From 5ce1b564dce4f4d540e3792bb5dedc575ded5a6d Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Mon, 25 Aug 2025 02:33:36 +0200
Subject: [PATCH] fix: delete old auth token upon replacing primary email

---
 services/user/email.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/services/user/email.go b/services/user/email.go
index 36a1145aec..cc38dacf95 100644
--- a/services/user/email.go
+++ b/services/user/email.go
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"strings"
 
+	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/setting"
@@ -171,6 +172,11 @@ func ReplaceInactivePrimaryEmail(ctx context.Context, oldEmail string, email *us
 		return err
 	}
 
+	// Delete previous activation token.
+	if err := auth_model.DeleteAuthTokenByUser(ctx, user.ID); err != nil {
+		return err
+	}
+
 	return DeleteEmailAddresses(ctx, user, []string{oldEmail})
 }