From ddcfac4f0f7f0ed0a5481d232f78adef4f5db783 Mon Sep 17 00:00:00 2001
From: Eldad Fux <eldad.fux@gmail.com>
Date: Tue, 14 Oct 2025 00:03:11 +0100
Subject: [PATCH] feat: enhance account handling with plan support for
 disposable email validation

- Added 'plan' injection to account-related API endpoints.
- Updated logic to check for disposable email validation support based on the plan.
- Improved handling of disposable email checks during account creation and email updates.
---
 app/controllers/api/account.php | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 18d3177251..59994d9702 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -325,7 +325,8 @@ App::post('/v1/account')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('hooks')
-    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Hooks $hooks) {
+    ->inject('plan')
+    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Hooks $hooks, array $plan) {
 
         $email = \strtolower($email);
         if ('console' === $project->getId()) {
@@ -369,7 +370,7 @@ App::post('/v1/account')
             }
         }
 
-        if ($project->getAttribute('auths', [])['disposableEmails'] ?? false) {
+        if (($plan['supportsDisposableEmailValidation'] ?? false) && ($project->getAttribute('auths', [])['disposableEmails'] ?? false)) {
             $disposableEmails = Config::getParam('disposableEmails', []);
             $emailDomain = substr(strrchr($email, "@"), 1);
             if (isset($disposableEmails[$emailDomain])) {
@@ -1942,7 +1943,8 @@ App::post('/v1/account/tokens/magic-url')
     ->inject('locale')
     ->inject('queueForEvents')
     ->inject('queueForMails')
-    ->action(function (string $userId, string $email, string $url, bool $phrase, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails) {
+    ->inject('plan')
+    ->action(function (string $userId, string $email, string $url, bool $phrase, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, array $plan) {
         if (empty(System::getEnv('_APP_SMTP_HOST'))) {
             throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP disabled');
         }
@@ -1975,7 +1977,7 @@ App::post('/v1/account/tokens/magic-url')
                 throw new Exception(Exception::USER_EMAIL_ALREADY_EXISTS);
             }
 
-            if ($project->getAttribute('auths', [])['disposableEmails'] ?? false) {
+            if (($plan['supportsDisposableEmailValidation'] ?? false) && ($project->getAttribute('auths', [])['disposableEmails'] ?? false)) {
                 $disposableEmails = Config::getParam('disposableEmails', []);
                 $emailDomain = substr(strrchr($email, "@"), 1);
                 if (isset($disposableEmails[$emailDomain])) {
@@ -2202,7 +2204,8 @@ App::post('/v1/account/tokens/email')
     ->inject('locale')
     ->inject('queueForEvents')
     ->inject('queueForMails')
-    ->action(function (string $userId, string $email, bool $phrase, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails) {
+    ->inject('plan')
+    ->action(function (string $userId, string $email, bool $phrase, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, array $plan) {
         if (empty(System::getEnv('_APP_SMTP_HOST'))) {
             throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP disabled');
         }
@@ -2233,7 +2236,7 @@ App::post('/v1/account/tokens/email')
                 throw new Exception(Exception::GENERAL_BAD_REQUEST); /** Return a generic bad request to prevent exposing existing accounts */
             }
 
-            if ($project->getAttribute('auths', [])['disposableEmails'] ?? false) {
+            if (($plan['supportsDisposableEmailValidation'] ?? false) && ($project->getAttribute('auths', [])['disposableEmails'] ?? false)) {
                 $disposableEmails = Config::getParam('disposableEmails', []);
                 $emailDomain = substr(strrchr($email, "@"), 1);
                 if (isset($disposableEmails[$emailDomain])) {
@@ -3048,7 +3051,8 @@ App::patch('/v1/account/email')
     ->inject('queueForEvents')
     ->inject('project')
     ->inject('hooks')
-    ->action(function (string $email, string $password, ?\DateTime $requestTimestamp, Response $response, Document $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks) {
+    ->inject('plan')
+    ->action(function (string $email, string $password, ?\DateTime $requestTimestamp, Response $response, Document $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, array $plan) {
         // passwordUpdate will be empty if the user has never set a password
         $passwordUpdate = $user->getAttribute('passwordUpdate');
 
@@ -3074,7 +3078,7 @@ App::patch('/v1/account/email')
             throw new Exception(Exception::GENERAL_BAD_REQUEST); /** Return a generic bad request to prevent exposing existing accounts */
         }
 
-        if ($project->getAttribute('auths', [])['disposableEmails'] ?? false) {
+        if (($plan['supportsDisposableEmailValidation'] ?? false) && ($project->getAttribute('auths', [])['disposableEmails'] ?? false)) {
             $disposableEmails = Config::getParam('disposableEmails', []);
             $emailDomain = substr(strrchr($email, "@"), 1);
             if (isset($disposableEmails[$emailDomain])) {