Merge branch 'fix-confirmation-email-spam' into 'master'

fixed email confirmation spam

See merge request kbr4/riskletpy!25

backend/accounts/migrations/0002_emailconfirmation_confirmed.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.1.3 on 2025-06-09 16:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='emailconfirmation',
+            name='confirmed',
+            field=models.BooleanField(default=False),
+        ),
+    ]

backend/accounts/models.py

@@ -7,6 +7,7 @@ class EmailConfirmation(models.Model):
     email = models.EmailField(unique=True)
     uuid = models.UUIDField(default=uuid.uuid4, unique=True)
     created_at = models.DateTimeField(auto_now_add=True)
+    confirmed = models.BooleanField(default=False)
 
     def is_expired(self):
         return now() > (self.created_at + timedelta(days=1))

backend/accounts/views.py

@@ -6,6 +6,7 @@ from django.shortcuts import get_object_or_404, render
 from django.http import HttpResponse
 from backend.accounts.utils import send_confirmation_email
 from .tasks import create_document_for_organization
+from backend.core.models import Organization, Document
 
 class SignUpView(CreateView):
     form_class = SignupForm
@@ -19,8 +20,18 @@ def confirm_email(request, uuid):
     if confirmation.is_expired():
         return render(request, 'accounts/confirmation_expired.html', {'email': confirmation.email})
     
-    task = create_document_for_organization.delay(confirmation.email)
+    if confirmation.confirmed:
-    return render(request, 'accounts/confirmation_success.html', {'email': confirmation.email})
+        return render(request, 'accounts/confirmation_success.html', {'email': confirmation.email})
+    
+    confirmation.confirmed = True
+    confirmation.save()
+
+    org = Organization.objects.filter(email=confirmation.email).first()
+    if org and Document.objects.filter(organization=org).exists():
+        return render(request, 'accounts/confirmation_success.html', {'email': confirmation.email})
+    else:
+        task = create_document_for_organization.delay(confirmation.email)
+        return render(request, 'accounts/confirmation_success.html', {'email': confirmation.email})
 
 def resend_confirmation(request,email):
     if request.method == 'POST':