wip: check verified emails on invite get

Author: mdtro

src/sentry/api/endpoints/accept_organization_invite.py

@@ -6,6 +6,7 @@
 from django.http import HttpRequest
 from django.urls import reverse
 from rest_framework import status
+from rest_framework.authentication import SessionAuthentication
 from rest_framework.request import Request
 from rest_framework.response import Response
 
@@ -89,6 +90,7 @@ class AcceptOrganizationInvite(Endpoint):
         "POST": ApiPublishStatus.UNKNOWN,
     }
     # Disable authentication and permission requirements.
+    authentication_classes = (SessionAuthentication,)
     permission_classes = ()
 
     @staticmethod
@@ -146,6 +148,20 @@ def get(
 
         response = Response(None)
 
+        # if the user is already authenticated, let's make sure
+        # they have the email that the invite was sent to as a
+        # verified email on their account
+        if self.request.user.is_authenticated:
+            user_verified_emails = {e.email for e in self.request.user.get_verified_emails()}
+
+            if organization_member.email not in user_verified_emails:
+                return Response(
+                    status=403,
+                    data={
+                        "details": "Your account must have a verified email matching the email the invite was sent to."
+                    },
+                )
+
         # Allow users to register an account when accepting an invite
         if not helper.user_authenticated:
             request.session["can_register"] = True
@@ -203,6 +219,7 @@ def post(
             user_id=request.user.id,
             request=request,
         )
+
         if invite_context is None:
             return self.respond_invalid()
 

src/sentry/api/invite_helper.py

@@ -86,6 +86,7 @@ def from_session_or_email(
             invite = organization_service.get_invite_by_id(
                 organization_id=organization_id, email=email, user_id=request.user.id
             )
+
         if invite is None:
             # Unable to locate the pending organization member. Cannot setup
             # the invite helper.
@@ -114,6 +115,7 @@ def from_session(
             organization_id=invite_details.invite_organization_id,
             user_id=request.user.id,
         )
+
         if invite_context is None:
             if logger:
                 logger.exception("Invalid pending invite cookie")