Token detection in email validation doesn't work if the token contains a comma

I understand the issue but we need to support email addresses and tokens

admin@example.com, [webform_submission:source-entity:co_authors_email:join:,]

Maybe we need to remove all tokens before the value's email addresses are validated.

Below is an untested POC.

      // If tokens are allowed, remove them before validating the email addresses.
      $values = preg_split(
        '/\s*,\s*/',
        (!empty($element['#allow_tokens']))
          ? preg_replace('/\[[^\]]+\]/', '', $value)
          : $value
      );
      foreach ($values as $value) {
        if ($value && !\Drupal::service('email.validator')->isValid($value)) {
          $form_state->setError($element, t('The email address %mail is not valid.', ['%mail' => $value]));
          return;
        }

Wouldn't it be best if we actually replace the tokens before validating? I noticed there's cardinality validation after the email address validation. That cardinality validation can be bypassed when you use tokens, because one token can include multiple email addresses.

Never mind, we're in context of a settings form. Of course there's no webform submission there to replace tokens with. I guess we can ignore the cardinality validation in this context.

I applied your suggestion.

We need to fix the broken test.

Can we please use snake case to internal variables?

$emailAddresses use $email_addresses (or $emails)

I updated the casing.

About the test failure, there's a test that checks if the following is allowed:

[token1]@[token2].com

Which isn't anymore, because now we're stripping tokens before validating email addresses and looking at the test output, it's trying to validate @.com as an email address. Do we remove this test or update the implementation?

I think the [token1]@[token2].com test was added for a reason.

We might have to take a different approach.

Pleaser review the different approach, which escapes the tokens and then skips the validation. The MR includes test coverage for commas within tokens.

Just tested and that works, thanks a lot for the help!