2fa email fallback need a verified email (#7770)

Co-authored-by: Timshel <timshel@users.noreply.github.com>
Co-authored-by: Mathijs van Veluw <black.dex@gmail.com>

src/api/core/organizations.rs

@@ -3038,11 +3038,12 @@ async fn recover_account(
         err!("Organization user must be confirmed for password reset functionality");
     }
 
-    let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
-        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
-    } else {
-        false
-    };
+    let fallback_2fa_email =
+        if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
+            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
+        } else {
+            false
+        };
 
     // Sending email first ensure working email configuration and the resulting user notification.
     // Also this might add some protection against security flaws and misuse

src/auth.rs

@@ -253,7 +253,7 @@ impl LoginJwtClaims {
             premium: true,
             name: user.name.clone(),
             email: user.email.clone(),
-            email_verified: !CONFIG.mail_enabled() || user.verified_at.is_some(),
+            email_verified: user.verified(),
 
             // ---
             // Disabled these keys to be added to the JWT since they could cause the JWT to get too large

src/db/models/user.rs

@@ -257,6 +257,10 @@ impl User {
 
 /// Database methods
 impl User {
+    pub fn verified(&self) -> bool {
+        !CONFIG.mail_enabled() || self.verified_at.is_some()
+    }
+
     pub async fn to_json(&self, conn: &DbConn) -> Value {
         let mut orgs_json = Vec::new();
         for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {
@@ -299,7 +303,7 @@ impl User {
             "id": self.uuid,
             "name": self.name,
             "email": self.email,
-            "emailVerified": !CONFIG.mail_enabled() || self.verified_at.is_some(),
+            "emailVerified": self.verified(),
             "premium": true,
             "premiumFromOrganization": false,
             "culture": "en-US",