Skip sending emails to users with unverified email addresses

simonhamp · claude · simonhamp · commit 56863f488fc2 · 2026-04-13T17:54:17.000+01:00
Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/app/Console/Commands/GrantPluginToBundleOwners.php b/app/Console/Commands/GrantPluginToBundleOwners.php
@@ -47,7 +47,7 @@ public function handle(): int
             ->distinct()
             ->pluck('user_id');
 
-        $users = User::whereIn('id', $userIds)->get();
+        $users = User::whereIn('id', $userIds)->whereNotNull('email_verified_at')->get();
 
         if ($users->isEmpty()) {
             $this->warn('No users found who have purchased this bundle.');
diff --git a/app/Console/Commands/ResendNewPluginNotifications.php b/app/Console/Commands/ResendNewPluginNotifications.php
@@ -37,6 +37,7 @@ public function handle(): int
         }
 
         $recipients = User::query()
+            ->whereNotNull('email_verified_at')
             ->where('receives_new_plugin_notifications', true)
             ->whereNotIn('id', $plugins->pluck('user_id'))
             ->get();
diff --git a/app/Console/Commands/SendLegacyLicenseThankYou.php b/app/Console/Commands/SendLegacyLicenseThankYou.php
@@ -42,8 +42,8 @@ public function handle(): int
         foreach ($userLicenses as $userId => $licenses) {
             $user = $licenses->first()->user;
 
-            if (! $user) {
-                $this->warn("Skipping license(s) for user ID {$userId} - user not found");
+            if (! $user || ! $user->email_verified_at) {
+                $this->warn("Skipping license(s) for user ID {$userId} - user not found or email not verified");
                 $skipped++;
 
                 continue;
diff --git a/app/Console/Commands/SendLicenseExpiryWarnings.php b/app/Console/Commands/SendLicenseExpiryWarnings.php
@@ -68,7 +68,7 @@ private function sendWarningsForDays(int $days, bool $catchUp = false): int
         $licenses = $query->get();
 
         foreach ($licenses as $license) {
-            if ($license->user) {
+            if ($license->user && $license->user->email_verified_at) {
                 $license->user->notify(new LicenseExpiryWarning($license, $days));
 
                 // Track that we sent this warning
diff --git a/app/Console/Commands/SendMaxToUltraAnnouncement.php b/app/Console/Commands/SendMaxToUltraAnnouncement.php
@@ -29,6 +29,7 @@ public function handle(): int
         ]);
 
         $users = User::query()
+            ->whereNotNull('email_verified_at')
             ->whereHas('subscriptions', function ($query) use ($maxPriceIds) {
                 $query->where('stripe_status', 'active')
                     ->where('is_comped', false)
diff --git a/app/Console/Commands/SendPluginSubmissionReminders.php b/app/Console/Commands/SendPluginSubmissionReminders.php
@@ -23,6 +23,7 @@ public function handle(): int
         }
 
         $users = User::query()
+            ->whereNotNull('email_verified_at')
             ->whereHas('plugins', function ($query) {
                 $query->whereIn('status', [PluginStatus::Draft, PluginStatus::Pending, PluginStatus::Rejected]);
             })
diff --git a/app/Console/Commands/SendUltraFreeUserPromotion.php b/app/Console/Commands/SendUltraFreeUserPromotion.php
@@ -22,6 +22,7 @@ public function handle(): int
         }
 
         $users = User::query()
+            ->whereNotNull('email_verified_at')
             ->whereDoesntHave('licenses')
             ->whereDoesntHave('subscriptions')
             ->get();
diff --git a/app/Console/Commands/SendUltraLicenseHolderPromotion.php b/app/Console/Commands/SendUltraLicenseHolderPromotion.php
@@ -37,7 +37,7 @@ public function handle(): int
         foreach ($userLicenses as $userId => $licenses) {
             $user = $licenses->first()->user;
 
-            if (! $user) {
+            if (! $user || ! $user->email_verified_at) {
                 $skipped++;
 
                 continue;
diff --git a/app/Console/Commands/SendUltraUpgradePromotion.php b/app/Console/Commands/SendUltraUpgradePromotion.php
@@ -36,6 +36,7 @@ public function handle(): int
         $eligiblePriceIds = array_merge($miniPriceIds, $proPriceIds);
 
         $users = User::query()
+            ->whereNotNull('email_verified_at')
             ->whereHas('subscriptions', function ($query) use ($eligiblePriceIds) {
                 $query->where('stripe_status', 'active')
                     ->where('is_comped', false)
diff --git a/app/Jobs/SendNewPluginNotifications.php b/app/Jobs/SendNewPluginNotifications.php
@@ -18,6 +18,7 @@ public function __construct(public Plugin $plugin) {}
     public function handle(): void
     {
         $recipients = User::query()
+            ->whereNotNull('email_verified_at')
             ->where('receives_new_plugin_notifications', true)
             ->where('id', '!=', $this->plugin->user_id)
             ->get();
diff --git a/app/Listeners/SuppressMailNotificationListener.php b/app/Listeners/SuppressMailNotificationListener.php
@@ -17,6 +17,10 @@ public function handle(NotificationSending $event): bool
             return true;
         }
 
+        if (! $event->notifiable->email_verified_at) {
+            return false;
+        }
+
         return $event->notifiable->receives_notification_emails;
     }
 }
diff --git a/package-lock.json b/package-lock.json
diff --git a/tests/Feature/Jobs/SendNewPluginNotificationsTest.php b/tests/Feature/Jobs/SendNewPluginNotificationsTest.php
@@ -41,4 +41,17 @@ public function test_job_does_not_notify_plugin_author(): void
 
         Notification::assertNotSentTo($author, NewPluginAvailable::class);
     }
+
+    public function test_job_does_not_notify_unverified_users(): void
+    {
+        Notification::fake();
+
+        $author = User::factory()->create();
+        $unverified = User::factory()->unverified()->create(['receives_new_plugin_notifications' => true]);
+        $plugin = Plugin::factory()->approved()->for($author)->create();
+
+        (new SendNewPluginNotifications($plugin))->handle();
+
+        Notification::assertNotSentTo($unverified, NewPluginAvailable::class);
+    }
 }
diff --git a/tests/Feature/SendPluginSubmissionRemindersTest.php b/tests/Feature/SendPluginSubmissionRemindersTest.php
@@ -151,4 +151,17 @@ public function test_notification_database_array_contains_plugin_names(): void
         $this->assertArrayHasKey('plugin_names', $data);
         $this->assertContains('acme/test-plugin', $data['plugin_names']);
     }
+
+    public function test_does_not_send_to_unverified_users(): void
+    {
+        Notification::fake();
+
+        $user = User::factory()->unverified()->create();
+        Plugin::factory()->draft()->for($user)->create();
+
+        $this->artisan('plugins:send-submission-reminders')
+            ->assertExitCode(0);
+
+        Notification::assertNothingSent();
+    }
 }
diff --git a/tests/Feature/SendUltraFreeUserPromotionTest.php b/tests/Feature/SendUltraFreeUserPromotionTest.php
@@ -186,4 +186,17 @@ public function test_notification_mentions_nativephp_is_free(): void
         $this->assertStringContainsString('free and open source', $rendered);
         $this->assertStringContainsString('no license required', $rendered);
     }
+
+    public function test_skips_unverified_users(): void
+    {
+        Notification::fake();
+
+        $unverified = User::factory()->unverified()->create();
+
+        $this->artisan('ultra:send-free-user-promo')
+            ->expectsOutputToContain('Found 0 eligible user(s)')
+            ->assertSuccessful();
+
+        Notification::assertNotSentTo($unverified, UltraFreeUserPromotion::class);
+    }
 }
diff --git a/tests/Feature/SuppressMailNotificationListenerTest.php b/tests/Feature/SuppressMailNotificationListenerTest.php
@@ -71,4 +71,38 @@ public function test_new_users_receive_notifications_by_default(): void
 
         $this->assertTrue($user->receives_notification_emails);
     }
+
+    public function test_suppresses_mail_when_user_email_is_not_verified(): void
+    {
+        $user = User::factory()->unverified()->create(['receives_notification_emails' => true]);
+
+        $event = new NotificationSending(
+            $user,
+            new PluginApproved(
+                plugin: Plugin::factory()->for($user)->create(),
+            ),
+            'mail',
+        );
+
+        $listener = new SuppressMailNotificationListener;
+
+        $this->assertFalse($listener->handle($event));
+    }
+
+    public function test_allows_non_mail_channels_for_unverified_users(): void
+    {
+        $user = User::factory()->unverified()->create(['receives_notification_emails' => true]);
+
+        $event = new NotificationSending(
+            $user,
+            new PluginApproved(
+                plugin: Plugin::factory()->for($user)->create(),
+            ),
+            'database',
+        );
+
+        $listener = new SuppressMailNotificationListener;
+
+        $this->assertTrue($listener->handle($event));
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,7 @@ public function handle(): int`
`37`	`37`	`}`
`38`	`38`
`39`	`39`	`$recipients = User::query()`
	`40`	`+ ->whereNotNull('email_verified_at')`
`40`	`41`	`->where('receives_new_plugin_notifications', true)`
`41`	`42`	`->whereNotIn('id', $plugins->pluck('user_id'))`
`42`	`43`	`->get();`
Original file line number	Diff line number	Diff line change
`@@ -23,6 +23,7 @@ public function handle(): int`
`23`	`23`	`}`
`24`	`24`
`25`	`25`	`$users = User::query()`
	`26`	`+ ->whereNotNull('email_verified_at')`
`26`	`27`	`->whereHas('plugins', function ($query) {`
`27`	`28`	`$query->whereIn('status', [PluginStatus::Draft, PluginStatus::Pending, PluginStatus::Rejected]);`
`28`	`29`	`})`
Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,7 @@ public function handle(): int`
`22`	`22`	`}`
`23`	`23`
`24`	`24`	`$users = User::query()`
	`25`	`+ ->whereNotNull('email_verified_at')`
`25`	`26`	`->whereDoesntHave('licenses')`
`26`	`27`	`->whereDoesntHave('subscriptions')`
`27`	`28`	`->get();`
Original file line number	Diff line number	Diff line change
`@@ -18,6 +18,7 @@ public function __construct(public Plugin $plugin) {}`
`18`	`18`	`public function handle(): void`
`19`	`19`	`{`
`20`	`20`	`$recipients = User::query()`
	`21`	`+ ->whereNotNull('email_verified_at')`
`21`	`22`	`->where('receives_new_plugin_notifications', true)`
`22`	`23`	`->where('id', '!=', $this->plugin->user_id)`
`23`	`24`	`->get();`