fix: verify email on activate

src/actions/activate.js

@@ -120,9 +120,10 @@ function verifyRequest() {
 async function activateAccount(data, metadata) {
   const userId = data[USERS_ID_FIELD];
   const alias = data[USERS_ALIAS_FIELD];
+  const username = data[USERS_USERNAME_FIELD];
   const referral = metadata[USERS_REFERRAL_FIELD];
   const userKey = redisKey(userId, USERS_DATA);
-  const { defaultAudience, service } = this;
+  const { defaultAudience, service, shouldVerifyContact } = this;
   const { redis } = service;
 
   // if this goes through, but other async calls fail its ok to repeat that
@@ -160,6 +161,10 @@ async function activateAccount(data, metadata) {
     throw new HttpStatusError(417, `Account ${userId} was already activated`);
   }
 
+  if (shouldVerifyContact) {
+    await contacts.setVerifiedIfExist({ redis, userId, value: username });
+  }
+
   return userId;
 }
 
@@ -208,6 +213,7 @@ async function activateAction({ log, params }) {
     defaultAudience,
     token,
     username,
+    shouldVerifyContact,
     service: this,
     erase: config.token.erase,
   };
@@ -223,10 +229,6 @@ async function activateAction({ log, params }) {
     .spread(activateAccount)
     .tap(hook);
 
-  if (shouldVerifyContact) {
-    await contacts.setVerifiedIfExist({ redis: this.redis, userId, value: username || userId });
-  }
-
   return jwt.login.call(this, userId, audience, isStatelessAuth);
 }
 

test/suites/actions/activate.js

@@ -52,6 +52,14 @@ describe('#activate', function activateSuite() {
         return true;
       });
     });
+
+    it('must fail to activate already active user with both token and username provided', async function test() {
+      await assert.rejects(this.users.dispatch('activate', { params: { token: this.token, username: email } }), (activation) => {
+        expect(activation.name).to.be.eq('HttpStatusError');
+        expect(activation.statusCode).to.be.eq(409);
+        return true;
+      });
+    });
   });
 
   describe('activate inactive user', function suite() {