Rate limiting same as password reset for the resending of email confirmation emails

Author: silverbackdan

src/Entity/User/AbstractUser.php

@@ -268,6 +268,9 @@ public function getNewEmailConfirmationToken(): ?string
     public function setNewEmailConfirmationToken(?string $newEmailConfirmationToken): self
     {
         $this->newEmailConfirmationToken = $newEmailConfirmationToken;
+        if ($newEmailConfirmationToken) {
+            $this->newEmailAddressChangeRequestedAt = new \DateTime();
+        }
 
         return $this;
     }
@@ -297,6 +300,9 @@ public function getEmailAddressVerifyToken(): ?string
     public function setEmailAddressVerifyToken(?string $emailAddressVerifyToken): void
     {
         $this->emailAddressVerifyToken = $emailAddressVerifyToken;
+        if ($emailAddressVerifyToken) {
+            $this->emailLastUpdatedAt = new \DateTime();
+        }
     }
 
     public function isPasswordRequestLimitReached($ttl): bool
@@ -307,6 +313,22 @@ public function isPasswordRequestLimitReached($ttl): bool
             && $lastRequest->getTimestamp() + $ttl > time();
     }
 
+    public function isNewEmailVerifyRequestLimitReached($ttl): bool
+    {
+        $lastRequest = $this->getNewEmailAddressChangeRequestedAt();
+
+        return $lastRequest instanceof \DateTime
+            && $lastRequest->getTimestamp() + $ttl > time();
+    }
+
+    public function isEmailVerifyRequestLimitReached($ttl): bool
+    {
+        $lastRequest = $this->emailLastUpdatedAt;
+
+        return $lastRequest instanceof \DateTime
+            && $lastRequest->getTimestamp() + $ttl > time();
+    }
+
     /** @see \Serializable::serialize() */
     public function serialize(): string
     {

src/Helper/User/UserDataProcessor.php

@@ -116,7 +116,7 @@ private function findUserByUsername(string $usernameQuery): ?AbstractUser
     public function updateNewEmailToken(string $usernameQuery): ?AbstractUser
     {
         $user = $this->findUserByUsername($usernameQuery);
-        if (!$user) {
+        if (!$user || $user->isNewEmailVerifyRequestLimitReached($this->tokenTtl)) {
             return null;
         }
         $this->setNewEmailConfirmationToken($user);
@@ -127,7 +127,7 @@ public function updateNewEmailToken(string $usernameQuery): ?AbstractUser
     public function updateVerifyEmailToken(string $usernameQuery): ?AbstractUser
     {
         $user = $this->findUserByUsername($usernameQuery);
-        if (!$user) {
+        if (!$user || $user->isEmailVerifyRequestLimitReached($this->tokenTtl)) {
             return null;
         }
         $this->setEmailAddressVerifyToken($user);