Repository navigation
fix(otp): sign in by phone only with a verified phone - #513
Merged
Merged
Conversation
/login finds an account by phone, and offers phone_otp, only when the phone is verified, and the login phone OTP routes refuse an unverified one. The registration phone OTP routes no longer verify a phone on an account that is already verified; that takes an access session through /registration/phone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A phone number now has to be verified before it can be used to sign in, and an account that is already verified can no longer have a phone verified through the pre-auth registration routes.
POST /loginlooks an account up by phone only when that phone is verified, and listsphone_otponly for a verified phone./otp/generate-login-phone-otpanswers an unverified phone as it answers an account with no phone (400 Invalid data)./otp/verify-login-phone-otprefuses it (401 Not allowed)./otp/generate-phone-otpand/otp/verify-phone-otp(registration, pre-auth token) no longer act on an already verified account: sending answers200and sends nothing, verifying answers401. Adding or verifying a phone on a verified account goes through/registration/phone, which takes an access session.Each new answer is one a decoy or an account with no phone already gives, so none of them distinguishes real accounts.
Compatibility
Phone-first sign up (verify the phone, then the email, on one attempt) is unchanged and covered by a test. A client that verified the email first and then the phone on the same pre-auth token no longer gets the phone verified; it should add the phone with the session it receives. The SDK flows do not do this. Only deployments with
phone_otpinlogin_methodsare affected; it is off by default.Tests
tests/postgres/unverifiedPhoneClaim.spec.tsruns the real app and migration chain over HTTP: three cases for unverified phones, plus a phone-first sign up control.Checks
npm run typecheck,npm run lint,npm run format:check: passnpm run test:run: 157 files, 2357 passednpm run coverage: 98.91 / 95.32 / 99.24 / 99.11TEST_DB=postgres): 7 files, 37 passednpm run generate:api: no diff