fix: redirect to login when confirming email if user is not authenticated (#64818)

Fixes an issue where users receive an error when trying to confirm their
emails if they are not already logged in. This redirects the user to
login and then to the email confirmation.

src/sentry/web/frontend/accounts.py

@@ -241,6 +241,7 @@ def start_confirm_email(request):
 
 
 @set_referrer_policy("strict-origin-when-cross-origin")
+@login_required
 @control_silo_function
 def confirm_email(request, user_id, hash):
     msg = _("Thanks for confirming your email")
@@ -261,7 +262,7 @@ def confirm_email(request, user_id, hash):
     else:
         email.is_verified = True
         email.validation_hash = ""
-        email.save()
+        email.save(update_fields=["is_verified", "validation_hash"])
         email_verified.send(email=email.email, sender=email)
         logger.info(
             "user.email.confirm",

tests/sentry/web/frontend/test_accounts.py

@@ -357,3 +357,20 @@ class TestAccounts(TestCase):
             messages[0].message
             == "There was an error confirming your email. Please try again or visit your Account Settings to resend the verification email."
         )
+
+    def test_confirm_email_unauthenticated(self):
+        useremail = UserEmail(user=self.user, email="new@example.com")
+        useremail.save()
+
+        assert not useremail.is_verified
+
+        url = reverse(
+            "sentry-account-confirm-email",
+            kwargs={"user_id": self.user.id, "hash": useremail.validation_hash},
+        )
+
+        resp = self.client.get(url)
+
+        assert resp.status_code == 302
+        assert resp.headers["location"] == "/auth/login/"
+        assert self.client.session["_next"] == url