fix: require email to be verified before making it primary (#68897)

Make sure the `username` is verified before making it a primary email.

Author: oioki

src/sentry/api/endpoints/user_details.py

@@ -26,6 +26,7 @@
 from sentry.models.organizationmapping import OrganizationMapping
 from sentry.models.organizationmembermapping import OrganizationMemberMapping
 from sentry.models.user import User
+from sentry.models.useremail import UserEmail
 from sentry.services.hybrid_cloud.organization import organization_service
 from sentry.services.hybrid_cloud.organization.model import RpcOrganizationDeleteState
 from sentry.services.hybrid_cloud.user.serial import serialize_generic_user
@@ -184,6 +185,13 @@ def put(self, request: Request, user) -> Response:
         :param string default_issue_event: Event displayed by default, "recommended", "latest" or "oldest"
         :auth: required
         """
+        if "username" in request.data:
+            verified_email_found = UserEmail.objects.filter(
+                user_id=user.id, email=request.data["username"], is_verified=True
+            ).exists()
+            if not verified_email_found:
+                return Response({"detail": "Verified email address is not found."}, status=400)
+
         # We want to prevent superusers from setting users to superuser or staff
         # because this is only done through _admin. This will always be enforced
         # once the feature flag is removed.

tests/sentry/api/endpoints/test_user_details.py

@@ -166,6 +166,7 @@ def test_change_username_when_different(self):
         user = self.create_user(email="c@example.com", username="diff@example.com")
         self.login_as(user=user, superuser=False)
 
+        self.create_useremail(user, "new@example.com", is_verified=True)
         self.get_success_response("me", username="new@example.com")
 
         user = User.objects.get(id=user.id)
@@ -179,13 +180,27 @@ def test_change_username_when_same(self):
         user = self.create_user(email="c@example.com", username="c@example.com")
         self.login_as(user=user)
 
+        self.create_useremail(user, "new@example.com", is_verified=True)
         self.get_success_response("me", username="new@example.com")
 
         user = User.objects.get(id=user.id)
 
         assert user.email == "new@example.com"
         assert user.username == "new@example.com"
 
+    def test_cannot_change_username_to_non_verified(self):
+        user = self.create_user(email="c@example.com", username="c@example.com")
+        self.login_as(user=user)
+
+        self.create_useremail(user, "new@example.com", is_verified=False)
+        resp = self.get_error_response("me", username="new@example.com", status_code=400)
+        assert resp.data["detail"] == "Verified email address is not found."
+
+        user = User.objects.get(id=user.id)
+
+        assert user.email == "c@example.com"
+        assert user.username == "c@example.com"
+
 
 @control_silo_test
 class UserDetailsSuperuserUpdateTest(UserDetailsTest):