diff --git a/packages/backend/src/server/api/SignupApiService.ts b/packages/backend/src/server/api/SignupApiService.ts index d2c4440116..c72420689f 100644 --- a/packages/backend/src/server/api/SignupApiService.ts +++ b/packages/backend/src/server/api/SignupApiService.ts @@ -136,7 +136,20 @@ export class SignupApiService { return; } - if (ticket.usedAt) { + // メアド認証が有効かつ有効期限が0以外に設定されている場合 + if (instance.emailRequiredForSignup && instance.emailVerificationExpiresIn !== 0) { + // メアド認証済みならエラー + if (ticket.usedBy) { + reply.code(400); + return; + } + + // 認証しておらず、まだ有効期限内ならエラー + if (ticket.usedAt && ticket.usedAt.getTime() + (instance.emailVerificationExpiresIn * 1000 * 60) > Date.now()) { + reply.code(400); + return; + } + } else if (ticket.usedAt) { reply.code(400); return; } @@ -222,8 +235,13 @@ export class SignupApiService { const code = body['code']; try { + const instance = await this.metaService.fetch(true); const pendingUser = await this.userPendingsRepository.findOneByOrFail({ code }); + if (instance.emailVerificationExpiresIn !== 0 && this.idService.parse(pendingUser.id).date.getTime() + (instance.emailVerificationExpiresIn * 1000 * 60) < Date.now()) { + throw new FastifyReplyError(400, 'EXPIRED'); + } + const { account, secret } = await this.signupService.signup({ username: pendingUser.username, passwordHash: pendingUser.password,