Ensure welcome email unsubscribe works as expected

Author: rossta

app/controllers/users/newsletter_subscriptions_controller.rb

@@ -65,29 +65,42 @@ def subscribe
   end
 
   def unsubscribe
-    if params[:token]
-      subscription = NewsletterSubscription.find_by_token_for(:unsubscribe, params[:token]) or raise ActiveRecord::RecordNotFound
-      subscription.destroy
-    elsif current_user
-      # Even though we model the subscription as a has_one, we should destroy
-      # all because has_one is not enforced as a constraint
-      NewsletterSubscription.where(subscriber: current_user).destroy_all
-    else
-      not_found!
-    end
+    subscriber = find_subscriber
+
+    # Even though we model the subscription as a has_one, we should destroy
+    # all because has_one is not enforced as a constraint
+    NewsletterSubscription.where(subscriber: subscriber).destroy_all
+
+    notice = "You have been unsubscribed from the Joy of Rails newsletter"
 
     if request.post? && params["List-Unsubscribe"] == "One-Click"
       # must not redirect according to RFC 8058
       # could render show action instead
-      render plain: "You have been unsubscribed", status: :ok
+      render plain: notice, status: :ok
     else
       respond_to do |format|
-        format.html { redirect_to root_path, notice: "You have been unsubscribed" }
+        format.html { redirect_to root_path, notice: notice }
         format.turbo_stream {
           redirect_path = current_user ? users_newsletter_subscriptions_path : new_users_newsletter_subscription_path
           redirect_to redirect_path
         }
       end
     end
   end
+
+  private
+
+  def find_subscriber
+    subscriber = if params[:token]
+      subscription = NewsletterSubscription.find_by_token_for!(:unsubscribe, params[:token])
+      subscription&.subscriber
+    else
+      current_user
+    end
+
+    subscriber or raise ActiveRecord::RecordNotFound
+  rescue ActiveSupport::MessageVerifier::InvalidSignature
+    Honeybadger.event("invalid_token", {path: request.path, controller: self.class.name, action: action_name})
+    raise ActiveRecord::RecordNotFound
+  end
 end

app/mailers/emails/user_mailer.rb

@@ -20,8 +20,9 @@ def password_reset(user, password_reset_token)
     mail to: @user.email, subject: "Reset your password"
   end
 
-  def welcome(user)
+  def welcome(user, unsubscribe_token = :no_token)
     @user = user
+    @unsubscribe_token = unsubscribe_token
 
     mail to: @user.email, subject: "Welcome to Joy of Rails!"
   end

app/notifiers/welcome_notifier.rb

@@ -5,14 +5,15 @@ def self.deliver_to(user, **)
 
   def deliver_notification(notification)
     user = notification.recipient
+    unsubscribe_token = user&.newsletter_subscription&.generate_token_for(:unsubscribe) || :no_token
 
     if !deliver_to?(user)
       Rails.logger.info "#[#{self.class}] Skipping delivery for: #{user.class.name}##{user.id}"
       Honeybadger.event("empty_notification", notifier: self.class.name, recipient: "#{user.class.name}##{user.id}")
       return false
     end
 
-    Emails::UserMailer.welcome(user).deliver_later
+    Emails::UserMailer.welcome(user, unsubscribe_token).deliver_later
   end
 
   def deliver_to?(recipient)

app/views/emails/user_mailer/welcome.html.erb

@@ -6,7 +6,9 @@
 
 <p>If you’re into RSS, you may want to subscribe to the <%= link_to "Joy of Rails feed", feed_index_url %>.</p>
 
-<p>You can also <%= link_to "unsubscribe", unsubscribe_users_newsletter_subscriptions_url %> at any time. That’s ok too!</p>
+<% unless @unsubscribe_token == :no_token %>
+<p>You can also <%= link_to "unsubscribe", unsubscribe_users_newsletter_subscription_url(@unsubscribe_token) %> at any time. That’s ok too!</p>
+<% end %>
 
 <p>If you have any questions, feedback, or just want to say hi, please don’t hesitate to reach out. I’d love to hear from you.</p>
 

app/views/emails/user_mailer/welcome.text.erb

@@ -6,7 +6,9 @@ Now that you’ve joined, you can expect occasional email updates from me. I’m
 
 If you’re into RSS, you may want to subscribe to the Joy of Rails feed: <%= feed_index_url %>.
 
-You can also unsubscribe at any time: <%= unsubscribe_users_newsletter_subscriptions_url %>. That’s ok too!
+<% unless @unsubscribe_token == :no_token %>
+You can also unsubscribe at any time: <%= unsubscribe_users_newsletter_subscription_url(@unsubscribe_token) %>. That’s ok too!
+<% end %>
 
 If you have any questions, feedback, or just want to say hi, please don’t hesitate to reach out. I’d love to hear from you.
 

spec/mailers/previews/emails/user_mailer_preview.rb

@@ -10,6 +10,6 @@ def password_reset
   end
 
   def welcome
-    Emails::UserMailer.welcome(FactoryBot.build(:user))
+    Emails::UserMailer.welcome(FactoryBot.build(:user), "unsubscribe_token")
   end
 end

spec/notifiers/welcome_notifier_spec.rb

@@ -12,7 +12,7 @@
       WelcomeNotifier.deliver_to(user)
       perform_enqueued_jobs
 
-      expect(Emails::UserMailer).to have_received(:welcome).with(user).once
+      expect(Emails::UserMailer).to have_received(:welcome).with(user, :no_token).once
     end
   end
 end

spec/requests/users/newsletter_subscriptions_spec.rb

@@ -233,7 +233,7 @@
       user.reload
 
       expect(response).to redirect_to(root_path)
-      expect(flash[:notice]).to eq("You have been unsubscribed")
+      expect(flash[:notice]).to eq("You have been unsubscribed from the Joy of Rails newsletter")
 
       expect(user.newsletter_subscription).to be_nil
     end
@@ -249,7 +249,7 @@
       user.reload
 
       expect(response).to redirect_to(root_path)
-      expect(flash[:notice]).to eq("You have been unsubscribed")
+      expect(flash[:notice]).to eq("You have been unsubscribed from the Joy of Rails newsletter")
 
       expect(user.newsletter_subscription).to be_nil
     end
@@ -265,7 +265,7 @@
       user.reload
 
       expect(response).to redirect_to(root_path)
-      expect(flash[:notice]).to eq("You have been unsubscribed")
+      expect(flash[:notice]).to eq("You have been unsubscribed from the Joy of Rails newsletter")
 
       expect(user.newsletter_subscription).to be_nil
     end
@@ -291,7 +291,7 @@
       expect(user.newsletter_subscription).to be_present
 
       expect {
-        post unsubscribe_users_newsletter_subscription_path(user.newsletter_subscription.id)
+        post unsubscribe_users_newsletter_subscription_path("bad-token")
       }.not_to change(NewsletterSubscription, :count)
 
       user.reload
@@ -313,7 +313,7 @@
       user.reload
 
       expect(response).to redirect_to(root_path)
-      expect(flash[:notice]).to eq("You have been unsubscribed")
+      expect(flash[:notice]).to eq("You have been unsubscribed from the Joy of Rails newsletter")
 
       expect(user.newsletter_subscription).to be_nil
     end

spec/system/users/confirmations_spec.rb

@@ -26,4 +26,26 @@
     expect(page).to have_content("Thank you for confirming your email address")
     expect(User.last).to be_confirmed
   end
+
+  it "sends welcome email which allow user to unsubscribe" do
+    user = FactoryBot.create(:user, :subscriber)
+    user.generate_token_for(:confirmation)
+
+    visit edit_users_confirmation_path(user.generate_token_for(:confirmation))
+
+    click_button "Confirm email"
+
+    expect(user.reload.newsletter_subscription).to be_present
+
+    perform_enqueued_jobs_and_subsequently_enqueued_jobs
+
+    mail = find_mail_to(user.email)
+
+    expect(mail.subject).to eq "Welcome to Joy of Rails!"
+
+    visit email_link(mail, "unsubscribe")
+
+    expect(page).to have_content("You have been unsubscribed from the Joy of Rails newsletter")
+    expect(user.reload.newsletter_subscription).to be_nil
+  end
 end