittingAction] = useState<boolean>(false);
 	const [now, setNow] = useState<number>(Date.now());
@@ -88,7 +89,7 @@ export const ClaimAccountModal = observer(() => {
 		if (!activeProof) {
 			throw new Error('Missing original proof token');
 		}
-		const result = await UserCommands.requestEmailChangeNew(activeTicket!, data.email, activeProof);
+		const result = await UserCommands.requestEmailChangeNew(activeTicket!, data.email, activeProof, data.newPassword);
 		setResendNewAt(result.resend_available_at ? new Date(result.resend_available_at) : null);
 		form.setValue('verificationCode', '');
 		form.clearErrors('verificationCode');
@@ -99,9 +100,14 @@ export const ClaimAccountModal = observer(() => {
 		if (!ticket || !originalProof) return;
 		setSubmittingAction(true);
 		try {
-			const {email_token} = await UserCommands.verifyEmailChangeNew(ticket, data.verificationCode, originalProof);
+			let activeEmailToken = emailToken;
+			if (!activeEmailToken) {
+				const verified = await UserCommands.verifyEmailChangeNew(ticket, data.verificationCode, originalProof);
+				activeEmailToken = verified.email_token;
+				setEmailToken(activeEmailToken);
+			}
 			await UserCommands.update({
-				email_token,
+				email_token: activeEmailToken,
 				new_password: data.newPassword,
 			});
 			ToastCommands.createToast({type: 'success', children: i18n._(ACCOUNT_CLAIMED_SUCCESSFULLY_DESCRIPTOR)});

fluxer_app/src/features/user/commands/UserCommands.ts

@@ -158,8 +158,14 @@ function requestNewEmailBody(
 	ticket: string,
 	newEmail: string,
 	originalProof: string,
-): {ticket: string; new_email: string; original_proof: string} {
-	return {ticket, new_email: newEmail, original_proof: originalProof};
+	newPassword?: string,
+): {ticket: string; new_email: string; original_proof: string; new_password?: string} {
+	return {
+		ticket,
+		new_email: newEmail,
+		original_proof: originalProof,
+		...(newPassword != null ? {new_password: newPassword} : {}),
+	};
 }
 
 function verifyNewEmailBody(
@@ -365,11 +371,12 @@ export async function requestEmailChangeNew(
 	ticket: string,
 	newEmail: string,
 	originalProof: string,
+	newPassword?: string,
 ): Promise<EmailChangeRequestNewResponse> {
 	try {
 		logger.debug('Requesting new email code');
 		const response = await http.post<EmailChangeRequestNewResponse>(Endpoints.USER_EMAIL_CHANGE_REQUEST_NEW, {
-			body: requestNewEmailBody(ticket, newEmail, originalProof),
+			body: requestNewEmailBody(ticket, newEmail, originalProof, newPassword),
 		});
 		return response.body;
 	} catch (error) {