Can only attach verified recipients

app/Console/Commands/ReceiveEmail.php

@@ -73,6 +73,8 @@ class ReceiveEmail extends Command
             $this->size = $this->option('size') / ($recipientCount ? $recipientCount : 1);
 
             foreach ($recipients as $key => $recipient) {
+                $displayTo = $this->parser->getAddresses('to')[$key]['display'];
+
                 $parentDomain = collect(config('anonaddy.all_domains'))
                     ->filter(function ($name) use ($recipient) {
                         return Str::endsWith($recipient['domain'], $name);
@@ -81,8 +83,6 @@ class ReceiveEmail extends Command
 
                 $subdomain = substr($recipient['domain'], 0, strrpos($recipient['domain'], '.'.$parentDomain)); // e.g. johndoe
 
-                $displayTo = $this->parser->getAddresses('to')[$key]['display'];
-
                 if ($subdomain === 'unsubscribe') {
                     $this->handleUnsubscribe($recipient);
                     continue;
@@ -97,6 +97,8 @@ class ReceiveEmail extends Command
                         $user = $customDomain->user;
                     }
 
+                    // TODO add check here for uuid pre-generated aliases e.g. 68699f3b-a8c3-4374-9dbf-bdde64afd3e4@anonaddy.me
+
                     // Check if this is the root domain e.g. anonaddy.me
                     if ($recipient['domain'] === $parentDomain && !empty(config('anonaddy.admin_username'))) {
                         $user = User::where('username', config('anonaddy.admin_username'))->first();
@@ -182,10 +184,11 @@ class ReceiveEmail extends Command
                 $recipient_ids = $user
                                     ->recipients()
                                     ->oldest()
-                                    ->pluck('id')
-                                    ->filter(function ($value, $key) use ($keys) {
-                                        return in_array($key+1, $keys);
+                                    ->get()
+                                    ->filter(function ($item, $key) use ($keys) {
+                                        return in_array($key+1, $keys) && ! is_null($item['email_verified_at']);
                                     })
+                                    ->pluck('id')
                                     ->take(10)
                                     ->toArray();
             }

tests/Feature/ReceiveEmailTest.php

@@ -314,7 +314,6 @@ class ReceiveEmailTest extends TestCase
     /** @test */
     public function it_can_attach_recipients_to_new_alias_with_extension()
     {
-        $this->withoutExceptionHandling();
         Mail::fake();
 
         Mail::assertNothingSent();
@@ -359,6 +358,59 @@ class ReceiveEmailTest extends TestCase
         });
     }
 
+    /** @test */
+    public function it_can_not_attach_unverified_recipient_to_new_alias_with_extension()
+    {
+        Mail::fake();
+
+        Mail::assertNothingSent();
+
+        $defaultRecipient = $this->user->defaultRecipient;
+
+        factory(Recipient::class)->create([
+            'user_id' => $this->user->id,
+            'email' => 'one@example.com',
+            'email_verified_at' => null
+        ]);
+
+        $verifiedRecipient = factory(Recipient::class)->create([
+            'user_id' => $this->user->id,
+            'email' => 'two@example.com'
+        ]);
+
+        $this->artisan(
+            'anonaddy:receive-email',
+            [
+                'file' => base_path('tests/emails/email_with_extension.eml'),
+                '--sender' => 'will@anonaddy.com',
+                '--recipient' => ['ebay@johndoe.anonaddy.com'],
+                '--local_part' => ['ebay'],
+                '--extension' => ['2.3'],
+                '--domain' => ['johndoe.anonaddy.com'],
+                '--size' => '444'
+            ]
+        )->assertExitCode(0);
+
+        $this->assertDatabaseHas('aliases', [
+            'email' => 'ebay@johndoe.'.config('anonaddy.domain'),
+            'emails_forwarded' => 1,
+            'emails_blocked' => 0
+        ]);
+        $this->assertDatabaseHas('users', [
+            'id' => $this->user->id,
+            'username' => 'johndoe',
+            'bandwidth' => '444'
+        ]);
+
+        $alias = $this->user->aliases()->where('email', 'ebay@johndoe.'.config('anonaddy.domain'))->first();
+
+        $this->assertCount(1, $alias->recipients);
+
+        Mail::assertQueued(ForwardEmail::class, function ($mail) use ($defaultRecipient, $verifiedRecipient) {
+            return $mail->hasTo($verifiedRecipient->email);
+        });
+    }
+
     /** @test */
     public function it_does_not_send_email_if_default_recipient_has_not_yet_been_verified()
     {