OTWO-7705 Username enumeration via activation resend endpoint — disti…

[Niharika1117]

…nct responses for valid/invalid emails

[Copilot]

Pull request overview

This PR aims to mitigate username/email enumeration on the activation resend endpoint by making the “account not found” path respond like a successful request, rather than returning a distinct “no account” response.

Changes:

• Updated ActivationResendsController#find_account_by_email to redirect with a generic success notice instead of rendering an error when no account exists.
• Updated controller test coverage to expect the new generic redirect/flash behavior for a nonexistent email.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
app/controllers/activation_resends_controller.rb	Changes the “no account” branch to redirect with a generic success message to reduce enumeration signal.
test/controllers/activation_resends_controller_test.rb	Updates the “nonexistent account” test to assert the new redirect + generic success notice behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

app/controllers/activation_resends_controller.rb:33

• This change equalizes redirects/flash text for missing accounts, but the endpoint may still be vulnerable to timing-based email enumeration: when an account exists and is eligible, @account.resend_activation! triggers AccountMailer...deliver_now (synchronous) which can make the response noticeably slower than the non-existent/blocked paths.

  def find_account_by_email
    @account = Account.find_by(email: params[:email])
    return unless @account.nil?

    redirect_to root_path, notice: t('.success')

test/controllers/activation_resends_controller_test.rb:39

• The previous test that covered malformed input (e.g., InvalidEmail) was removed. Since the goal here is to prevent account/email enumeration, it’s useful to keep an explicit test asserting that invalid email formats receive the same generic redirect/flash as other non-delivery cases (so future validations don’t reintroduce distinct responses).

    it 'should not send email if account does not exist' do
      before = ActionMailer::Base.deliveries.count
      post :create, params: { email: 'nonexistent@example.com' }
      _(ActionMailer::Base.deliveries.count).must_equal before
      assert_response :redirect