fix(breach-alerts): subscribe to updated primary email address

Author: kschelonka

src/db/tables/subscribers.integration.ts

@@ -9,6 +9,10 @@ import createDbConnection from "../connect";
 import { updatePrimaryEmail } from "./subscribers";
 import { getSha1 } from "../../utils/fxa";
 
+vi.mock("../../utils/hibp", () => ({
+  subscribeHash: vi.fn().mockResolvedValue(undefined),
+}));
+
 const conn = createDbConnection();
 
 afterEach(async () => {
@@ -90,6 +94,19 @@ describe("updatePrimaryEmail", () => {
     expect(updated.primary_sha1).toBe(getSha1(newEmail));
   });
 
+  it("calls subscribeHash with the sha1 of the new primary email", async () => {
+    const { subscribeHash } = await import("../../utils/hibp");
+    const newEmail = faker.internet.email().toLowerCase();
+
+    const [subscriber] = await conn("subscribers")
+      .insert(seeds.subscribers())
+      .returning("*");
+
+    await updatePrimaryEmail(subscriber, newEmail);
+
+    expect(subscribeHash).toHaveBeenCalledWith(getSha1(newEmail));
+  });
+
   it("logs the error and returns null when the transaction throws", async () => {
     const [subscriber] = await conn("subscribers")
       .insert(seeds.subscribers())

src/db/tables/subscribers.ts

@@ -9,6 +9,7 @@ import { SerializedSubscriber } from "../../next-auth.js";
 import { config } from "../../config";
 import { logger } from "../../app/functions/server/logging";
 import { getSha1 } from "../../utils/fxa";
+import { subscribeHash } from "../../utils/hibp";
 import { type Knex } from "knex";
 
 const knex = createDbConnection();
@@ -88,6 +89,10 @@ async function updatePrimaryEmail(
           // even if it's not typed as a JS date object:
           updated_at: knex.fn.now() as unknown as Date,
         });
+
+      // Subscribe the new primary email's hash to HIBP breach notifications
+      await subscribeHash(getSha1(updatedEmail.toLowerCase()));
+
       return subscriberTableUpdated[0] ?? null;
     });
     return subscriberTableUpdated;

src/utils/email.ts

@@ -8,6 +8,7 @@ import crypto from "crypto";
 import { SentMessageInfo } from "nodemailer/lib/smtp-transport/index.js";
 import { config } from "../config";
 import { logger } from "../app/functions/server/logging";
+import { captureException } from "@sentry/node";
 
 // The SMTP transport object. This is initialized to a nodemailer transport
 // object while reading SMTP credentials, or to a dummy function in debug mode.
@@ -86,12 +87,16 @@ export async function sendEmail(
   } catch (e) {
     if (e instanceof Error) {
       logger.error("error_sending_email", {
-        message: e.message,
-        stack: e.stack,
+        error: {
+          message: e.message,
+          stack: e.stack,
+        },
       });
+      captureException(e);
       /* c8 ignore next 3 */
     } else {
-      logger.error("error_sending_email", { message: JSON.stringify(e) });
+      logger.error("error_sending_email", { error: JSON.stringify(e) });
+      captureException(e);
     }
     throw e;
   }