feat: remove legacy lookup in users for one_time_tokens (phase II)

internal/api/admin_test.go

@@ -594,6 +594,11 @@ func (ts *AdminTestSuite) TestAdminUserSoftDeletion() {
 		"provider": "email",
 	}
 	require.NoError(ts.T(), ts.API.db.Create(u))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.ConfirmationToken, models.ConfirmationToken))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.RecoveryToken, models.RecoveryToken))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.EmailChangeTokenCurrent, models.EmailChangeTokenCurrent))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.EmailChangeTokenNew, models.EmailChangeTokenNew))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetPhone(), u.PhoneChangeToken, models.PhoneChangeToken))
 
 	// create user identities
 	_, err = ts.API.createNewIdentity(ts.API.db, u, "email", map[string]interface{}{

internal/api/external_test.go

@@ -56,6 +56,10 @@ func (ts *ExternalTestSuite) createUser(providerId string, email string, name st
 	ts.Require().NoError(err, "Error making new user")
 	ts.Require().NoError(ts.API.db.Create(u), "Error creating user")
 
+	if confirmationToken != "" {
+		ts.Require().NoError(models.CreateOneTimeToken(ts.API.db, u.ID, email, u.ConfirmationToken, models.ConfirmationToken), "Error creating one-time confirmation/invite token")
+	}
+
 	i, err := models.NewIdentity(u, "email", map[string]interface{}{
 		"sub":   u.ID.String(),
 		"email": email,

internal/api/invite_test.go

@@ -211,6 +211,7 @@ func (ts *InviteTestSuite) TestVerifyInvite() {
 			user.ConfirmationToken = crypto.GenerateTokenHash(c.email, c.requestBody["token"].(string))
 			require.NoError(ts.T(), err)
 			require.NoError(ts.T(), ts.API.db.Create(user))
+			require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, user.ID, user.GetEmail(), user.ConfirmationToken, models.ConfirmationToken))
 
 			// Find test user
 			_, err = models.FindUserByEmailAndAudience(ts.API.db, c.email, ts.Config.JWT.Aud)

internal/api/resend_test.go

@@ -128,20 +128,24 @@ func (ts *ResendTestSuite) TestResendSuccess() {
 	u.EmailChangeSentAt = &now
 	u.EmailChangeTokenNew = "123456"
 	require.NoError(ts.T(), ts.API.db.Create(u), "Error saving new test user")
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.ConfirmationToken, models.ConfirmationToken))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.EmailChange, u.EmailChangeTokenNew, models.EmailChangeTokenNew))
 
 	phoneUser, err := models.NewUser("1234567890", "", "password", ts.Config.JWT.Aud, nil)
 	require.NoError(ts.T(), err, "Error creating test user model")
 	phoneUser.EmailChange = "bar@example.com"
 	phoneUser.EmailChangeSentAt = &now
 	phoneUser.EmailChangeTokenNew = "123456"
 	require.NoError(ts.T(), ts.API.db.Create(phoneUser), "Error saving new test user")
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, phoneUser.ID, phoneUser.EmailChange, phoneUser.EmailChangeTokenNew, models.EmailChangeTokenNew))
 
 	emailUser, err := models.NewUser("", "bar@example.com", "password", ts.Config.JWT.Aud, nil)
 	require.NoError(ts.T(), err, "Error creating test user model")
 	phoneUser.PhoneChange = "1234567890"
 	phoneUser.PhoneChangeSentAt = &now
 	phoneUser.PhoneChangeToken = "123456"
 	require.NoError(ts.T(), ts.API.db.Create(emailUser), "Error saving new test user")
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, phoneUser.ID, phoneUser.PhoneChange, phoneUser.PhoneChangeToken, models.PhoneChangeToken))
 
 	cases := []struct {
 		desc   string

internal/api/signup_test.go

@@ -4,13 +4,14 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	mail "github.com/supabase/auth/internal/mailer"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"testing"
 	"time"
 
+	mail "github.com/supabase/auth/internal/mailer"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
@@ -127,6 +128,7 @@ func (ts *SignupTestSuite) TestVerifySignup() {
 	user.ConfirmationSentAt = &now
 	require.NoError(ts.T(), err)
 	require.NoError(ts.T(), ts.API.db.Create(user))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, user.ID, user.GetEmail(), user.ConfirmationToken, models.ConfirmationToken))
 
 	// Find test user
 	u, err := models.FindUserByEmailAndAudience(ts.API.db, "test@example.com", ts.Config.JWT.Aud)

internal/api/verify_test.go

@@ -24,15 +24,11 @@ import (
 type VerifyVariant int
 
 const (
-	VerifyWithoutOTT VerifyVariant = iota
-	VerifyWithOTT
+	VerifyWithOTT VerifyVariant = iota
 )
 
 func (v VerifyVariant) String() string {
 	switch v {
-	case VerifyWithoutOTT:
-		return "WithoutOTT"
-
 	case VerifyWithOTT:
 		return "WithOTT"
 
@@ -71,7 +67,6 @@ func (ts *VerifyTestSuite) SetupTest() {
 
 func (ts *VerifyTestSuite) VerifyWithVariants(fn func(variant VerifyVariant)) {
 	variants := []VerifyVariant{
-		VerifyWithoutOTT,
 		VerifyWithOTT,
 	}
 
@@ -146,10 +141,6 @@ func (ts *VerifyTestSuite) TestVerifyPasswordRecovery() {
 
 				recoveryToken := u.RecoveryToken
 
-				if variant == VerifyWithoutOTT {
-					require.NoError(ts.T(), models.ClearAllOneTimeTokensForUser(ts.API.db, u.ID))
-				}
-
 				reqURL := fmt.Sprintf("http://localhost/verify?type=%s&token=%s", mail.RecoveryVerification, recoveryToken)
 				req = httptest.NewRequest(http.MethodGet, reqURL, nil)
 
@@ -249,10 +240,6 @@ func (ts *VerifyTestSuite) TestVerifySecureEmailChange() {
 			currentTokenHash := u.EmailChangeTokenCurrent
 			newTokenHash := u.EmailChangeTokenNew
 
-			if variant == VerifyWithoutOTT {
-				require.NoError(ts.T(), models.ClearAllOneTimeTokensForUser(ts.API.db, u.ID))
-			}
-
 			u, err = models.FindUserByEmailAndAudience(ts.API.db, c.currentEmail, ts.Config.JWT.Aud)
 			require.NoError(ts.T(), err)
 
@@ -332,6 +319,7 @@ func (ts *VerifyTestSuite) TestExpiredConfirmationToken() {
 	sentTime := time.Now().Add(-48 * time.Hour)
 	u.ConfirmationSentAt = &sentTime
 	require.NoError(ts.T(), ts.API.db.Update(u))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.ConfirmationToken, models.ConfirmationToken))
 
 	// Setup request
 	reqURL := fmt.Sprintf("http://localhost/verify?type=%s&token=%s", mail.SignupVerification, u.ConfirmationToken)
@@ -363,6 +351,8 @@ func (ts *VerifyTestSuite) TestInvalidOtp() {
 	u.PhoneChangeToken = "123456"
 	u.PhoneChangeSentAt = &sentTime
 	require.NoError(ts.T(), ts.API.db.Update(u))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.ConfirmationToken, models.ConfirmationToken))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.PhoneChange, u.PhoneChangeToken, models.PhoneChangeToken))
 
 	type ResponseBody struct {
 		Code int    `json:"code"`
@@ -685,6 +675,7 @@ func (ts *VerifyTestSuite) TestVerifySignupWithRedirectURLContainedPath() {
 			sendTime := time.Now().Add(time.Hour)
 			u.ConfirmationSentAt = &sendTime
 			require.NoError(ts.T(), ts.API.db.Update(u))
+			require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.ConfirmationToken, models.ConfirmationToken))
 
 			reqURL := fmt.Sprintf("http://localhost/verify?type=%s&token=%s&redirect_to=%s", "signup", u.ConfirmationToken, redirectURL)
 			req := httptest.NewRequest(http.MethodGet, reqURL, nil)
@@ -705,13 +696,10 @@ func (ts *VerifyTestSuite) TestVerifySignupWithRedirectURLContainedPath() {
 func (ts *VerifyTestSuite) TestVerifyPKCEOTP() {
 	u, err := models.FindUserByEmailAndAudience(ts.API.db, "test@example.com", ts.Config.JWT.Aud)
 	require.NoError(ts.T(), err)
-	u.ConfirmationToken = "pkce_confirmation_token"
-	u.RecoveryToken = "pkce_recovery_token"
 	t := time.Now()
 	u.ConfirmationSentAt = &t
 	u.RecoverySentAt = &t
 	u.EmailChangeSentAt = &t
-
 	require.NoError(ts.T(), ts.API.db.Update(u))
 
 	cases := []struct {
@@ -720,27 +708,35 @@ func (ts *VerifyTestSuite) TestVerifyPKCEOTP() {
 		authenticationMethod models.AuthenticationMethod
 	}{
 		{
-			desc: "Verify banned user on signup",
+			desc: "Verify user on signup",
 			payload: &VerifyParams{
 				Type:  "signup",
-				Token: u.ConfirmationToken,
+				Token: "pkce_confirmation_token",
 			},
 			authenticationMethod: models.EmailSignup,
 		},
 		{
 			desc: "Verify magiclink",
 			payload: &VerifyParams{
 				Type:  "magiclink",
-				Token: u.RecoveryToken,
+				Token: "pkce_recovery_token",
 			},
 			authenticationMethod: models.MagicLink,
 		},
 	}
 	for _, c := range cases {
 		ts.Run(c.desc, func() {
 			var buffer bytes.Buffer
+			// since the test user is the same, the tokens are being cleared after each successful verification attempt
+			// so we create them on each run
+			if c.payload.Type == "signup" {
+				require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), c.payload.Token, models.ConfirmationToken))
+			} else if c.payload.Type == "magiclink" {
+				require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), c.payload.Token, models.RecoveryToken))
+			}
+
 			require.NoError(ts.T(), json.NewEncoder(&buffer).Encode(c.payload))
-			codeChallenge := "codechallengecodechallengcodechallengcodechallengcodechallenge" + c.payload.Type
+			codeChallenge := "codechallengecodechallengcodechallengcodechallengcodechallenge"
 			flowState := models.NewFlowState(c.authenticationMethod.String(), codeChallenge, models.SHA256, c.authenticationMethod, &u.ID)
 			require.NoError(ts.T(), ts.API.db.Create(flowState))
 
@@ -780,6 +776,10 @@ func (ts *VerifyTestSuite) TestVerifyBannedUser() {
 	t = time.Now().Add(24 * time.Hour)
 	u.BannedUntil = &t
 	require.NoError(ts.T(), ts.API.db.Update(u))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.ConfirmationToken, models.ConfirmationToken))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.RecoveryToken, models.RecoveryToken))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.EmailChangeTokenCurrent, models.EmailChangeTokenCurrent))
+	require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, u.GetEmail(), u.EmailChangeTokenNew, models.EmailChangeTokenNew))
 
 	cases := []struct {
 		desc    string
@@ -1002,10 +1002,6 @@ func (ts *VerifyTestSuite) TestVerifyValidOtp() {
 				require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, "relates_to not used", u.EmailChangeTokenNew, models.EmailChangeTokenNew))
 				require.NoError(ts.T(), models.CreateOneTimeToken(ts.API.db, u.ID, "relates_to not used", u.PhoneChangeToken, models.PhoneChangeToken))
 
-				if variant == VerifyWithoutOTT {
-					require.NoError(ts.T(), models.ClearAllOneTimeTokensForUser(ts.API.db, u.ID))
-				}
-
 				require.NoError(ts.T(), ts.API.db.Update(u))
 
 				var buffer bytes.Buffer

internal/models/connection.go

@@ -48,6 +48,7 @@ func TruncateAll(conn *storage.Connection) error {
 			(&pop.Model{Value: SAMLProvider{}}).TableName(),
 			(&pop.Model{Value: SAMLRelayState{}}).TableName(),
 			(&pop.Model{Value: FlowState{}}).TableName(),
+			(&pop.Model{Value: OneTimeToken{}}).TableName(),
 		}
 
 		for _, tableName := range tables {

internal/models/one_time_token.go

@@ -178,99 +178,57 @@ func FindOneTimeToken(tx *storage.Connection, tokenHash string, tokenTypes ...On
 // FindUserByConfirmationToken finds users with the matching confirmation token.
 func FindUserByConfirmationOrRecoveryToken(tx *storage.Connection, token string) (*User, error) {
 	ott, err := FindOneTimeToken(tx, token, ConfirmationToken, RecoveryToken)
-	if err != nil && !IsNotFoundError(err) {
+	if err != nil {
 		return nil, err
 	}
 
-	if ott == nil {
-		user, err := findUser(tx, "(confirmation_token = ? or recovery_token = ?) and is_sso_user = false", token, token)
-		if err != nil {
-			if IsNotFoundError(err) {
-				return nil, ConfirmationOrRecoveryTokenNotFoundError{}
-			} else {
-				return nil, err
-			}
-		}
-
-		return user, nil
-	}
-
 	return FindUserByID(tx, ott.UserID)
 }
 
 // FindUserByConfirmationToken finds users with the matching confirmation token.
 func FindUserByConfirmationToken(tx *storage.Connection, token string) (*User, error) {
 	ott, err := FindOneTimeToken(tx, token, ConfirmationToken)
-	if err != nil && !IsNotFoundError(err) {
+	if err != nil {
 		return nil, err
 	}
 
-	if ott == nil {
-		user, err := findUser(tx, "confirmation_token = ? and is_sso_user = false", token)
-		if err != nil {
-			if IsNotFoundError(err) {
-				return nil, ConfirmationTokenNotFoundError{}
-			} else {
-				return nil, err
-			}
-		}
-
-		return user, nil
-	}
-
 	return FindUserByID(tx, ott.UserID)
 }
 
 // FindUserByRecoveryToken finds a user with the matching recovery token.
 func FindUserByRecoveryToken(tx *storage.Connection, token string) (*User, error) {
 	ott, err := FindOneTimeToken(tx, token, RecoveryToken)
-	if err != nil && !IsNotFoundError(err) {
+	if err != nil {
 		return nil, err
 	}
 
-	if ott == nil {
-		return findUser(tx, "recovery_token = ? and is_sso_user = false", token)
-	}
-
 	return FindUserByID(tx, ott.UserID)
 }
 
 // FindUserByEmailChangeToken finds a user with the matching email change token.
 func FindUserByEmailChangeToken(tx *storage.Connection, token string) (*User, error) {
 	ott, err := FindOneTimeToken(tx, token, EmailChangeTokenCurrent, EmailChangeTokenNew)
-	if err != nil && !IsNotFoundError(err) {
+	if err != nil {
 		return nil, err
 	}
 
-	if ott == nil {
-		return findUser(tx, "is_sso_user = false and (email_change_token_current = ? or email_change_token_new = ?)", token, token)
-	}
-
 	return FindUserByID(tx, ott.UserID)
 }
 
 // FindUserByEmailChangeCurrentAndAudience finds a user with the matching email change and audience.
 func FindUserByEmailChangeCurrentAndAudience(tx *storage.Connection, email, token, aud string) (*User, error) {
 	ott, err := FindOneTimeToken(tx, token, EmailChangeTokenCurrent)
-	if err != nil && !IsNotFoundError(err) {
+	if err != nil {
 		return nil, err
 	}
 
 	if ott == nil {
 		ott, err = FindOneTimeToken(tx, "pkce_"+token, EmailChangeTokenCurrent)
-		if err != nil && !IsNotFoundError(err) {
+		if err != nil {
 			return nil, err
 		}
 	}
 
-	if ott == nil {
-		return findUser(
-			tx,
-			"instance_id = ? and LOWER(email) = ? and aud = ? and is_sso_user = false and (email_change_token_current = 'pkce_' || ? or email_change_token_current = ?)",
-			uuid.Nil, strings.ToLower(email), aud, token, token,
-		)
-	}
-
 	user, err := FindUserByID(tx, ott.UserID)
 	if err != nil {
 		return nil, err
@@ -297,14 +255,6 @@ func FindUserByEmailChangeNewAndAudience(tx *storage.Connection, email, token, a
 		}
 	}
 
-	if ott == nil {
-		return findUser(
-			tx,
-			"instance_id = ? and LOWER(email_change) = ? and aud = ? and is_sso_user = false and (email_change_token_new = 'pkce_' || ? or email_change_token_new = ?)",
-			uuid.Nil, strings.ToLower(email), aud, token, token,
-		)
-	}
-
 	user, err := FindUserByID(tx, ott.UserID)
 	if err != nil {
 		return nil, err

internal/models/user_test.go

@@ -83,8 +83,10 @@ func (ts *UserTestSuite) TestUpdateUserMetadata() {
 
 func (ts *UserTestSuite) TestFindUserByConfirmationToken() {
 	u := ts.createUser()
+	tokenHash := "test_confirmation_token"
+	require.NoError(ts.T(), CreateOneTimeToken(ts.db, u.ID, "relates_to not used", tokenHash, ConfirmationToken))
 
-	n, err := FindUserByConfirmationToken(ts.db, u.ConfirmationToken)
+	n, err := FindUserByConfirmationToken(ts.db, tokenHash)
 	require.NoError(ts.T(), err)
 	require.Equal(ts.T(), u.ID, n.ID)
 }
@@ -136,14 +138,11 @@ func (ts *UserTestSuite) TestFindUserByID() {
 
 func (ts *UserTestSuite) TestFindUserByRecoveryToken() {
 	u := ts.createUser()
-	u.RecoveryToken = "asdf"
+	tokenHash := "test_recovery_token"
+	require.NoError(ts.T(), CreateOneTimeToken(ts.db, u.ID, "relates_to not used", tokenHash, RecoveryToken))
 
-	err := ts.db.Update(u)
+	n, err := FindUserByRecoveryToken(ts.db, tokenHash)
 	require.NoError(ts.T(), err)
-
-	n, err := FindUserByRecoveryToken(ts.db, u.RecoveryToken)
-	require.NoError(ts.T(), err)
-
 	require.Equal(ts.T(), u.ID, n.ID)
 }