From 79d6f644515b90933c96cbe72c9ae3fbc5e21adc Mon Sep 17 00:00:00 2001
From: KernelDeimos <eric.alex.dube@gmail.com>
Date: Fri, 26 Apr 2024 21:01:31 -0400
Subject: [PATCH 1/2] Notify old email when email change is initiated

---
 packages/backend/src/routers/change_email.js  |  5 +++++
 packages/backend/src/services/EmailService.js | 11 +++++++++++
 2 files changed, 16 insertions(+)

diff --git a/packages/backend/src/routers/change_email.js b/packages/backend/src/routers/change_email.js
index fd1d91392..dea3d20cc 100644
--- a/packages/backend/src/routers/change_email.js
+++ b/packages/backend/src/routers/change_email.js
@@ -79,6 +79,11 @@ const CHANGE_EMAIL_START = eggspress('/change_email/start', {
         confirm_url: `${config.origin}/change_email/confirm?token=${jwt_token}`,
         username: user.username,
     });
+    const old_email = user.email;
+    // TODO: NotificationService
+    await svc_email.send_email({ email: old_email }, 'email_change_notification', {
+        new_email: new_email,
+    });
 
     // update user
     await db.write(
diff --git a/packages/backend/src/services/EmailService.js b/packages/backend/src/services/EmailService.js
index 23f8d9487..d125edc3c 100644
--- a/packages/backend/src/services/EmailService.js
+++ b/packages/backend/src/services/EmailService.js
@@ -63,6 +63,17 @@ We received a request to link this email to the user "{{username}}" on Puter. If
 
 <p>
 <a href="{{confirm_url}}">Confirm email change</a>
+</p>
+                `,
+            },
+            'email_change_notification': {
+                subject: '\u{1f4dd} Notification of email change',
+                html: `
+<p>Hi there,</p>
+<p>
+We're sending an email to let you know about a change to your account.
+We have sent a confirmation to "{{new_email}}" to confirm an email change request.
+If this was not you, please contact support@puter.com immediately.
 </p>
                 `,
             },

From d7d6ff0cca3a9d15424851038fa9d781ec1d2d92 Mon Sep 17 00:00:00 2001
From: KernelDeimos <eric.alex.dube@gmail.com>
Date: Fri, 26 Apr 2024 21:01:52 -0400
Subject: [PATCH 2/2] Rate limit updates

---
 packages/backend/src/routers/change_username.js              | 5 +++++
 .../src/services/abuse-prevention/EdgeRateLimitService.js    | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/backend/src/routers/change_username.js b/packages/backend/src/routers/change_username.js
index 1a55d0ac4..5bbb49192 100644
--- a/packages/backend/src/routers/change_username.js
+++ b/packages/backend/src/routers/change_username.js
@@ -54,6 +54,11 @@ module.exports = eggspress('/change_username', {
     if(await username_exists(req.body.new_username))
         throw APIError.create('username_already_in_use', null, { username: req.body.new_username });
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('change-email-start') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     const db = Context.get('services').get('database').get(DB_WRITE, 'auth');
 
     // Has the user already changed their username twice this month?
diff --git a/packages/backend/src/services/abuse-prevention/EdgeRateLimitService.js b/packages/backend/src/services/abuse-prevention/EdgeRateLimitService.js
index 32e22947b..a4fbd691f 100644
--- a/packages/backend/src/services/abuse-prevention/EdgeRateLimitService.js
+++ b/packages/backend/src/services/abuse-prevention/EdgeRateLimitService.js
@@ -8,7 +8,7 @@ class EdgeRateLimitService extends BaseService {
     _construct () {
         this.scopes = {
             ['login']: {
-                limit: 3,
+                limit: 10,
                 window: 15 * MINUTE,
             },
             ['signup']: {