docs: reorder & testing

backend/internal/auth/challenge.go

@@ -28,10 +28,11 @@ import (
 //
 // locale (request body, BCP 47) takes precedence over acceptLanguage
 // (the standard HTTP header forwarded by gateway) when both are
-// supplied. The captured value is persisted on the challenge row as
-// `preferred_language`, replayed at confirm-email-code, and used only
-// for newly-registered accounts; existing accounts keep their stored
-// language.
+// supplied. When neither is supplied SendEmailCode falls back to the
+// platform default ("en"). The resolved value is persisted on the
+// challenge row as `preferred_language` and used by confirm-email-code
+// only for newly-registered accounts; existing accounts keep their
+// stored language.
 func (s *Service) SendEmailCode(
 	ctx context.Context,
 	email, locale, acceptLanguage, sourceIP string,
@@ -50,6 +51,9 @@ func (s *Service) SendEmailCode(
 	}
 
 	captured := pickCapturedLocale(locale, acceptLanguage)
+	if captured == "" {
+		captured = defaultLanguage
+	}
 
 	now := s.deps.Now()
 	windowStart := now.Add(-s.deps.Config.ChallengeThrottle.Window)
@@ -178,11 +182,23 @@ func (s *Service) ConfirmEmailCode(ctx context.Context, in ConfirmInputs) (Sessi
 		return Session{}, err
 	}
 
+	// Re-check permanent_block after verifying the code. SendEmailCode
+	// guards against fresh challenges for already-blocked addresses;
+	// this guard catches the case where an admin applied
+	// permanent_block in the window between send and confirm.
+	permanent, err := s.deps.Store.IsEmailPermanentlyBlocked(ctx, loaded.Email)
+	if err != nil {
+		return Session{}, fmt.Errorf("auth: check permanent block at confirm: %w", err)
+	}
+	if permanent {
+		return Session{}, ErrEmailPermanentlyBlocked
+	}
+
 	preferredLang := loaded.PreferredLanguage
 	if preferredLang == "" {
-		preferredLang = s.deps.Geo.LanguageForIP(in.SourceIP)
-	}
-	if preferredLang == "" {
+		// Defensive fallback: SendEmailCode now always persists a
+		// non-empty preferred_language, but a row written by an older
+		// build could still be empty.
 		preferredLang = defaultLanguage
 	}