censor new email address in email change emails

apps/labrinth/src/queue/email/templates.rs

@@ -739,7 +739,7 @@ async fn collect_template_variables(
             new_email,
             to_email: _,
         } => {
-            map.insert(EMAILCHANGED_NEW_EMAIL, new_email.clone());
+            map.insert(EMAILCHANGED_NEW_EMAIL, censor_email_address(new_email));
 
             Ok(EmailTemplate::Static(map))
         }
@@ -939,6 +939,23 @@ async fn dynamic_email_body(
     .await
 }
 
+fn censor_email_address(email: &str) -> String {
+    const MASK: &str = "***";
+
+    let Some((local, domain)) = email.rsplit_once('@') else {
+        return mask_local_part(email, MASK);
+    };
+
+    format!("{}@{domain}", mask_local_part(local, MASK))
+}
+
+fn mask_local_part(local: &str, mask: &str) -> String {
+    match local.chars().next() {
+        Some(first) => format!("{first}{mask}"),
+        None => mask.to_string(),
+    }
+}
+
 fn date_human_readable(date: chrono::DateTime<chrono::Utc>) -> String {
     date.format("%B %d, %Y").to_string()
 }