Require verification after email change

When the User model is configured to require email verification,
then any change of the email address should trigger re-verification.

Author: loay

common/models/user.js

@@ -683,6 +683,19 @@ module.exports = function(User) {
 ctx.hookState.originalUserData=userInstances.map(function(u){
 return{id: u.id,email: u.email};
 });
+if(ctx.instance){
+varemailChanged=ctx.instance.email!==ctx.hookState.originalUserData[0].email;
+if(emailChanged&&ctx.Model.settings.emailVerificationRequired){
+ctx.instance.emailVerified=false;
+}
+}else{
+varemailChanged=ctx.hookState.originalUserData.some(function(data){
+returndata.email!=ctx.data.email;
+});
+if(emailChanged&&ctx.Model.settings.emailVerificationRequired){
+ctx.data.emailVerified=false;
+}
+}
 next();
 });
 });

test/user.test.js

@@ -2193,6 +2193,70 @@ describe('User', function() {
 });
 });
 
+describe('Verification after updating email',function(){
+varNEW_EMAIL='updated@example.com';
+varuserInstance;
+
+beforeEach(createOriginalUser);
+
+it('sets verification to false after email update if verification is required',
+function(done){
+User.settings.emailVerificationRequired=true;
+async.series([
+functionupdateUser(next){
+userInstance.updateAttribute('email',NEW_EMAIL,function(err,info){
+if(err)returnnext(err);
+assert.equal(info.email,NEW_EMAIL);
+next();
+});
+},
+functionfindUser(next){
+User.findById(userInstance.id,function(err,info){
+if(err)returnnext(err);
+assert.equal(info.email,NEW_EMAIL);
+assert.equal(info.emailVerified,false);
+next();
+});
+},
+],done);
+});
+
+it('leaves verification as is after email update if verification is not required',
+function(done){
+User.settings.emailVerificationRequired=false;
+async.series([
+functionupdateUser(next){
+userInstance.updateAttribute('email',NEW_EMAIL,function(err,info){
+if(err)returnnext(err);
+assert.equal(info.email,NEW_EMAIL);
+next();
+});
+},
+functionfindUser(next){
+User.findById(userInstance.id,function(err,info){
+if(err)returnnext(err);
+assert.equal(info.email,NEW_EMAIL);
+assert.equal(info.emailVerified,true);
+next();
+});
+},
+],done);
+});
+
+functioncreateOriginalUser(done){
+varuserData={
+email: 'original@example.com',
+password: 'bar',
+emailVerified: true,
+};
+User.create(userData,function(err,instance){
+if(err)returndone(err);
+userInstance=instance;
+done();
+});
+}
+});
+
 describe('password reset with/without email verification',function(){
 it('allows resetPassword by email if email verification is required and done',
 function(done){