Dont Allow Multiple User Destroy Requests (#7685)

app/controllers/users_controller.rb

@@ -93,7 +93,11 @@ class UsersController < ApplicationController
 
   def request_destroy
     set_tabs("account")
-    if @user.email?
+
+    if destroy_request_in_progress
+      flash[:settings_notice] = "You have already requested account deletion. Please, check your email for further instructions."
+      redirect_to "/settings/#{@tab}"
+    elsif @user.email?
       Users::RequestDestroy.call(@user)
       flash[:settings_notice] = "You have requested account deletion. Please, check your email for further instructions."
       redirect_to "/settings/#{@tab}"
@@ -400,4 +404,8 @@ class UsersController < ApplicationController
     @user.errors.add(:profile_image, FILENAME_TOO_LONG_MESSAGE)
     false
   end
+
+  def destroy_request_in_progress
+    Rails.cache.exist?("user-destroy-token-#{@user.id}")
+  end
 end

spec/requests/user/user_destroy_spec.rb

@@ -94,6 +94,16 @@ RSpec.describe "UserDestroy", type: :request do
         expect(flash[:settings_notice]).to include("provide an email")
       end
     end
+
+    it "does not send an email if already requested" do
+      allow(Rails.cache).to receive(:exist?).with("user-destroy-token-#{user.id}").and_return(true)
+      allow(NotifyMailer).to receive(:account_deletion_requested_email)
+      sign_in user
+      post "/users/request_destroy"
+
+      expect(NotifyMailer).not_to have_received(:account_deletion_requested_email)
+      expect(flash[:settings_notice]).to include("You have already requested")
+    end
   end
 
   describe "GET /users/confirm_destroy" do