Improve requestEmailChangeOTP await logic

backend/src/services/user/user-service.ts

@@ -197,6 +197,7 @@ export const userServiceFactory = ({
 
   const requestEmailChangeOTP = async ({ userId, newEmail }: TUpdateUserEmailDTO) => {
     const changeEmailOTP = await userDAL.transaction(async (tx) => {
+      const startTime = new Date();
       const user = await userDAL.findById(userId, tx);
       if (!user)
         throw new NotFoundError({ message: `User with ID '${userId}' not found`, name: "RequestEmailChangeOTP" });
@@ -216,14 +217,7 @@ export const userServiceFactory = ({
       // Silently check if another user already has this email - don't send OTP if email is taken
       const existingUsers = await userDAL.findUserByUsername(newEmail.toLowerCase(), tx);
       const existingUser = existingUsers?.find((u) => u.id !== userId);
-      if (existingUser) {
+      if (!existingUser) {
-        // Don't reveal that email is taken - just don't send OTP.
-        await new Promise((resolve) => {
-          setTimeout(resolve, 2000);
-        });
-        return { success: true, message: "Verification code sent to new email address" };
-      }
-
         // Generate 6-digit OTP
         const otpCode = await tokenService.createTokenForUser({
           type: TokenType.TOKEN_EMAIL_CHANGE_OTP,
@@ -240,6 +234,16 @@ export const userServiceFactory = ({
             code: otpCode
           }
         });
+      }
+
+      // Force this function to have a minimum execution time of 2 seconds to avoid possible information disclosure about existing users
+      const endTime = new Date();
+      const timeDiff = endTime.getTime() - startTime.getTime();
+      if (timeDiff < 2000) {
+        await new Promise((resolve) => {
+          setTimeout(resolve, 2000 - timeDiff);
+        });
+      }
 
       return { success: true, message: "Verification code sent to new email address" };
     });
@@ -258,7 +262,7 @@ export const userServiceFactory = ({
       const hasScimRestriction = await checkUserScimRestriction(userId, tx);
       if (hasScimRestriction) {
         throw new BadRequestError({
-          message: "Email changes are disabled because SCIM is enabled for one or more of your organizations",
+          message: "You are part of an organization that has SCIM enabled, and email changes are not allowed",
           name: "UpdateUserEmail"
         });
       }