{#if invites.length === 0}
-
No invite codes found
+
{$_('admin.noInvites')}
{:else}
- | Code |
- Available |
- Uses |
- Status |
- Created |
- Actions |
+ {$_('admin.code')} |
+ {$_('admin.available')} |
+ {$_('admin.uses')} |
+ {$_('admin.status')} |
+ {$_('admin.created')} |
+ {$_('admin.actions')} |
@@ -549,18 +549,18 @@
{invite.uses.length} |
{#if invite.disabled}
- Disabled
+ {$_('admin.disabled')}
{:else if invite.available === 0}
- Exhausted
+ {$_('admin.exhausted')}
{:else}
- Active
+ {$_('admin.active')}
{/if}
|
{formatDate(invite.createdAt)} |
{#if !invite.disabled}
{:else}
-
@@ -572,7 +572,7 @@
|
{#if invitesCursor}
{/if}
{/if}
@@ -585,38 +585,38 @@
e.key === 'Escape' && closeUserDetail()} role="presentation">
e.stopPropagation()} onkeydown={(e) => e.stopPropagation()} role="dialog" aria-modal="true" tabindex="-1">
{#if userDetailLoading}
-
Loading...
+
{$_('admin.loading')}
{:else}
- - Handle
+ - {$_('admin.handle')}
- @{selectedUser.handle}
- - DID
+ - {$_('admin.did')}
- {selectedUser.did}
- - Email
+ - {$_('admin.email')}
- {selectedUser.email || '-'}
- - Status
+ - {$_('admin.status')}
-
{#if selectedUser.deactivatedAt}
- Deactivated
+ {$_('admin.deactivated')}
{:else if selectedUser.emailConfirmedAt}
- Verified
+ {$_('admin.verified')}
{:else}
- Unverified
+ {$_('admin.unverified')}
{/if}
- - Created
+ - {$_('admin.created')}
- {formatDateTime(selectedUser.indexedAt)}
- - Invites
+ - {$_('admin.invites')}
-
{#if selectedUser.invitesDisabled}
- Disabled
+ {$_('admin.disabled')}
{:else}
- Enabled
+ {$_('admin.enabled')}
{/if}
@@ -626,14 +626,14 @@
onclick={toggleUserInvites}
disabled={userActionLoading}
>
- {selectedUser.invitesDisabled ? 'Enable Invites' : 'Disable Invites'}
+ {selectedUser.invitesDisabled ? $_('admin.enableInvites') : $_('admin.disableInvites')}
@@ -642,7 +642,7 @@
{/if}
{:else if auth.loading}
-
Loading...
+
{$_('admin.loading')}
{/if}
diff --git a/migrations/20251232_add_migration_verification_comms_type.sql b/migrations/20251232_add_migration_verification_comms_type.sql
new file mode 100644
index 0000000..6cf8a9d
--- /dev/null
+++ b/migrations/20251232_add_migration_verification_comms_type.sql
@@ -0,0 +1 @@
+ALTER TYPE comms_type ADD VALUE IF NOT EXISTS 'migration_verification';
diff --git a/migrations/20251233_remove_channel_verifications.sql b/migrations/20251233_remove_channel_verifications.sql
new file mode 100644
index 0000000..37e780b
--- /dev/null
+++ b/migrations/20251233_remove_channel_verifications.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS channel_verifications;
diff --git a/src/api/admin/config.rs b/src/api/admin/config.rs
index 506da8a..4e23f64 100644
--- a/src/api/admin/config.rs
+++ b/src/api/admin/config.rs
@@ -1,7 +1,7 @@
use crate::api::error::ApiError;
use crate::auth::BearerAuthAdmin;
use crate::state::AppState;
-use axum::{extract::State, Json};
+use axum::{Json, extract::State};
use serde::{Deserialize, Serialize};
use tracing::error;
@@ -80,7 +80,7 @@ pub async fn get_server_config(
async fn upsert_config(db: &sqlx::PgPool, key: &str, value: &str) -> Result<(), sqlx::Error> {
sqlx::query(
"INSERT INTO server_config (key, value, updated_at) VALUES ($1, $2, NOW())
- ON CONFLICT (key) DO UPDATE SET value = $2, updated_at = NOW()"
+ ON CONFLICT (key) DO UPDATE SET value = $2, updated_at = NOW()",
)
.bind(key)
.bind(value)
@@ -105,7 +105,9 @@ pub async fn update_server_config(
if let Some(server_name) = req.server_name {
let trimmed = server_name.trim();
if trimmed.is_empty() || trimmed.len() > 100 {
- return Err(ApiError::InvalidRequest("Server name must be 1-100 characters".into()));
+ return Err(ApiError::InvalidRequest(
+ "Server name must be 1-100 characters".into(),
+ ));
}
upsert_config(&state.db, "server_name", trimmed).await?;
}
@@ -116,7 +118,9 @@ pub async fn update_server_config(
} else if is_valid_hex_color(color) {
upsert_config(&state.db, "primary_color", color).await?;
} else {
- return Err(ApiError::InvalidRequest("Invalid primary color format (expected #RRGGBB)".into()));
+ return Err(ApiError::InvalidRequest(
+ "Invalid primary color format (expected #RRGGBB)".into(),
+ ));
}
}
@@ -126,7 +130,9 @@ pub async fn update_server_config(
} else if is_valid_hex_color(color) {
upsert_config(&state.db, "primary_color_dark", color).await?;
} else {
- return Err(ApiError::InvalidRequest("Invalid primary dark color format (expected #RRGGBB)".into()));
+ return Err(ApiError::InvalidRequest(
+ "Invalid primary dark color format (expected #RRGGBB)".into(),
+ ));
}
}
@@ -136,7 +142,9 @@ pub async fn update_server_config(
} else if is_valid_hex_color(color) {
upsert_config(&state.db, "secondary_color", color).await?;
} else {
- return Err(ApiError::InvalidRequest("Invalid secondary color format (expected #RRGGBB)".into()));
+ return Err(ApiError::InvalidRequest(
+ "Invalid secondary color format (expected #RRGGBB)".into(),
+ ));
}
}
@@ -146,16 +154,17 @@ pub async fn update_server_config(
} else if is_valid_hex_color(color) {
upsert_config(&state.db, "secondary_color_dark", color).await?;
} else {
- return Err(ApiError::InvalidRequest("Invalid secondary dark color format (expected #RRGGBB)".into()));
+ return Err(ApiError::InvalidRequest(
+ "Invalid secondary dark color format (expected #RRGGBB)".into(),
+ ));
}
}
if let Some(ref logo_cid) = req.logo_cid {
- let old_logo_cid: Option
= sqlx::query_scalar(
- "SELECT value FROM server_config WHERE key = 'logo_cid'"
- )
- .fetch_optional(&state.db)
- .await?;
+ let old_logo_cid: Option =
+ sqlx::query_scalar("SELECT value FROM server_config WHERE key = 'logo_cid'")
+ .fetch_optional(&state.db)
+ .await?;
let should_delete_old = match (&old_logo_cid, logo_cid.is_empty()) {
(Some(old), true) => Some(old.clone()),
@@ -163,23 +172,20 @@ pub async fn update_server_config(
_ => None,
};
- if let Some(old_cid) = should_delete_old {
- if let Ok(Some(blob)) = sqlx::query!(
- "SELECT storage_key FROM blobs WHERE cid = $1",
- old_cid
- )
- .fetch_optional(&state.db)
- .await
- {
- if let Err(e) = state.blob_store.delete(&blob.storage_key).await {
- error!("Failed to delete old logo blob from storage: {:?}", e);
- }
- if let Err(e) = sqlx::query!("DELETE FROM blobs WHERE cid = $1", old_cid)
- .execute(&state.db)
+ if let Some(old_cid) = should_delete_old
+ && let Ok(Some(blob)) =
+ sqlx::query!("SELECT storage_key FROM blobs WHERE cid = $1", old_cid)
+ .fetch_optional(&state.db)
.await
- {
- error!("Failed to delete old logo blob record: {:?}", e);
- }
+ {
+ if let Err(e) = state.blob_store.delete(&blob.storage_key).await {
+ error!("Failed to delete old logo blob from storage: {:?}", e);
+ }
+ if let Err(e) = sqlx::query!("DELETE FROM blobs WHERE cid = $1", old_cid)
+ .execute(&state.db)
+ .await
+ {
+ error!("Failed to delete old logo blob record: {:?}", e);
}
}
diff --git a/src/api/error.rs b/src/api/error.rs
index 562b485..5e41fda 100644
--- a/src/api/error.rs
+++ b/src/api/error.rs
@@ -94,7 +94,9 @@ impl ApiError {
fn error_name(&self) -> Cow<'static, str> {
match self {
Self::InternalError | Self::DatabaseError => Cow::Borrowed("InternalError"),
- Self::UpstreamFailure | Self::UpstreamUnavailable(_) => Cow::Borrowed("UpstreamFailure"),
+ Self::UpstreamFailure | Self::UpstreamUnavailable(_) => {
+ Cow::Borrowed("UpstreamFailure")
+ }
Self::UpstreamTimeout => Cow::Borrowed("UpstreamTimeout"),
Self::UpstreamError { error, .. } => {
if let Some(e) = error {
diff --git a/src/api/identity/account.rs b/src/api/identity/account.rs
index 3e967ea..4e2aa04 100644
--- a/src/api/identity/account.rs
+++ b/src/api/identity/account.rs
@@ -132,11 +132,11 @@ pub async fn create_account(
.map(|d| d.starts_with("did:plc:"))
.unwrap_or(false);
- if is_migration || is_did_web_byod {
- if let (Some(provided_did), Some(auth_did)) = (input.did.as_ref(), migration_auth.as_ref())
- {
- if provided_did != auth_did {
- return (
+ if (is_migration || is_did_web_byod)
+ && let (Some(provided_did), Some(auth_did)) = (input.did.as_ref(), migration_auth.as_ref())
+ {
+ if provided_did != auth_did {
+ return (
StatusCode::FORBIDDEN,
Json(json!({
"error": "AuthorizationError",
@@ -144,12 +144,11 @@ pub async fn create_account(
})),
)
.into_response();
- }
- if is_did_web_byod {
- info!(did = %provided_did, "Processing did:web BYOD account creation");
- } else {
- info!(did = %provided_did, "Processing account migration");
- }
+ }
+ if is_did_web_byod {
+ info!(did = %provided_did, "Processing did:web BYOD account creation");
+ } else {
+ info!(did = %provided_did, "Processing account migration");
}
}
@@ -348,16 +347,15 @@ pub async fn create_account(
)
.into_response();
}
- if !is_did_web_byod {
- if let Err(e) =
+ if !is_did_web_byod
+ && let Err(e) =
verify_did_web(d, &hostname, &input.handle, input.signing_key.as_deref()).await
- {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidDid", "message": e})),
- )
- .into_response();
- }
+ {
+ return (
+ StatusCode::BAD_REQUEST,
+ Json(json!({"error": "InvalidDid", "message": e})),
+ )
+ .into_response();
}
info!(did = %d, "Creating external did:web account");
d.clone()
@@ -368,17 +366,20 @@ pub async fn create_account(
info!(did = %d, "Migration with existing did:plc");
d.clone()
} else if d.starts_with("did:web:") {
- if !is_did_web_byod {
- if let Err(e) =
- verify_did_web(d, &hostname, &input.handle, input.signing_key.as_deref())
- .await
- {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidDid", "message": e})),
- )
- .into_response();
- }
+ if !is_did_web_byod
+ && let Err(e) = verify_did_web(
+ d,
+ &hostname,
+ &input.handle,
+ input.signing_key.as_deref(),
+ )
+ .await
+ {
+ return (
+ StatusCode::BAD_REQUEST,
+ Json(json!({"error": "InvalidDid", "message": e})),
+ )
+ .into_response();
}
d.clone()
} else if !d.trim().is_empty() {
@@ -710,8 +711,6 @@ pub async fn create_account(
.into_response();
}
};
- let verification_code = format!("{:06}", rand::random::() % 1_000_000);
- let code_expires_at = chrono::Utc::now() + chrono::Duration::minutes(30);
let is_first_user = sqlx::query_scalar!("SELECT COUNT(*) as count FROM users")
.fetch_one(&mut *tx)
.await
@@ -758,7 +757,7 @@ pub async fn create_account(
)
.bind(is_first_user)
.bind(deactivated_at)
- .bind(is_migration)
+ .bind(false)
.fetch_one(&mut *tx)
.await;
let user_id = match user_insert {
@@ -806,25 +805,6 @@ pub async fn create_account(
}
};
- if !is_migration
- && let Some(ref recipient) = verification_recipient
- && let Err(e) = sqlx::query!(
- "INSERT INTO channel_verifications (user_id, channel, code, pending_identifier, expires_at) VALUES ($1, $2::comms_channel, $3, $4, $5)",
- user_id,
- verification_channel as _,
- verification_code,
- recipient,
- code_expires_at
- )
- .execute(&mut *tx)
- .await {
- error!("Error inserting verification code: {:?}", e);
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
let encrypted_key_bytes = match crate::config::encrypt_key(&secret_key_bytes) {
Ok(enc) => enc,
Err(e) => {
@@ -881,17 +861,18 @@ pub async fn create_account(
}
};
let rev = Tid::now(LimitedU32::MIN);
- let (commit_bytes, _sig) = match create_signed_commit(&did, mst_root, &rev.to_string(), None, &signing_key) {
- Ok(result) => result,
- Err(e) => {
- error!("Error creating genesis commit: {:?}", e);
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
- };
+ let (commit_bytes, _sig) =
+ match create_signed_commit(&did, mst_root, rev.as_ref(), None, &signing_key) {
+ Ok(result) => result,
+ Err(e) => {
+ error!("Error creating genesis commit: {:?}", e);
+ return (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({"error": "InternalError"})),
+ )
+ .into_response();
+ }
+ };
let commit_cid = match state.block_store.put(&commit_bytes).await {
Ok(c) => c,
Err(e) => {
@@ -973,22 +954,45 @@ pub async fn create_account(
warn!("Failed to create default profile for {}: {}", did, e);
}
}
+ let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
if !is_migration {
- if let Some(ref recipient) = verification_recipient
- && let Err(e) = crate::comms::enqueue_signup_verification(
+ if let Some(ref recipient) = verification_recipient {
+ let verification_token = crate::auth::verification_token::generate_signup_token(
+ &did,
+ verification_channel,
+ recipient,
+ );
+ let formatted_token =
+ crate::auth::verification_token::format_token_for_display(&verification_token);
+ if let Err(e) = crate::comms::enqueue_signup_verification(
&state.db,
user_id,
verification_channel,
recipient,
- &verification_code,
+ &formatted_token,
None,
)
.await
+ {
+ warn!(
+ "Failed to enqueue signup verification notification: {:?}",
+ e
+ );
+ }
+ }
+ } else if let Some(ref user_email) = email {
+ let token = crate::auth::verification_token::generate_migration_token(&did, user_email);
+ let formatted_token = crate::auth::verification_token::format_token_for_display(&token);
+ if let Err(e) = crate::comms::enqueue_migration_verification(
+ &state.db,
+ user_id,
+ user_email,
+ &formatted_token,
+ &hostname,
+ )
+ .await
{
- warn!(
- "Failed to enqueue signup verification notification: {:?}",
- e
- );
+ warn!("Failed to enqueue migration verification email: {:?}", e);
}
}
diff --git a/src/api/notification_prefs.rs b/src/api/notification_prefs.rs
index 8c7fca0..18312ea 100644
--- a/src/api/notification_prefs.rs
+++ b/src/api/notification_prefs.rs
@@ -6,21 +6,11 @@ use axum::{
http::{HeaderMap, StatusCode},
response::{IntoResponse, Response},
};
-use chrono::{Duration, Utc};
-use rand::Rng;
use serde::{Deserialize, Serialize};
use serde_json::json;
use sqlx::Row;
use tracing::info;
-fn generate_verification_code() -> String {
- rand::thread_rng()
- .sample_iter(&rand::distributions::Uniform::new(0, 10))
- .take(6)
- .map(|x| x.to_string())
- .collect()
-}
-
#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
pub struct NotificationPrefsResponse {
@@ -228,36 +218,28 @@ pub struct UpdateNotificationPrefsResponse {
pub async fn request_channel_verification(
db: &sqlx::PgPool,
user_id: uuid::Uuid,
+ did: &str,
channel: &str,
identifier: &str,
handle: Option<&str>,
) -> Result {
- let code = generate_verification_code();
- let expires_at = Utc::now() + Duration::minutes(10);
-
- sqlx::query!(
- r#"
- INSERT INTO channel_verifications (user_id, channel, code, pending_identifier, expires_at)
- VALUES ($1, $2::comms_channel, $3, $4, $5)
- ON CONFLICT (user_id, channel) DO UPDATE
- SET code = $3, pending_identifier = $4, expires_at = $5, created_at = NOW()
- "#,
- user_id,
- channel as _,
- code,
- identifier,
- expires_at
- )
- .execute(db)
- .await
- .map_err(|e| format!("Database error: {}", e))?;
+ let token =
+ crate::auth::verification_token::generate_channel_update_token(did, channel, identifier);
+ let formatted_token = crate::auth::verification_token::format_token_for_display(&token);
if channel == "email" {
let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
let handle_str = handle.unwrap_or("user");
- crate::comms::enqueue_email_update(db, user_id, identifier, handle_str, &code, &hostname)
- .await
- .map_err(|e| format!("Failed to enqueue email notification: {}", e))?;
+ crate::comms::enqueue_email_update(
+ db,
+ user_id,
+ identifier,
+ handle_str,
+ &formatted_token,
+ &hostname,
+ )
+ .await
+ .map_err(|e| format!("Failed to enqueue email notification: {}", e))?;
} else {
sqlx::query!(
r#"
@@ -267,15 +249,15 @@ pub async fn request_channel_verification(
user_id,
channel as _,
identifier,
- format!("Your verification code is: {}", code),
- json!({"code": code})
+ format!("Your verification code is: {}", formatted_token),
+ json!({"code": formatted_token})
)
.execute(db)
.await
.map_err(|e| format!("Failed to enqueue notification: {}", e))?;
}
- Ok(code)
+ Ok(token)
}
pub async fn update_notification_prefs(
@@ -397,6 +379,7 @@ pub async fn update_notification_prefs(
if let Err(e) = request_channel_verification(
&state.db,
user_id,
+ &user.did,
"email",
&email_clean,
Some(&handle),
@@ -429,16 +412,12 @@ pub async fn update_notification_prefs(
)
.into_response();
}
- let _ = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = 'discord'",
- user_id
- )
- .execute(&state.db)
- .await;
info!(did = %user.did, "Cleared Discord ID");
} else {
- if let Err(e) =
- request_channel_verification(&state.db, user_id, "discord", discord_id, None).await
+ if let Err(e) = request_channel_verification(
+ &state.db, user_id, &user.did, "discord", discord_id, None,
+ )
+ .await
{
return (
StatusCode::INTERNAL_SERVER_ERROR,
@@ -467,17 +446,17 @@ pub async fn update_notification_prefs(
)
.into_response();
}
- let _ = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = 'telegram'",
- user_id
- )
- .execute(&state.db)
- .await;
info!(did = %user.did, "Cleared Telegram username");
} else {
- if let Err(e) =
- request_channel_verification(&state.db, user_id, "telegram", telegram_clean, None)
- .await
+ if let Err(e) = request_channel_verification(
+ &state.db,
+ user_id,
+ &user.did,
+ "telegram",
+ telegram_clean,
+ None,
+ )
+ .await
{
return (
StatusCode::INTERNAL_SERVER_ERROR,
@@ -505,16 +484,11 @@ pub async fn update_notification_prefs(
)
.into_response();
}
- let _ = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = 'signal'",
- user_id
- )
- .execute(&state.db)
- .await;
info!(did = %user.did, "Cleared Signal number");
} else {
if let Err(e) =
- request_channel_verification(&state.db, user_id, "signal", signal, None).await
+ request_channel_verification(&state.db, user_id, &user.did, "signal", signal, None)
+ .await
{
return (
StatusCode::INTERNAL_SERVER_ERROR,
diff --git a/src/api/repo/record/utils.rs b/src/api/repo/record/utils.rs
index 4359c53..acbb766 100644
--- a/src/api/repo/record/utils.rs
+++ b/src/api/repo/record/utils.rs
@@ -3,7 +3,7 @@ use bytes::Bytes;
use cid::Cid;
use jacquard::types::{integer::LimitedU32, string::Tid};
use jacquard_repo::storage::BlockStore;
-use k256::ecdsa::{signature::Signer, Signature, SigningKey};
+use k256::ecdsa::{Signature, SigningKey, signature::Signer};
use serde::Serialize;
use serde_json::json;
use uuid::Uuid;
diff --git a/src/api/server/email.rs b/src/api/server/email.rs
index 6c1d582..95e5a10 100644
--- a/src/api/server/email.rs
+++ b/src/api/server/email.rs
@@ -6,7 +6,6 @@ use axum::{
http::StatusCode,
response::{IntoResponse, Response},
};
-use chrono::Utc;
use serde::Deserialize;
use serde_json::json;
use tracing::{error, info, warn};
@@ -66,7 +65,7 @@ pub async fn request_email_update(
return e;
}
- let did = auth_user.did;
+ let did = auth_user.did.clone();
let user = match sqlx::query!("SELECT id, handle, email FROM users WHERE did = $1", did)
.fetch_optional(&state.db)
.await
@@ -117,6 +116,7 @@ pub async fn request_email_update(
if let Err(e) = crate::api::notification_prefs::request_channel_verification(
&state.db,
user_id,
+ &did,
"email",
&email,
Some(&handle),
@@ -206,62 +206,50 @@ pub async fn confirm_email(
}
};
- let verification = match sqlx::query!(
- "SELECT code, pending_identifier, expires_at FROM channel_verifications WHERE user_id = $1 AND channel = 'email'",
- user_id
- )
- .fetch_optional(&state.db)
- .await
- {
- Ok(Some(row)) => row,
- _ => {
+ let email = input.email.trim().to_lowercase();
+ let confirmation_code =
+ crate::auth::verification_token::normalize_token_input(input.token.trim());
+
+ let verified = crate::auth::verification_token::verify_channel_update_token(
+ &confirmation_code,
+ "email",
+ &email,
+ );
+
+ match verified {
+ Ok(token_data) => {
+ if token_data.did != did {
+ return (
+ StatusCode::BAD_REQUEST,
+ Json(
+ json!({"error": "InvalidToken", "message": "Token does not match account"}),
+ ),
+ )
+ .into_response();
+ }
+ }
+ Err(crate::auth::verification_token::VerifyError::Expired) => {
return (
StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidRequest", "message": "No pending email update found"})),
+ Json(json!({"error": "ExpiredToken", "message": "Token has expired"})),
+ )
+ .into_response();
+ }
+ Err(_) => {
+ return (
+ StatusCode::BAD_REQUEST,
+ Json(json!({"error": "InvalidToken", "message": "Invalid token"})),
)
.into_response();
}
- };
-
- let pending_email = verification.pending_identifier.unwrap_or_default();
- let email = input.email.trim().to_lowercase();
- let confirmation_code = input.token.trim();
-
- if pending_email != email {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidRequest", "message": "Email does not match pending update"})),
- )
- .into_response();
}
- if verification.code != confirmation_code {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidToken", "message": "Invalid token"})),
- )
- .into_response();
- }
-
- if Utc::now() > verification.expires_at {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "ExpiredToken", "message": "Token has expired"})),
- )
- .into_response();
- }
-
- let mut tx = match state.db.begin().await {
- Ok(tx) => tx,
- Err(_) => return ApiError::InternalError.into_response(),
- };
-
let update = sqlx::query!(
- "UPDATE users SET email = $1, updated_at = NOW() WHERE id = $2",
- pending_email,
+ "UPDATE users SET email = $1, email_verified = TRUE, updated_at = NOW() WHERE id = $2",
+ email,
user_id
)
- .execute(&mut *tx)
+ .execute(&state.db)
.await;
if let Err(e) = update {
@@ -283,21 +271,6 @@ pub async fn confirm_email(
.into_response();
}
- if let Err(e) = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = 'email'",
- user_id
- )
- .execute(&mut *tx)
- .await
- {
- error!("Failed to delete verification record: {:?}", e);
- return ApiError::InternalError.into_response();
- }
-
- if tx.commit().await.is_err() {
- return ApiError::InternalError.into_response();
- }
-
info!("Email updated for user {}", user_id);
(StatusCode::OK, Json(json!({}))).into_response()
}
@@ -377,50 +350,49 @@ pub async fn update_email(
return (StatusCode::OK, Json(json!({}))).into_response();
}
- let verification = sqlx::query!(
- "SELECT code, pending_identifier, expires_at FROM channel_verifications WHERE user_id = $1 AND channel = 'email'",
- user_id
- )
- .fetch_optional(&state.db)
- .await
- .unwrap_or(None);
+ let confirmation_token = match &input.token {
+ Some(t) => crate::auth::verification_token::normalize_token_input(t.trim()),
+ None => {
+ return (
+ StatusCode::BAD_REQUEST,
+ Json(json!({"error": "TokenRequired", "message": "Token required. Call requestEmailUpdate first."})),
+ )
+ .into_response();
+ }
+ };
- if let Some(ver) = verification {
- let confirmation_token = match &input.token {
- Some(t) => t.trim(),
- None => {
+ let verified = crate::auth::verification_token::verify_channel_update_token(
+ &confirmation_token,
+ "email",
+ &new_email,
+ );
+
+ match verified {
+ Ok(token_data) => {
+ if token_data.did != did {
return (
StatusCode::BAD_REQUEST,
- Json(json!({"error": "TokenRequired", "message": "Token required. Call requestEmailUpdate first."})),
+ Json(
+ json!({"error": "InvalidToken", "message": "Token does not match account"}),
+ ),
)
.into_response();
}
- };
-
- let pending_email = ver.pending_identifier.unwrap_or_default();
- if pending_email.to_lowercase() != new_email {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidRequest", "message": "Email does not match pending update"})),
- )
- .into_response();
}
-
- if ver.code != confirmation_token {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidToken", "message": "Invalid token"})),
- )
- .into_response();
- }
-
- if Utc::now() > ver.expires_at {
+ Err(crate::auth::verification_token::VerifyError::Expired) => {
return (
StatusCode::BAD_REQUEST,
Json(json!({"error": "ExpiredToken", "message": "Token has expired"})),
)
.into_response();
}
+ Err(_) => {
+ return (
+ StatusCode::BAD_REQUEST,
+ Json(json!({"error": "InvalidToken", "message": "Invalid token"})),
+ )
+ .into_response();
+ }
}
let exists = sqlx::query!(
@@ -439,17 +411,12 @@ pub async fn update_email(
.into_response();
}
- let mut tx = match state.db.begin().await {
- Ok(tx) => tx,
- Err(_) => return ApiError::InternalError.into_response(),
- };
-
let update = sqlx::query!(
- "UPDATE users SET email = $1, updated_at = NOW() WHERE id = $2",
+ "UPDATE users SET email = $1, email_verified = TRUE, updated_at = NOW() WHERE id = $2",
new_email,
user_id
)
- .execute(&mut *tx)
+ .execute(&state.db)
.await;
if let Err(e) = update {
@@ -471,17 +438,6 @@ pub async fn update_email(
.into_response();
}
- let _ = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = 'email'",
- user_id
- )
- .execute(&mut *tx)
- .await;
-
- if tx.commit().await.is_err() {
- return ApiError::InternalError.into_response();
- }
-
match sqlx::query!(
"INSERT INTO account_preferences (user_id, name, value_json) VALUES ($1, 'email_auth_factor', $2) ON CONFLICT (user_id, name) DO UPDATE SET value_json = $2",
user_id,
diff --git a/src/api/server/logo.rs b/src/api/server/logo.rs
index c8c42b9..91b02b4 100644
--- a/src/api/server/logo.rs
+++ b/src/api/server/logo.rs
@@ -9,18 +9,17 @@ use axum::{
use tracing::error;
pub async fn get_logo(State(state): State) -> Response {
- let logo_cid: Option = match sqlx::query_scalar(
- "SELECT value FROM server_config WHERE key = 'logo_cid'"
- )
- .fetch_optional(&state.db)
- .await
- {
- Ok(cid) => cid,
- Err(e) => {
- error!("DB error fetching logo_cid: {:?}", e);
- return StatusCode::INTERNAL_SERVER_ERROR.into_response();
- }
- };
+ let logo_cid: Option =
+ match sqlx::query_scalar("SELECT value FROM server_config WHERE key = 'logo_cid'")
+ .fetch_optional(&state.db)
+ .await
+ {
+ Ok(cid) => cid,
+ Err(e) => {
+ error!("DB error fetching logo_cid: {:?}", e);
+ return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+ }
+ };
let cid = match logo_cid {
Some(c) if !c.is_empty() => c,
diff --git a/src/api/server/mod.rs b/src/api/server/mod.rs
index aceb14d..588113c 100644
--- a/src/api/server/mod.rs
+++ b/src/api/server/mod.rs
@@ -13,6 +13,8 @@ pub mod session;
pub mod signing_key;
pub mod totp;
pub mod trusted_devices;
+pub mod verify_email;
+pub mod verify_token;
pub use account_status::{
activate_account, check_account_status, deactivate_account, delete_account,
@@ -35,9 +37,9 @@ pub use password::{
change_password, get_password_status, remove_password, request_password_reset, reset_password,
};
pub use reauth::{
- check_legacy_session_mfa, check_reauth_required, get_reauth_status, legacy_mfa_required_response,
- reauth_passkey_finish, reauth_passkey_start, reauth_password, reauth_required_response,
- reauth_totp, update_mfa_verified,
+ check_legacy_session_mfa, check_reauth_required, get_reauth_status,
+ legacy_mfa_required_response, reauth_passkey_finish, reauth_passkey_start, reauth_password,
+ reauth_required_response, reauth_totp, update_mfa_verified,
};
pub use service_auth::get_service_auth;
pub use session::{
@@ -54,3 +56,5 @@ pub use trusted_devices::{
extend_device_trust, is_device_trusted, list_trusted_devices, revoke_trusted_device,
trust_device, update_trusted_device,
};
+pub use verify_email::{resend_migration_verification, verify_migration_email};
+pub use verify_token::{VerifyTokenInput, VerifyTokenOutput, verify_token, verify_token_internal};
diff --git a/src/api/server/passkey_account.rs b/src/api/server/passkey_account.rs
index 79c6fd9..9b5350b 100644
--- a/src/api/server/passkey_account.rs
+++ b/src/api/server/passkey_account.rs
@@ -117,7 +117,10 @@ pub async fn create_passkey_account(
.await
{
Ok(claims) => {
- debug!("Service token verified for BYOD did:web: iss={}", claims.iss);
+ debug!(
+ "Service token verified for BYOD did:web: iss={}",
+ claims.iss
+ );
Some(claims.iss)
}
Err(e) => {
@@ -342,9 +345,10 @@ pub async fn create_passkey_account(
.into_response();
}
if is_byod_did_web {
- if let Some(ref auth_did) = byod_auth {
- if d != auth_did {
- return (
+ if let Some(ref auth_did) = byod_auth
+ && d != auth_did
+ {
+ return (
StatusCode::FORBIDDEN,
Json(json!({
"error": "AuthorizationError",
@@ -352,7 +356,6 @@ pub async fn create_passkey_account(
})),
)
.into_response();
- }
}
info!(did = %d, "Creating external did:web passkey account (BYOD key)");
} else {
@@ -416,12 +419,6 @@ pub async fn create_passkey_account(
info!(did = %did, handle = %handle, "Created DID for passkey-only account");
- let verification_code = format!(
- "{:06}",
- rand::Rng::gen_range(&mut rand::thread_rng(), 0..1_000_000u32)
- );
- let verification_code_expires_at = Utc::now() + Duration::minutes(30);
-
let setup_token = generate_setup_token();
let setup_token_hash = match hash(&setup_token, DEFAULT_COST) {
Ok(h) => h,
@@ -591,17 +588,18 @@ pub async fn create_passkey_account(
}
};
let rev = Tid::now(LimitedU32::MIN);
- let (commit_bytes, _sig) = match create_signed_commit(&did, mst_root, &rev.to_string(), None, &secret_key) {
- Ok(result) => result,
- Err(e) => {
- error!("Error creating genesis commit: {:?}", e);
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
- };
+ let (commit_bytes, _sig) =
+ match create_signed_commit(&did, mst_root, rev.as_ref(), None, &secret_key) {
+ Ok(result) => result,
+ Err(e) => {
+ error!("Error creating genesis commit: {:?}", e);
+ return (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({"error": "InternalError"})),
+ )
+ .into_response();
+ }
+ };
let commit_cid: cid::Cid = match state.block_store.put(&commit_bytes).await {
Ok(c) => c,
Err(e) => {
@@ -647,25 +645,6 @@ pub async fn create_passkey_account(
.await;
}
- if let Err(e) = sqlx::query!(
- "INSERT INTO channel_verifications (user_id, channel, code, pending_identifier, expires_at) VALUES ($1, $2::comms_channel, $3, $4, $5)",
- user_id,
- verification_channel as _,
- verification_code,
- verification_recipient,
- verification_code_expires_at
- )
- .execute(&mut *tx)
- .await
- {
- error!("Error inserting channel verification: {:?}", e);
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
-
if let Err(e) = tx.commit().await {
error!("Error committing transaction: {:?}", e);
return (
@@ -703,12 +682,19 @@ pub async fn create_passkey_account(
}
}
+ let verification_token = crate::auth::verification_token::generate_signup_token(
+ &did,
+ verification_channel,
+ &verification_recipient,
+ );
+ let formatted_token =
+ crate::auth::verification_token::format_token_for_display(&verification_token);
if let Err(e) = crate::comms::enqueue_signup_verification(
&state.db,
user_id,
verification_channel,
&verification_recipient,
- &verification_code,
+ &formatted_token,
None,
)
.await
@@ -847,21 +833,20 @@ pub async fn complete_passkey_setup(
}
};
- let credential: webauthn_rs::prelude::RegisterPublicKeyCredential = match serde_json::from_value(
- input.passkey_credential,
- ) {
- Ok(c) => c,
- Err(e) => {
- warn!("Failed to parse credential: {:?}", e);
- return (
+ let credential: webauthn_rs::prelude::RegisterPublicKeyCredential =
+ match serde_json::from_value(input.passkey_credential) {
+ Ok(c) => c,
+ Err(e) => {
+ warn!("Failed to parse credential: {:?}", e);
+ return (
StatusCode::BAD_REQUEST,
Json(
json!({"error": "InvalidCredential", "message": "Failed to parse credential"}),
),
)
.into_response();
- }
- };
+ }
+ };
let security_key = match webauthn.finish_registration(&credential, ®_state) {
Ok(sk) => sk,
diff --git a/src/api/server/password.rs b/src/api/server/password.rs
index 642e2de..2e0d0ae 100644
--- a/src/api/server/password.rs
+++ b/src/api/server/password.rs
@@ -471,7 +471,13 @@ pub async fn remove_password(State(state): State, auth: BearerAuth) ->
.await;
}
- if crate::api::server::reauth::check_reauth_required_cached(&state.db, &state.cache, &auth.0.did).await {
+ if crate::api::server::reauth::check_reauth_required_cached(
+ &state.db,
+ &state.cache,
+ &auth.0.did,
+ )
+ .await
+ {
return crate::api::server::reauth::reauth_required_response(&state.db, &auth.0.did).await;
}
diff --git a/src/api/server/reauth.rs b/src/api/server/reauth.rs
index 76e2ea7..cba46c1 100644
--- a/src/api/server/reauth.rs
+++ b/src/api/server/reauth.rs
@@ -376,7 +376,8 @@ pub async fn reauth_passkey_finish(
{
Ok(false) => {
warn!(did = %auth.0.did, "Passkey counter anomaly detected - possible cloned key");
- let _ = crate::auth::webauthn::delete_authentication_state(&state.db, &auth.0.did).await;
+ let _ =
+ crate::auth::webauthn::delete_authentication_state(&state.db, &auth.0.did).await;
return (
StatusCode::UNAUTHORIZED,
Json(json!({
@@ -494,14 +495,14 @@ pub async fn check_reauth_required_cached(
did: &str,
) -> bool {
let cache_key = format!("reauth:{}", did);
- if let Some(timestamp_str) = cache.get(&cache_key).await {
- if let Ok(timestamp) = timestamp_str.parse::() {
- let reauth_time = chrono::DateTime::from_timestamp(timestamp, 0);
- if let Some(t) = reauth_time {
- let elapsed = Utc::now().signed_duration_since(t);
- if elapsed.num_seconds() <= REAUTH_WINDOW_SECONDS {
- return false;
- }
+ if let Some(timestamp_str) = cache.get(&cache_key).await
+ && let Ok(timestamp) = timestamp_str.parse::()
+ {
+ let reauth_time = chrono::DateTime::from_timestamp(timestamp, 0);
+ if let Some(t) = reauth_time {
+ let elapsed = Utc::now().signed_duration_since(t);
+ if elapsed.num_seconds() <= REAUTH_WINDOW_SECONDS {
+ return false;
}
}
}
diff --git a/src/api/server/service_auth.rs b/src/api/server/service_auth.rs
index f0906cc..191c28d 100644
--- a/src/api/server/service_auth.rs
+++ b/src/api/server/service_auth.rs
@@ -66,7 +66,9 @@ pub async fn get_service_auth(
}
};
- let (token, is_dpop) = if auth_header.len() >= 7 && auth_header[..7].eq_ignore_ascii_case("bearer ") {
+ let (token, is_dpop) = if auth_header.len() >= 7
+ && auth_header[..7].eq_ignore_ascii_case("bearer ")
+ {
(auth_header[7..].trim().to_string(), false)
} else if auth_header.len() >= 5 && auth_header[..5].eq_ignore_ascii_case("dpop ") {
(auth_header[5..].trim().to_string(), true)
@@ -81,10 +83,14 @@ pub async fn get_service_auth(
&token,
dpop_proof,
"GET",
- &format!("/xrpc/com.atproto.server.getServiceAuth?aud={}&lxm={}",
- params.aud,
- params.lxm.as_deref().unwrap_or("")),
- ).await {
+ &format!(
+ "/xrpc/com.atproto.server.getServiceAuth?aud={}&lxm={}",
+ params.aud,
+ params.lxm.as_deref().unwrap_or("")
+ ),
+ )
+ .await
+ {
Ok(result) => crate::auth::AuthenticatedUser {
did: result.did,
is_oauth: true,
@@ -100,7 +106,8 @@ pub async fn get_service_auth(
"error": "use_dpop_nonce",
"message": "DPoP nonce required"
})),
- ).into_response();
+ )
+ .into_response();
}
Err(e) => {
warn!(error = ?e, "getServiceAuth DPoP auth validation failed");
@@ -110,7 +117,8 @@ pub async fn get_service_auth(
"error": "AuthenticationFailed",
"message": format!("{:?}", e)
})),
- ).into_response();
+ )
+ .into_response();
}
}
} else {
@@ -136,7 +144,7 @@ pub async fn get_service_auth(
"SELECT k.key_bytes, k.encryption_version
FROM users u
JOIN user_keys k ON u.id = k.user_id
- WHERE u.did = $1"
+ WHERE u.did = $1",
)
.bind(&auth_user.did)
.fetch_optional(&state.db)
@@ -155,17 +163,13 @@ pub async fn get_service_auth(
}
}
Ok(None) => {
- return ApiError::AuthenticationFailedMsg(
- "User has no signing key".into(),
- )
- .into_response();
+ return ApiError::AuthenticationFailedMsg("User has no signing key".into())
+ .into_response();
}
Err(e) => {
error!(error = ?e, "DB error fetching user key");
- return ApiError::AuthenticationFailedMsg(
- "Failed to get signing key".into(),
- )
- .into_response();
+ return ApiError::AuthenticationFailedMsg("Failed to get signing key".into())
+ .into_response();
}
}
}
diff --git a/src/api/server/session.rs b/src/api/server/session.rs
index 652b7a8..638feeb 100644
--- a/src/api/server/session.rs
+++ b/src/api/server/session.rs
@@ -8,7 +8,6 @@ use axum::{
response::{IntoResponse, Response},
};
use bcrypt::verify;
-use chrono::Utc;
use serde::{Deserialize, Serialize};
use serde_json::json;
use tracing::{error, info, warn};
@@ -167,10 +166,7 @@ pub async fn create_session(
let has_totp = row.totp_enabled.unwrap_or(false);
let is_legacy_login = has_totp;
if has_totp && !row.allow_legacy_login {
- warn!(
- "Legacy login blocked for TOTP-enabled account: {}",
- row.did
- );
+ warn!("Legacy login blocked for TOTP-enabled account: {}", row.did);
return (
StatusCode::FORBIDDEN,
Json(json!({
@@ -556,6 +552,7 @@ pub async fn confirm_signup(
r#"SELECT
u.id, u.did, u.handle, u.email,
u.preferred_comms_channel as "channel: crate::comms::CommsChannel",
+ u.discord_id, u.telegram_username, u.signal_number,
k.key_bytes, k.encryption_version
FROM users u
JOIN user_keys k ON u.id = k.user_id
@@ -577,38 +574,46 @@ pub async fn confirm_signup(
}
};
- let channel_str = match row.channel {
- crate::comms::CommsChannel::Email => "email",
- crate::comms::CommsChannel::Discord => "discord",
- crate::comms::CommsChannel::Telegram => "telegram",
- crate::comms::CommsChannel::Signal => "signal",
- };
- let verification = match sqlx::query!(
- "SELECT code, expires_at FROM channel_verifications WHERE user_id = $1 AND channel = $2::comms_channel",
- row.id,
- channel_str as _
- )
- .fetch_optional(&state.db)
- .await
- {
- Ok(Some(v)) => v,
- Ok(None) => {
- warn!("No verification code found for user: {}", input.did);
- return ApiError::InvalidRequest("No pending verification".into()).into_response();
+ let (channel_str, identifier) = match row.channel {
+ crate::comms::CommsChannel::Email => ("email", row.email.clone().unwrap_or_default()),
+ crate::comms::CommsChannel::Discord => {
+ ("discord", row.discord_id.clone().unwrap_or_default())
}
- Err(e) => {
- error!("Database error fetching verification: {:?}", e);
- return ApiError::InternalError.into_response();
+ crate::comms::CommsChannel::Telegram => (
+ "telegram",
+ row.telegram_username.clone().unwrap_or_default(),
+ ),
+ crate::comms::CommsChannel::Signal => {
+ ("signal", row.signal_number.clone().unwrap_or_default())
}
};
- if verification.code != input.verification_code {
- warn!("Invalid verification code for user: {}", input.did);
- return ApiError::InvalidRequest("Invalid verification code".into()).into_response();
- }
- if verification.expires_at < Utc::now() {
- warn!("Verification code expired for user: {}", input.did);
- return ApiError::ExpiredTokenMsg("Verification code has expired".into()).into_response();
+ let normalized_token =
+ crate::auth::verification_token::normalize_token_input(&input.verification_code);
+ match crate::auth::verification_token::verify_signup_token(
+ &normalized_token,
+ channel_str,
+ &identifier,
+ ) {
+ Ok(token_data) => {
+ if token_data.did != input.did {
+ warn!(
+ "Token DID mismatch for confirm_signup: expected {}, got {}",
+ input.did, token_data.did
+ );
+ return ApiError::InvalidRequest("Invalid verification code".into())
+ .into_response();
+ }
+ }
+ Err(crate::auth::verification_token::VerifyError::Expired) => {
+ warn!("Verification code expired for user: {}", input.did);
+ return ApiError::ExpiredTokenMsg("Verification code has expired".into())
+ .into_response();
+ }
+ Err(e) => {
+ warn!("Invalid verification code for user {}: {:?}", input.did, e);
+ return ApiError::InvalidRequest("Invalid verification code".into()).into_response();
+ }
}
let key_bytes = match crate::config::decrypt_key(&row.key_bytes, row.encryption_version) {
@@ -634,17 +639,6 @@ pub async fn confirm_signup(
return ApiError::InternalError.into_response();
}
- if let Err(e) = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = $2::comms_channel",
- row.id,
- channel_str as _
- )
- .execute(&state.db)
- .await
- {
- error!("Failed to delete verification record: {:?}", e);
- }
-
let access_meta = match crate::auth::create_access_token_with_metadata(&row.did, &key_bytes) {
Ok(m) => m,
Err(e) => {
@@ -737,8 +731,6 @@ pub async fn resend_verification(
if is_verified {
return ApiError::InvalidRequest("Account is already verified".into()).into_response();
}
- let verification_code = format!("{:06}", rand::random::() % 1_000_000);
- let code_expires_at = Utc::now() + chrono::Duration::minutes(30);
let (channel_str, recipient) = match row.channel {
crate::comms::CommsChannel::Email => ("email", row.email.clone().unwrap_or_default()),
@@ -754,31 +746,17 @@ pub async fn resend_verification(
}
};
- if let Err(e) = sqlx::query!(
- r#"
- INSERT INTO channel_verifications (user_id, channel, code, pending_identifier, expires_at)
- VALUES ($1, $2::comms_channel, $3, $4, $5)
- ON CONFLICT (user_id, channel) DO UPDATE
- SET code = $3, pending_identifier = $4, expires_at = $5, created_at = NOW()
- "#,
- row.id,
- channel_str as _,
- verification_code,
- recipient,
- code_expires_at
- )
- .execute(&state.db)
- .await
- {
- error!("Failed to update verification code: {:?}", e);
- return ApiError::InternalError.into_response();
- }
+ let verification_token =
+ crate::auth::verification_token::generate_signup_token(&input.did, channel_str, &recipient);
+ let formatted_token =
+ crate::auth::verification_token::format_token_for_display(&verification_token);
+
if let Err(e) = crate::comms::enqueue_signup_verification(
&state.db,
row.id,
channel_str,
&recipient,
- &verification_code,
+ &formatted_token,
None,
)
.await
@@ -886,8 +864,7 @@ pub async fn list_sessions(
Ok(rows) => {
for (id, token_id, created_at, expires_at, client_id) in rows {
let client_name = extract_client_name(&client_id);
- let is_current_oauth = auth.0.is_oauth
- && current_jti.as_ref() == Some(&token_id);
+ let is_current_oauth = auth.0.is_oauth && current_jti.as_ref() == Some(&token_id);
sessions.push(SessionInfo {
id: format!("oauth:{}", id),
session_type: "oauth".to_string(),
@@ -1071,11 +1048,12 @@ pub async fn revoke_all_sessions(
.into_response();
}
} else {
- if let Err(e) = sqlx::query("DELETE FROM session_tokens WHERE did = $1 AND access_jti != $2")
- .bind(&auth.0.did)
- .bind(jti)
- .execute(&state.db)
- .await
+ if let Err(e) =
+ sqlx::query("DELETE FROM session_tokens WHERE did = $1 AND access_jti != $2")
+ .bind(&auth.0.did)
+ .bind(jti)
+ .execute(&state.db)
+ .await
{
error!("DB error revoking JWT sessions: {:?}", e);
return (
diff --git a/src/api/server/verify_email.rs b/src/api/server/verify_email.rs
new file mode 100644
index 0000000..438a279
--- /dev/null
+++ b/src/api/server/verify_email.rs
@@ -0,0 +1,101 @@
+use axum::{Json, extract::State, http::StatusCode};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use tracing::{info, warn};
+
+use crate::state::AppState;
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct VerifyMigrationEmailInput {
+ pub token: String,
+ pub email: String,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct VerifyMigrationEmailOutput {
+ pub success: bool,
+ pub did: String,
+}
+
+pub async fn verify_migration_email(
+ State(state): State,
+ Json(input): Json,
+) -> Result, (StatusCode, Json)> {
+ let token_input = super::verify_token::VerifyTokenInput {
+ token: input.token,
+ identifier: input.email,
+ };
+
+ let result = super::verify_token::verify_token_internal(&state, None, token_input).await?;
+
+ Ok(Json(VerifyMigrationEmailOutput {
+ success: result.success,
+ did: result.did.clone(),
+ }))
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ResendMigrationVerificationInput {
+ pub email: String,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ResendMigrationVerificationOutput {
+ pub sent: bool,
+}
+
+pub async fn resend_migration_verification(
+ State(state): State,
+ Json(input): Json,
+) -> Result, (StatusCode, Json)> {
+ let email = input.email.trim().to_lowercase();
+
+ let user = sqlx::query!(
+ "SELECT id, did, email, email_verified, handle FROM users WHERE LOWER(email) = $1",
+ email
+ )
+ .fetch_optional(&state.db)
+ .await
+ .map_err(|e| {
+ warn!(error = %e, "Database error during resend verification");
+ (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "Database error" })),
+ )
+ })?;
+
+ let user = match user {
+ Some(u) => u,
+ None => {
+ return Ok(Json(ResendMigrationVerificationOutput { sent: true }));
+ }
+ };
+
+ if user.email_verified {
+ return Ok(Json(ResendMigrationVerificationOutput { sent: true }));
+ }
+
+ let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
+ let token = crate::auth::verification_token::generate_migration_token(&user.did, &email);
+ let formatted_token = crate::auth::verification_token::format_token_for_display(&token);
+
+ if let Err(e) = crate::comms::enqueue_migration_verification(
+ &state.db,
+ user.id,
+ &email,
+ &formatted_token,
+ &hostname,
+ )
+ .await
+ {
+ warn!(error = %e, "Failed to enqueue migration verification email");
+ }
+
+ info!(did = %user.did, "Resent migration verification email");
+
+ Ok(Json(ResendMigrationVerificationOutput { sent: true }))
+}
diff --git a/src/api/server/verify_token.rs b/src/api/server/verify_token.rs
new file mode 100644
index 0000000..60509c4
--- /dev/null
+++ b/src/api/server/verify_token.rs
@@ -0,0 +1,391 @@
+use axum::{
+ Json,
+ extract::State,
+ http::{HeaderMap, StatusCode},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use tracing::{error, info, warn};
+
+use crate::auth::verification_token::{
+ VerificationPurpose, VerifyError, normalize_token_input, verify_token_signature,
+};
+use crate::state::AppState;
+
+#[derive(Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct VerifyTokenInput {
+ pub token: String,
+ pub identifier: String,
+}
+
+#[derive(Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct VerifyTokenOutput {
+ pub success: bool,
+ pub did: String,
+ pub purpose: String,
+ pub channel: String,
+}
+
+pub async fn verify_token(
+ State(state): State,
+ headers: HeaderMap,
+ Json(input): Json,
+) -> Result, (StatusCode, Json)> {
+ verify_token_internal(&state, Some(&headers), input).await
+}
+
+pub async fn verify_token_internal(
+ state: &AppState,
+ headers: Option<&HeaderMap>,
+ input: VerifyTokenInput,
+) -> Result, (StatusCode, Json)> {
+ let normalized_token = normalize_token_input(&input.token);
+ let identifier = input.identifier.trim().to_lowercase();
+
+ let token_data = match verify_token_signature(&normalized_token) {
+ Ok(data) => data,
+ Err(e) => {
+ let (status, error, message) = match e {
+ VerifyError::InvalidFormat => (
+ StatusCode::BAD_REQUEST,
+ "InvalidToken",
+ "The verification token is invalid or malformed",
+ ),
+ VerifyError::UnsupportedVersion => (
+ StatusCode::BAD_REQUEST,
+ "InvalidToken",
+ "This verification token version is not supported",
+ ),
+ VerifyError::Expired => (
+ StatusCode::BAD_REQUEST,
+ "ExpiredToken",
+ "The verification token has expired. Please request a new one.",
+ ),
+ VerifyError::InvalidSignature => (
+ StatusCode::BAD_REQUEST,
+ "InvalidToken",
+ "The verification token signature is invalid",
+ ),
+ _ => (
+ StatusCode::BAD_REQUEST,
+ "InvalidToken",
+ "The verification token is not valid",
+ ),
+ };
+ warn!(error = ?e, "Token verification failed");
+ return Err((status, Json(json!({ "error": error, "message": message }))));
+ }
+ };
+
+ let expected_hash = crate::auth::verification_token::hash_identifier(&identifier);
+ if token_data.identifier_hash != expected_hash {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(
+ json!({ "error": "IdentifierMismatch", "message": "The identifier does not match the verification token" }),
+ ),
+ ));
+ }
+
+ match token_data.purpose {
+ VerificationPurpose::Migration => {
+ handle_migration_verification(state, &token_data.did, &token_data.channel, &identifier)
+ .await
+ }
+ VerificationPurpose::ChannelUpdate => {
+ let auth_did = extract_and_validate_auth(state, headers).await?;
+ if auth_did != token_data.did {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(
+ json!({ "error": "InvalidToken", "message": "Token does not match authenticated account" }),
+ ),
+ ));
+ }
+ handle_channel_update(state, &token_data.did, &token_data.channel, &identifier).await
+ }
+ VerificationPurpose::Signup => {
+ handle_signup_verification(state, &token_data.did, &token_data.channel, &identifier)
+ .await
+ }
+ }
+}
+
+async fn extract_and_validate_auth(
+ state: &AppState,
+ headers: Option<&HeaderMap>,
+) -> Result)> {
+ let headers = headers.ok_or_else(|| {
+ (
+ StatusCode::UNAUTHORIZED,
+ Json(json!({ "error": "AuthenticationRequired", "message": "Authentication required for this verification" })),
+ )
+ })?;
+
+ let token = crate::auth::extract_bearer_token_from_header(
+ headers.get("Authorization").and_then(|h| h.to_str().ok()),
+ )
+ .ok_or_else(|| {
+ (
+ StatusCode::UNAUTHORIZED,
+ Json(json!({ "error": "AuthenticationRequired", "message": "Authentication required for this verification" })),
+ )
+ })?;
+
+ let user = crate::auth::validate_bearer_token(&state.db, &token)
+ .await
+ .map_err(|_| {
+ (
+ StatusCode::UNAUTHORIZED,
+ Json(json!({ "error": "AuthenticationFailed", "message": "Invalid authentication token" })),
+ )
+ })?;
+
+ Ok(user.did)
+}
+
+async fn handle_migration_verification(
+ state: &AppState,
+ did: &str,
+ channel: &str,
+ identifier: &str,
+) -> Result, (StatusCode, Json)> {
+ if channel != "email" {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(
+ json!({ "error": "InvalidChannel", "message": "Migration verification is only supported for email" }),
+ ),
+ ));
+ }
+
+ let user = sqlx::query!(
+ "SELECT id, email, email_verified FROM users WHERE did = $1",
+ did
+ )
+ .fetch_optional(&state.db)
+ .await
+ .map_err(|e| {
+ warn!(error = %e, "Database error during migration verification");
+ (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "Database error" })),
+ )
+ })?;
+
+ let user = user.ok_or_else(|| {
+ (
+ StatusCode::NOT_FOUND,
+ Json(json!({ "error": "AccountNotFound", "message": "No account found for this verification token" })),
+ )
+ })?;
+
+ if user.email.as_ref().map(|e| e.to_lowercase()) != Some(identifier.to_string()) {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(
+ json!({ "error": "IdentifierMismatch", "message": "The email address does not match the account" }),
+ ),
+ ));
+ }
+
+ if !user.email_verified {
+ sqlx::query!(
+ "UPDATE users SET email_verified = true WHERE id = $1",
+ user.id
+ )
+ .execute(&state.db)
+ .await
+ .map_err(|e| {
+ warn!(error = %e, "Failed to update email_verified status");
+ (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "Failed to verify email" })),
+ )
+ })?;
+ }
+
+ info!(did = %did, "Migration email verified successfully");
+
+ Ok(Json(VerifyTokenOutput {
+ success: true,
+ did: did.to_string(),
+ purpose: "migration".to_string(),
+ channel: channel.to_string(),
+ }))
+}
+
+async fn handle_channel_update(
+ state: &AppState,
+ did: &str,
+ channel: &str,
+ identifier: &str,
+) -> Result, (StatusCode, Json)> {
+ let user_id = sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did)
+ .fetch_one(&state.db)
+ .await
+ .map_err(|_| {
+ (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "User not found" })),
+ )
+ })?;
+
+ let update_result = match channel {
+ "email" => sqlx::query!(
+ "UPDATE users SET email = $1, email_verified = TRUE, updated_at = NOW() WHERE id = $2",
+ identifier,
+ user_id
+ ).execute(&state.db).await,
+ "discord" => sqlx::query!(
+ "UPDATE users SET discord_id = $1, discord_verified = TRUE, updated_at = NOW() WHERE id = $2",
+ identifier,
+ user_id
+ ).execute(&state.db).await,
+ "telegram" => sqlx::query!(
+ "UPDATE users SET telegram_username = $1, telegram_verified = TRUE, updated_at = NOW() WHERE id = $2",
+ identifier,
+ user_id
+ ).execute(&state.db).await,
+ "signal" => sqlx::query!(
+ "UPDATE users SET signal_number = $1, signal_verified = TRUE, updated_at = NOW() WHERE id = $2",
+ identifier,
+ user_id
+ ).execute(&state.db).await,
+ _ => {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(json!({ "error": "InvalidChannel", "message": "Invalid channel" })),
+ ));
+ }
+ };
+
+ if let Err(e) = update_result {
+ error!("Failed to update user channel: {:?}", e);
+ if channel == "email"
+ && e.as_database_error()
+ .map(|db| db.is_unique_violation())
+ .unwrap_or(false)
+ {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(json!({ "error": "EmailTaken", "message": "Email already in use" })),
+ ));
+ }
+ return Err((
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "Failed to update channel" })),
+ ));
+ }
+
+ info!(did = %did, channel = %channel, "Channel verified successfully");
+
+ Ok(Json(VerifyTokenOutput {
+ success: true,
+ did: did.to_string(),
+ purpose: "channel_update".to_string(),
+ channel: channel.to_string(),
+ }))
+}
+
+async fn handle_signup_verification(
+ state: &AppState,
+ did: &str,
+ channel: &str,
+ _identifier: &str,
+) -> Result, (StatusCode, Json)> {
+ let user = sqlx::query!(
+ "SELECT id, handle, email, email_verified, discord_verified, telegram_verified, signal_verified FROM users WHERE did = $1",
+ did
+ )
+ .fetch_optional(&state.db)
+ .await
+ .map_err(|e| {
+ warn!(error = %e, "Database error during signup verification");
+ (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "Database error" })),
+ )
+ })?;
+
+ let user = user.ok_or_else(|| {
+ (
+ StatusCode::NOT_FOUND,
+ Json(json!({ "error": "AccountNotFound", "message": "No account found for this verification token" })),
+ )
+ })?;
+
+ let is_verified = user.email_verified
+ || user.discord_verified
+ || user.telegram_verified
+ || user.signal_verified;
+ if is_verified {
+ info!(did = %did, "Account already verified");
+ return Ok(Json(VerifyTokenOutput {
+ success: true,
+ did: did.to_string(),
+ purpose: "signup".to_string(),
+ channel: channel.to_string(),
+ }));
+ }
+
+ let update_result = match channel {
+ "email" => {
+ sqlx::query!(
+ "UPDATE users SET email_verified = TRUE WHERE id = $1",
+ user.id
+ )
+ .execute(&state.db)
+ .await
+ }
+ "discord" => {
+ sqlx::query!(
+ "UPDATE users SET discord_verified = TRUE WHERE id = $1",
+ user.id
+ )
+ .execute(&state.db)
+ .await
+ }
+ "telegram" => {
+ sqlx::query!(
+ "UPDATE users SET telegram_verified = TRUE WHERE id = $1",
+ user.id
+ )
+ .execute(&state.db)
+ .await
+ }
+ "signal" => {
+ sqlx::query!(
+ "UPDATE users SET signal_verified = TRUE WHERE id = $1",
+ user.id
+ )
+ .execute(&state.db)
+ .await
+ }
+ _ => {
+ return Err((
+ StatusCode::BAD_REQUEST,
+ Json(json!({ "error": "InvalidChannel", "message": "Invalid channel" })),
+ ));
+ }
+ };
+
+ update_result.map_err(|e| {
+ warn!(error = %e, "Failed to update channel verified status");
+ (
+ StatusCode::INTERNAL_SERVER_ERROR,
+ Json(json!({ "error": "InternalError", "message": "Failed to verify channel" })),
+ )
+ })?;
+
+ info!(did = %did, channel = %channel, "Signup verified successfully");
+
+ Ok(Json(VerifyTokenOutput {
+ success: true,
+ did: did.to_string(),
+ purpose: "signup".to_string(),
+ channel: channel.to_string(),
+ }))
+}
diff --git a/src/api/validation.rs b/src/api/validation.rs
index 0731dbe..00b2347 100644
--- a/src/api/validation.rs
+++ b/src/api/validation.rs
@@ -64,16 +64,16 @@ pub fn validate_short_handle(handle: &str) -> Result,
) -> Response {
- let token = match crate::auth::extract_bearer_token_from_header(
- headers.get("Authorization").and_then(|h| h.to_str().ok()),
- ) {
- Some(t) => t,
- None => return (
- StatusCode::UNAUTHORIZED,
- Json(json!({"error": "AuthenticationRequired", "message": "Authentication required"})),
- )
- .into_response(),
- };
- let user = match validate_bearer_token(&state.db, &token).await {
- Ok(u) => u,
- Err(_) => {
- return (
- StatusCode::UNAUTHORIZED,
- Json(json!({"error": "AuthenticationFailed", "message": "Invalid token"})),
- )
- .into_response();
- }
+ let token_input = crate::api::server::VerifyTokenInput {
+ token: input.code,
+ identifier: input.identifier,
};
- let user_id = match sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", user.did)
- .fetch_one(&state.db)
- .await
- {
- Ok(id) => id,
- Err(_) => {
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError", "message": "User not found"})),
- )
- .into_response();
- }
- };
-
- let channel_str = input.channel.as_str();
- if !["email", "discord", "telegram", "signal"].contains(&channel_str) {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidRequest", "message": "Invalid channel"})),
- )
- .into_response();
+ match crate::api::server::verify_token_internal(&state, Some(&headers), token_input).await {
+ Ok(output) => Json(json!({"success": output.success})).into_response(),
+ Err((status, err_json)) => (status, err_json).into_response(),
}
-
- let record = match sqlx::query!(
- r#"
- SELECT code, pending_identifier, expires_at FROM channel_verifications
- WHERE user_id = $1 AND channel = $2::comms_channel
- "#,
- user_id,
- channel_str as _
- )
- .fetch_optional(&state.db)
- .await {
- Ok(Some(r)) => r,
- Ok(None) => return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidRequest", "message": "No pending verification found. Update notification preferences first."})),
- )
- .into_response(),
- Err(e) => return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError", "message": format!("Database error: {}", e)})),
- )
- .into_response(),
- };
-
- let pending_identifier =
- match record.pending_identifier {
- Some(p) => p,
- None => return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidRequest", "message": "No pending identifier found"})),
- )
- .into_response(),
- };
-
- if record.expires_at < Utc::now() {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "ExpiredToken", "message": "Verification code expired"})),
- )
- .into_response();
- }
-
- if record.code != input.code {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "InvalidCode", "message": "Invalid verification code"})),
- )
- .into_response();
- }
-
- let mut tx = match state.db.begin().await {
- Ok(tx) => tx,
- Err(_) => {
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
- };
-
- let update_result = match channel_str {
- "email" => sqlx::query!(
- "UPDATE users SET email = $1, updated_at = NOW() WHERE id = $2",
- pending_identifier,
- user_id
- ).execute(&mut *tx).await,
- "discord" => sqlx::query!(
- "UPDATE users SET discord_id = $1, discord_verified = TRUE, updated_at = NOW() WHERE id = $2",
- pending_identifier,
- user_id
- ).execute(&mut *tx).await,
- "telegram" => sqlx::query!(
- "UPDATE users SET telegram_username = $1, telegram_verified = TRUE, updated_at = NOW() WHERE id = $2",
- pending_identifier,
- user_id
- ).execute(&mut *tx).await,
- "signal" => sqlx::query!(
- "UPDATE users SET signal_number = $1, signal_verified = TRUE, updated_at = NOW() WHERE id = $2",
- pending_identifier,
- user_id
- ).execute(&mut *tx).await,
- _ => unreachable!(),
- };
-
- if let Err(e) = update_result {
- error!("Failed to update user channel: {:?}", e);
- if channel_str == "email"
- && e.as_database_error()
- .map(|db| db.is_unique_violation())
- .unwrap_or(false)
- {
- return (
- StatusCode::BAD_REQUEST,
- Json(json!({"error": "EmailTaken", "message": "Email already in use"})),
- )
- .into_response();
- }
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError", "message": "Failed to update channel"})),
- )
- .into_response();
- }
-
- if let Err(e) = sqlx::query!(
- "DELETE FROM channel_verifications WHERE user_id = $1 AND channel = $2::comms_channel",
- user_id,
- channel_str as _
- )
- .execute(&mut *tx)
- .await
- {
- error!("Failed to delete verification record: {:?}", e);
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
-
- if tx.commit().await.is_err() {
- return (
- StatusCode::INTERNAL_SERVER_ERROR,
- Json(json!({"error": "InternalError"})),
- )
- .into_response();
- }
-
- info!(did = %user.did, channel = %channel_str, "Channel verified successfully");
-
- Json(json!({"success": true})).into_response()
}
diff --git a/src/auth/mod.rs b/src/auth/mod.rs
index d86dcff..cff08dc 100644
--- a/src/auth/mod.rs
+++ b/src/auth/mod.rs
@@ -12,6 +12,7 @@ pub mod scope_check;
pub mod service;
pub mod token;
pub mod totp;
+pub mod verification_token;
pub mod verify;
pub mod webauthn;
diff --git a/src/auth/verification_token.rs b/src/auth/verification_token.rs
new file mode 100644
index 0000000..033801c
--- /dev/null
+++ b/src/auth/verification_token.rs
@@ -0,0 +1,423 @@
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use hmac::Mac;
+use sha2::{Digest, Sha256};
+
+type HmacSha256 = hmac::Hmac;
+
+const TOKEN_VERSION: u8 = 1;
+const DEFAULT_SIGNUP_EXPIRY_MINUTES: u64 = 30;
+const DEFAULT_MIGRATION_EXPIRY_HOURS: u64 = 48;
+const DEFAULT_CHANNEL_UPDATE_EXPIRY_MINUTES: u64 = 10;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum VerificationPurpose {
+ Signup,
+ Migration,
+ ChannelUpdate,
+}
+
+impl VerificationPurpose {
+ fn as_str(&self) -> &'static str {
+ match self {
+ Self::Signup => "signup",
+ Self::Migration => "migration",
+ Self::ChannelUpdate => "channel_update",
+ }
+ }
+
+ fn from_str(s: &str) -> Option {
+ match s {
+ "signup" => Some(Self::Signup),
+ "migration" => Some(Self::Migration),
+ "channel_update" => Some(Self::ChannelUpdate),
+ _ => None,
+ }
+ }
+
+ fn default_expiry_seconds(&self) -> u64 {
+ match self {
+ Self::Signup => DEFAULT_SIGNUP_EXPIRY_MINUTES * 60,
+ Self::Migration => DEFAULT_MIGRATION_EXPIRY_HOURS * 3600,
+ Self::ChannelUpdate => DEFAULT_CHANNEL_UPDATE_EXPIRY_MINUTES * 60,
+ }
+ }
+}
+
+#[derive(Debug)]
+pub struct VerificationToken {
+ pub did: String,
+ pub purpose: VerificationPurpose,
+ pub channel: String,
+ pub identifier_hash: String,
+ pub expires_at: u64,
+}
+
+fn derive_verification_key() -> [u8; 32] {
+ use hkdf::Hkdf;
+ let master_key = std::env::var("MASTER_KEY").unwrap_or_else(|_| {
+ if cfg!(test) || std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_ok() {
+ "test-master-key-not-for-production".to_string()
+ } else {
+ panic!("MASTER_KEY must be set");
+ }
+ });
+ let hk = Hkdf::::new(None, master_key.as_bytes());
+ let mut key = [0u8; 32];
+ hk.expand(b"tranquil-pds-verification-token-v1", &mut key)
+ .expect("HKDF expansion failed");
+ key
+}
+
+pub fn hash_identifier(identifier: &str) -> String {
+ let mut hasher = Sha256::new();
+ hasher.update(identifier.to_lowercase().as_bytes());
+ let result = hasher.finalize();
+ URL_SAFE_NO_PAD.encode(&result[..16])
+}
+
+pub fn generate_signup_token(did: &str, channel: &str, identifier: &str) -> String {
+ generate_token(did, VerificationPurpose::Signup, channel, identifier)
+}
+
+pub fn generate_migration_token(did: &str, email: &str) -> String {
+ generate_token(did, VerificationPurpose::Migration, "email", email)
+}
+
+pub fn generate_channel_update_token(did: &str, channel: &str, identifier: &str) -> String {
+ generate_token(did, VerificationPurpose::ChannelUpdate, channel, identifier)
+}
+
+pub fn generate_token(
+ did: &str,
+ purpose: VerificationPurpose,
+ channel: &str,
+ identifier: &str,
+) -> String {
+ generate_token_with_expiry(
+ did,
+ purpose,
+ channel,
+ identifier,
+ purpose.default_expiry_seconds(),
+ )
+}
+
+pub fn generate_token_with_expiry(
+ did: &str,
+ purpose: VerificationPurpose,
+ channel: &str,
+ identifier: &str,
+ expiry_seconds: u64,
+) -> String {
+ let key = derive_verification_key();
+ let identifier_hash = hash_identifier(identifier);
+ let expires_at = std::time::SystemTime::now()
+ .duration_since(std::time::UNIX_EPOCH)
+ .unwrap_or_default()
+ .as_secs()
+ + expiry_seconds;
+
+ let payload = format!(
+ "{}|{}|{}|{}|{}",
+ did,
+ purpose.as_str(),
+ channel,
+ identifier_hash,
+ expires_at
+ );
+
+ let mut mac = ::new_from_slice(&key).expect("HMAC key size is valid");
+ mac.update(payload.as_bytes());
+ let signature = URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes());
+
+ let token_data = format!(
+ "{}|{}|{}|{}|{}|{}|{}",
+ TOKEN_VERSION,
+ did,
+ purpose.as_str(),
+ channel,
+ identifier_hash,
+ expires_at,
+ signature
+ );
+ URL_SAFE_NO_PAD.encode(token_data.as_bytes())
+}
+
+#[derive(Debug)]
+pub enum VerifyError {
+ InvalidFormat,
+ UnsupportedVersion,
+ Expired,
+ InvalidSignature,
+ IdentifierMismatch,
+ PurposeMismatch,
+ ChannelMismatch,
+}
+
+impl std::fmt::Display for VerifyError {
+ fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+ match self {
+ Self::InvalidFormat => write!(f, "Invalid token format"),
+ Self::UnsupportedVersion => write!(f, "Unsupported token version"),
+ Self::Expired => write!(f, "Token has expired"),
+ Self::InvalidSignature => write!(f, "Invalid token signature"),
+ Self::IdentifierMismatch => write!(f, "Identifier does not match token"),
+ Self::PurposeMismatch => write!(f, "Token purpose does not match"),
+ Self::ChannelMismatch => write!(f, "Token channel does not match"),
+ }
+ }
+}
+
+pub fn verify_signup_token(
+ token: &str,
+ expected_channel: &str,
+ expected_identifier: &str,
+) -> Result {
+ let parsed = verify_token_signature(token)?;
+ if parsed.purpose != VerificationPurpose::Signup {
+ return Err(VerifyError::PurposeMismatch);
+ }
+ if parsed.channel != expected_channel {
+ return Err(VerifyError::ChannelMismatch);
+ }
+ let expected_hash = hash_identifier(expected_identifier);
+ if parsed.identifier_hash != expected_hash {
+ return Err(VerifyError::IdentifierMismatch);
+ }
+ Ok(parsed)
+}
+
+pub fn verify_migration_token(
+ token: &str,
+ expected_email: &str,
+) -> Result {
+ let parsed = verify_token_signature(token)?;
+ if parsed.purpose != VerificationPurpose::Migration {
+ return Err(VerifyError::PurposeMismatch);
+ }
+ if parsed.channel != "email" {
+ return Err(VerifyError::ChannelMismatch);
+ }
+ let expected_hash = hash_identifier(expected_email);
+ if parsed.identifier_hash != expected_hash {
+ return Err(VerifyError::IdentifierMismatch);
+ }
+ Ok(parsed)
+}
+
+pub fn verify_channel_update_token(
+ token: &str,
+ expected_channel: &str,
+ expected_identifier: &str,
+) -> Result {
+ let parsed = verify_token_signature(token)?;
+ if parsed.purpose != VerificationPurpose::ChannelUpdate {
+ return Err(VerifyError::PurposeMismatch);
+ }
+ if parsed.channel != expected_channel {
+ return Err(VerifyError::ChannelMismatch);
+ }
+ let expected_hash = hash_identifier(expected_identifier);
+ if parsed.identifier_hash != expected_hash {
+ return Err(VerifyError::IdentifierMismatch);
+ }
+ Ok(parsed)
+}
+
+pub fn verify_token_for_did(
+ token: &str,
+ expected_did: &str,
+) -> Result {
+ let parsed = verify_token_signature(token)?;
+ if parsed.did != expected_did {
+ return Err(VerifyError::IdentifierMismatch);
+ }
+ Ok(parsed)
+}
+
+pub fn verify_token_signature(token: &str) -> Result {
+ let token_bytes = URL_SAFE_NO_PAD
+ .decode(token.trim())
+ .map_err(|_| VerifyError::InvalidFormat)?;
+ let token_str = String::from_utf8(token_bytes).map_err(|_| VerifyError::InvalidFormat)?;
+
+ let parts: Vec<&str> = token_str.split('|').collect();
+ if parts.len() != 7 {
+ return Err(VerifyError::InvalidFormat);
+ }
+
+ let version: u8 = parts[0].parse().map_err(|_| VerifyError::InvalidFormat)?;
+ if version != TOKEN_VERSION {
+ return Err(VerifyError::UnsupportedVersion);
+ }
+
+ let did = parts[1];
+ let purpose_str = parts[2];
+ let channel = parts[3];
+ let identifier_hash = parts[4];
+ let expires_at: u64 = parts[5].parse().map_err(|_| VerifyError::InvalidFormat)?;
+ let provided_signature = parts[6];
+
+ let purpose = VerificationPurpose::from_str(purpose_str).ok_or(VerifyError::InvalidFormat)?;
+
+ let now = std::time::SystemTime::now()
+ .duration_since(std::time::UNIX_EPOCH)
+ .unwrap_or_default()
+ .as_secs();
+ if now > expires_at {
+ return Err(VerifyError::Expired);
+ }
+
+ let key = derive_verification_key();
+ let payload = format!(
+ "{}|{}|{}|{}|{}",
+ did, purpose_str, channel, identifier_hash, expires_at
+ );
+ let mut mac = ::new_from_slice(&key).expect("HMAC key size is valid");
+ mac.update(payload.as_bytes());
+ let expected_signature = URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes());
+
+ use subtle::ConstantTimeEq;
+ let sig_matches: bool = provided_signature
+ .as_bytes()
+ .ct_eq(expected_signature.as_bytes())
+ .into();
+ if !sig_matches {
+ return Err(VerifyError::InvalidSignature);
+ }
+
+ Ok(VerificationToken {
+ did: did.to_string(),
+ purpose,
+ channel: channel.to_string(),
+ identifier_hash: identifier_hash.to_string(),
+ expires_at,
+ })
+}
+
+pub fn format_token_for_display(token: &str) -> String {
+ let clean = token.replace(['-', ' '], "");
+ let mut result = String::new();
+ for (i, c) in clean.chars().enumerate() {
+ if i > 0 && i % 4 == 0 {
+ result.push('-');
+ }
+ result.push(c);
+ }
+ result
+}
+
+pub fn normalize_token_input(input: &str) -> String {
+ input
+ .chars()
+ .filter(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '=')
+ .collect()
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_signup_token() {
+ let did = "did:plc:test123";
+ let channel = "email";
+ let identifier = "test@example.com";
+ let token = generate_signup_token(did, channel, identifier);
+ let result = verify_signup_token(&token, channel, identifier);
+ assert!(result.is_ok(), "Expected Ok, got {:?}", result);
+ let parsed = result.unwrap();
+ assert_eq!(parsed.did, did);
+ assert_eq!(parsed.purpose, VerificationPurpose::Signup);
+ assert_eq!(parsed.channel, channel);
+ }
+
+ #[test]
+ fn test_migration_token() {
+ let did = "did:plc:test123";
+ let email = "test@example.com";
+ let token = generate_migration_token(did, email);
+ let result = verify_migration_token(&token, email);
+ assert!(result.is_ok(), "Expected Ok, got {:?}", result);
+ let parsed = result.unwrap();
+ assert_eq!(parsed.did, did);
+ assert_eq!(parsed.purpose, VerificationPurpose::Migration);
+ }
+
+ #[test]
+ fn test_token_case_insensitive() {
+ let did = "did:plc:test123";
+ let token = generate_signup_token(did, "email", "Test@Example.COM");
+ let result = verify_signup_token(&token, "email", "test@example.com");
+ assert!(result.is_ok());
+ }
+
+ #[test]
+ fn test_token_wrong_identifier() {
+ let did = "did:plc:test123";
+ let token = generate_signup_token(did, "email", "test@example.com");
+ let result = verify_signup_token(&token, "email", "other@example.com");
+ assert!(matches!(result, Err(VerifyError::IdentifierMismatch)));
+ }
+
+ #[test]
+ fn test_token_wrong_channel() {
+ let did = "did:plc:test123";
+ let token = generate_signup_token(did, "email", "test@example.com");
+ let result = verify_signup_token(&token, "discord", "test@example.com");
+ assert!(matches!(result, Err(VerifyError::ChannelMismatch)));
+ }
+
+ #[test]
+ fn test_expired_token() {
+ let did = "did:plc:test123";
+ let token = generate_token_with_expiry(
+ did,
+ VerificationPurpose::Signup,
+ "email",
+ "test@example.com",
+ 0,
+ );
+ std::thread::sleep(std::time::Duration::from_millis(1100));
+ let result = verify_signup_token(&token, "email", "test@example.com");
+ assert!(matches!(result, Err(VerifyError::Expired)));
+ }
+
+ #[test]
+ fn test_invalid_token() {
+ let result = verify_signup_token("invalid-token", "email", "test@example.com");
+ assert!(matches!(result, Err(VerifyError::InvalidFormat)));
+ }
+
+ #[test]
+ fn test_purpose_mismatch() {
+ let did = "did:plc:test123";
+ let email = "test@example.com";
+ let signup_token = generate_signup_token(did, "email", email);
+ let result = verify_migration_token(&signup_token, email);
+ assert!(matches!(result, Err(VerifyError::PurposeMismatch)));
+ }
+
+ #[test]
+ fn test_discord_channel() {
+ let did = "did:plc:test123";
+ let discord_id = "123456789012345678";
+ let token = generate_signup_token(did, "discord", discord_id);
+ let result = verify_signup_token(&token, "discord", discord_id);
+ assert!(result.is_ok());
+ }
+
+ #[test]
+ fn test_format_token_for_display() {
+ let token = "ABCDEFGHIJKLMNOP";
+ let formatted = format_token_for_display(token);
+ assert_eq!(formatted, "ABCD-EFGH-IJKL-MNOP");
+ }
+
+ #[test]
+ fn test_normalize_token_input() {
+ let input = "ABCD-EFGH IJKL-MNOP";
+ let normalized = normalize_token_input(input);
+ assert_eq!(normalized, "ABCDEFGHIJKLMNOP");
+ }
+}
diff --git a/src/comms/locale.rs b/src/comms/locale.rs
index 7e80bd3..895d7e5 100644
--- a/src/comms/locale.rs
+++ b/src/comms/locale.rs
@@ -12,8 +12,6 @@ pub fn validate_locale(locale: &str) -> &str {
pub struct NotificationStrings {
pub welcome_subject: &'static str,
pub welcome_body: &'static str,
- pub email_verification_subject: &'static str,
- pub email_verification_body: &'static str,
pub password_reset_subject: &'static str,
pub password_reset_body: &'static str,
pub email_update_subject: &'static str,
@@ -30,6 +28,8 @@ pub struct NotificationStrings {
pub signup_verification_body: &'static str,
pub legacy_login_subject: &'static str,
pub legacy_login_body: &'static str,
+ pub migration_verification_subject: &'static str,
+ pub migration_verification_body: &'static str,
}
pub fn get_strings(locale: &str) -> &'static NotificationStrings {
@@ -46,12 +46,10 @@ pub fn get_strings(locale: &str) -> &'static NotificationStrings {
static STRINGS_EN: NotificationStrings = NotificationStrings {
welcome_subject: "Welcome to {hostname}",
welcome_body: "Welcome to {hostname}!\n\nYour handle is: @{handle}\n\nThank you for joining us.",
- email_verification_subject: "Verify your email - {hostname}",
- email_verification_body: "Hello @{handle},\n\nYour email verification code is: {code}\n\nThis code will expire in 10 minutes.\n\nIf you did not request this, please ignore this email.",
password_reset_subject: "Password Reset - {hostname}",
password_reset_body: "Hello @{handle},\n\nYour password reset code is: {code}\n\nThis code will expire in 10 minutes.\n\nIf you did not request this, please ignore this message.",
email_update_subject: "Confirm your new email - {hostname}",
- email_update_body: "Hello @{handle},\n\nYour email update confirmation code is: {code}\n\nThis code will expire in 10 minutes.\n\nIf you did not request this, please ignore this email.",
+ email_update_body: "Hello @{handle},\n\nYour verification code is:\n{code}\n\nCopy the code above and enter it at:\n{verify_page}\n\nThis code will expire in 10 minutes.\n\nIf you did not request this, please ignore this email.\n\n(Or if you like to live dangerously: {verify_link})",
account_deletion_subject: "Account Deletion Request - {hostname}",
account_deletion_body: "Hello @{handle},\n\nYour account deletion confirmation code is: {code}\n\nThis code will expire in 10 minutes.\n\nIf you did not request this, please secure your account immediately.",
plc_operation_subject: "{hostname} - PLC Operation Token",
@@ -61,20 +59,20 @@ static STRINGS_EN: NotificationStrings = NotificationStrings {
passkey_recovery_subject: "Account Recovery - {hostname}",
passkey_recovery_body: "Hello @{handle},\n\nYou requested to recover your passkey-only account.\n\nClick the link below to set a temporary password and regain access:\n{url}\n\nThis link will expire in 1 hour.\n\nIf you did not request this, please ignore this message. Your account remains secure.",
signup_verification_subject: "Verify your account - {hostname}",
- signup_verification_body: "Welcome! Your account verification code is: {code}\n\nThis code will expire in 30 minutes.\n\nEnter this code to complete your registration on {hostname}.",
+ signup_verification_body: "Welcome! Your verification code is:\n{code}\n\nCopy the code above and enter it at:\n{verify_page}\n\nThis code will expire in 30 minutes.\n\nIf you did not create an account on {hostname}, please ignore this message.\n\n(Or if you like to live dangerously: {verify_link})",
legacy_login_subject: "Security Alert: Legacy Login Detected - {hostname}",
legacy_login_body: "Hello @{handle},\n\nA login to your account was detected using a legacy app (like Bluesky) that doesn't support TOTP verification.\n\nDetails:\n- Time: {timestamp}\n- IP Address: {ip}\n\nYour TOTP protection was bypassed for this login. The session has limited permissions for sensitive operations.\n\nIf this wasn't you, please:\n1. Change your password immediately\n2. Review your active sessions\n3. Consider disabling legacy app logins in your security settings\n\nStay safe,\n{hostname}",
+ migration_verification_subject: "Verify your email - {hostname}",
+ migration_verification_body: "Welcome to {hostname}!\n\nYour account has been migrated successfully. To complete the setup, please verify your email address.\n\nYour verification code is:\n{code}\n\nCopy the code above and enter it at:\n{verify_page}\n\nThis code will expire in 48 hours.\n\nIf you did not migrate your account, please ignore this email.\n\n(Or if you like to live dangerously: {verify_link})",
};
static STRINGS_ZH: NotificationStrings = NotificationStrings {
welcome_subject: "欢迎加入 {hostname}",
welcome_body: "欢迎加入 {hostname}！\n\n您的用户名是：@{handle}\n\n感谢您的加入。",
- email_verification_subject: "验证您的邮箱 - {hostname}",
- email_verification_body: "您好 @{handle}，\n\n您的邮箱验证码是：{code}\n\n此验证码将在10分钟后过期。\n\n如果这不是您的操作，请忽略此邮件。",
password_reset_subject: "密码重置 - {hostname}",
password_reset_body: "您好 @{handle}，\n\n您的密码重置验证码是：{code}\n\n此验证码将在10分钟后过期。\n\n如果这不是您的操作，请忽略此消息。",
email_update_subject: "确认您的新邮箱 - {hostname}",
- email_update_body: "您好 @{handle}，\n\n您的邮箱更新确认码是：{code}\n\n此验证码将在10分钟后过期。\n\n如果这不是您的操作，请忽略此邮件。",
+ email_update_body: "您好 @{handle}，\n\n您的验证码是：\n{code}\n\n复制上述验证码并在此输入：\n{verify_page}\n\n此验证码将在10分钟后过期。\n\n如果这不是您的操作，请忽略此邮件。\n\n（或者直接点击链接：{verify_link}）",
account_deletion_subject: "账户删除请求 - {hostname}",
account_deletion_body: "您好 @{handle}，\n\n您的账户删除确认码是：{code}\n\n此验证码将在10分钟后过期。\n\n如果这不是您的操作，请立即保护您的账户。",
plc_operation_subject: "{hostname} - PLC 操作令牌",
@@ -84,20 +82,20 @@ static STRINGS_ZH: NotificationStrings = NotificationStrings {
passkey_recovery_subject: "账户恢复 - {hostname}",
passkey_recovery_body: "您好 @{handle}，\n\n您请求恢复仅通行密钥账户的访问权限。\n\n点击以下链接设置临时密码并恢复访问：\n{url}\n\n此链接将在1小时后过期。\n\n如果这不是您的操作，请忽略此消息。您的账户仍然安全。",
signup_verification_subject: "验证您的账户 - {hostname}",
- signup_verification_body: "欢迎！您的账户验证码是：{code}\n\n此验证码将在30分钟后过期。\n\n请输入此验证码完成在 {hostname} 上的注册。",
+ signup_verification_body: "欢迎！您的验证码是：\n{code}\n\n复制上述验证码并在此输入：\n{verify_page}\n\n此验证码将在30分钟后过期。\n\n如果您没有在 {hostname} 上创建账户，请忽略此消息。\n\n（或者直接点击链接：{verify_link}）",
legacy_login_subject: "安全提醒：检测到传统应用登录 - {hostname}",
legacy_login_body: "您好 @{handle}，\n\n检测到使用不支持 TOTP 验证的传统应用（如 Bluesky）登录您的账户。\n\n详细信息：\n- 时间：{timestamp}\n- IP 地址：{ip}\n\n此次登录绕过了 TOTP 保护。该会话对敏感操作的权限有限。\n\n如果这不是您的操作，请：\n1. 立即更改密码\n2. 检查您的活跃会话\n3. 考虑在安全设置中禁用传统应用登录\n\n请注意安全，\n{hostname}",
+ migration_verification_subject: "验证您的邮箱 - {hostname}",
+ migration_verification_body: "欢迎来到 {hostname}！\n\n您的账户已成功迁移。要完成设置，请验证您的邮箱地址。\n\n您的验证码是：\n{code}\n\n复制上述验证码并在此输入：\n{verify_page}\n\n此验证码将在 48 小时后过期。\n\n如果您没有迁移账户，请忽略此邮件。\n\n（或者直接点击链接：{verify_link}）",
};
static STRINGS_JA: NotificationStrings = NotificationStrings {
welcome_subject: "{hostname} へようこそ",
welcome_body: "{hostname} へようこそ！\n\nお客様のハンドル：@{handle}\n\nご登録ありがとうございます。",
- email_verification_subject: "メール認証 - {hostname}",
- email_verification_body: "@{handle} 様\n\nメール認証コードは：{code}\n\nこのコードは10分後に期限切れとなります。\n\nこの操作に心当たりがない場合は、このメールを無視してください。",
password_reset_subject: "パスワードリセット - {hostname}",
password_reset_body: "@{handle} 様\n\nパスワードリセットコードは：{code}\n\nこのコードは10分後に期限切れとなります。\n\nこの操作に心当たりがない場合は、このメッセージを無視してください。",
email_update_subject: "新しいメールアドレスの確認 - {hostname}",
- email_update_body: "@{handle} 様\n\nメールアドレス更新の確認コードは：{code}\n\nこのコードは10分後に期限切れとなります。\n\nこの操作に心当たりがない場合は、このメールを無視してください。",
+ email_update_body: "@{handle} 様\n\n確認コードは：\n{code}\n\n上記のコードをコピーして、こちらで入力してください：\n{verify_page}\n\nこのコードは10分後に期限切れとなります。\n\nこの操作に心当たりがない場合は、このメールを無視してください。\n\n（自己責任でワンクリック認証：{verify_link}）",
account_deletion_subject: "アカウント削除リクエスト - {hostname}",
account_deletion_body: "@{handle} 様\n\nアカウント削除の確認コードは：{code}\n\nこのコードは10分後に期限切れとなります。\n\nこの操作に心当たりがない場合は、直ちにアカウントを保護してください。",
plc_operation_subject: "{hostname} - PLC 操作トークン",
@@ -107,20 +105,20 @@ static STRINGS_JA: NotificationStrings = NotificationStrings {
passkey_recovery_subject: "アカウント復旧 - {hostname}",
passkey_recovery_body: "@{handle} 様\n\nパスキー専用アカウントの復旧をリクエストされました。\n\n以下のリンクをクリックして一時パスワードを設定し、アクセスを回復してください：\n{url}\n\nこのリンクは1時間後に期限切れとなります。\n\nこの操作に心当たりがない場合は、このメッセージを無視してください。アカウントは安全なままです。",
signup_verification_subject: "アカウント認証 - {hostname}",
- signup_verification_body: "ようこそ！アカウント認証コードは：{code}\n\nこのコードは30分後に期限切れとなります。\n\n{hostname} への登録を完了するには、このコードを入力してください。",
+ signup_verification_body: "ようこそ！認証コードは：\n{code}\n\n上記のコードをコピーして、こちらで入力してください：\n{verify_page}\n\nこのコードは30分後に期限切れとなります。\n\n{hostname} でアカウントを作成していない場合は、このメールを無視してください。\n\n（自己責任でワンクリック認証：{verify_link}）",
legacy_login_subject: "セキュリティ警告：レガシーログインを検出 - {hostname}",
legacy_login_body: "@{handle} 様\n\nTOTP 認証に対応していないレガシーアプリ（Bluesky など）からのログインが検出されました。\n\n詳細：\n- 時刻：{timestamp}\n- IP アドレス：{ip}\n\nこのログインでは TOTP 保護がバイパスされました。このセッションは機密操作に対する権限が制限されています。\n\n心当たりがない場合は：\n1. 直ちにパスワードを変更してください\n2. アクティブなセッションを確認してください\n3. セキュリティ設定でレガシーアプリのログインを無効にすることを検討してください\n\nご注意ください。\n{hostname}",
+ migration_verification_subject: "メールアドレスの認証 - {hostname}",
+ migration_verification_body: "{hostname} へようこそ！\n\nアカウントの移行が完了しました。設定を完了するには、メールアドレスを認証してください。\n\n認証コードは：\n{code}\n\n上記のコードをコピーして、こちらで入力してください：\n{verify_page}\n\nこのコードは48時間後に期限切れとなります。\n\nアカウントを移行していない場合は、このメールを無視してください。\n\n（自己責任でワンクリック認証：{verify_link}）",
};
static STRINGS_KO: NotificationStrings = NotificationStrings {
welcome_subject: "{hostname}에 오신 것을 환영합니다",
welcome_body: "{hostname}에 오신 것을 환영합니다!\n\n회원님의 핸들은: @{handle}\n\n가입해 주셔서 감사합니다.",
- email_verification_subject: "이메일 인증 - {hostname}",
- email_verification_body: "안녕하세요 @{handle}님,\n\n이메일 인증 코드는: {code}\n\n이 코드는 10분 후에 만료됩니다.\n\n요청하지 않으셨다면 이 이메일을 무시하세요.",
password_reset_subject: "비밀번호 재설정 - {hostname}",
password_reset_body: "안녕하세요 @{handle}님,\n\n비밀번호 재설정 코드는: {code}\n\n이 코드는 10분 후에 만료됩니다.\n\n요청하지 않으셨다면 이 메시지를 무시하세요.",
- email_update_subject: "새 이메일 확인 - {hostname}",
- email_update_body: "안녕하세요 @{handle}님,\n\n이메일 업데이트 확인 코드는: {code}\n\n이 코드는 10분 후에 만료됩니다.\n\n요청하지 않으셨다면 이 이메일을 무시하세요.",
+ email_update_subject: "새 이메일 주소 확인 - {hostname}",
+ email_update_body: "안녕하세요 @{handle}님,\n\n인증 코드는:\n{code}\n\n위 코드를 복사하여 여기에 입력하세요:\n{verify_page}\n\n이 코드는 10분 후에 만료됩니다.\n\n요청하지 않으셨다면 이 이메일을 무시하세요.\n\n(위험을 감수하고 원클릭 인증: {verify_link})",
account_deletion_subject: "계정 삭제 요청 - {hostname}",
account_deletion_body: "안녕하세요 @{handle}님,\n\n계정 삭제 확인 코드는: {code}\n\n이 코드는 10분 후에 만료됩니다.\n\n요청하지 않으셨다면 즉시 계정을 보호하세요.",
plc_operation_subject: "{hostname} - PLC 작업 토큰",
@@ -130,20 +128,20 @@ static STRINGS_KO: NotificationStrings = NotificationStrings {
passkey_recovery_subject: "계정 복구 - {hostname}",
passkey_recovery_body: "안녕하세요 @{handle}님,\n\n패스키 전용 계정 복구를 요청하셨습니다.\n\n아래 링크를 클릭하여 임시 비밀번호를 설정하고 액세스를 복구하세요:\n{url}\n\n이 링크는 1시간 후에 만료됩니다.\n\n요청하지 않으셨다면 이 메시지를 무시하세요. 계정은 안전하게 유지됩니다.",
signup_verification_subject: "계정 인증 - {hostname}",
- signup_verification_body: "환영합니다! 계정 인증 코드는: {code}\n\n이 코드는 30분 후에 만료됩니다.\n\n{hostname}에서 등록을 완료하려면 이 코드를 입력하세요.",
+ signup_verification_body: "환영합니다! 인증 코드는:\n{code}\n\n위 코드를 복사하여 여기에 입력하세요:\n{verify_page}\n\n이 코드는 30분 후에 만료됩니다.\n\n{hostname}에서 계정을 만들지 않았다면 이 이메일을 무시하세요.\n\n(위험을 감수하고 원클릭 인증: {verify_link})",
legacy_login_subject: "보안 알림: 레거시 로그인 감지 - {hostname}",
legacy_login_body: "안녕하세요 @{handle}님,\n\nTOTP 인증을 지원하지 않는 레거시 앱(예: Bluesky)을 사용한 로그인이 감지되었습니다.\n\n세부 정보:\n- 시간: {timestamp}\n- IP 주소: {ip}\n\n이 로그인에서 TOTP 보호가 우회되었습니다. 이 세션은 민감한 작업에 대한 권한이 제한됩니다.\n\n본인이 아닌 경우:\n1. 즉시 비밀번호를 변경하세요\n2. 활성 세션을 검토하세요\n3. 보안 설정에서 레거시 앱 로그인 비활성화를 고려하세요\n\n{hostname} 드림",
+ migration_verification_subject: "이메일 인증 - {hostname}",
+ migration_verification_body: "{hostname}에 오신 것을 환영합니다!\n\n계정 마이그레이션이 완료되었습니다. 설정을 완료하려면 이메일 주소를 인증하세요.\n\n인증 코드는:\n{code}\n\n위 코드를 복사하여 여기에 입력하세요:\n{verify_page}\n\n이 코드는 48시간 후에 만료됩니다.\n\n계정을 마이그레이션하지 않았다면 이 이메일을 무시하세요.\n\n(위험을 감수하고 원클릭 인증: {verify_link})",
};
static STRINGS_SV: NotificationStrings = NotificationStrings {
welcome_subject: "Välkommen till {hostname}",
welcome_body: "Välkommen till {hostname}!\n\nDitt användarnamn är: @{handle}\n\nTack för att du gick med.",
- email_verification_subject: "Verifiera din e-post - {hostname}",
- email_verification_body: "Hej @{handle},\n\nDin e-postverifieringskod är: {code}\n\nDenna kod upphör om 10 minuter.\n\nOm du inte begärde detta kan du ignorera detta meddelande.",
password_reset_subject: "Lösenordsåterställning - {hostname}",
password_reset_body: "Hej @{handle},\n\nDin kod för lösenordsåterställning är: {code}\n\nDenna kod upphör om 10 minuter.\n\nOm du inte begärde detta kan du ignorera detta meddelande.",
email_update_subject: "Bekräfta din nya e-post - {hostname}",
- email_update_body: "Hej @{handle},\n\nDin bekräftelsekod för e-postuppdatering är: {code}\n\nDenna kod upphör om 10 minuter.\n\nOm du inte begärde detta kan du ignorera detta meddelande.",
+ email_update_body: "Hej @{handle},\n\nDin verifieringskod är:\n{code}\n\nKopiera koden ovan och ange den på:\n{verify_page}\n\nDenna kod upphör om 10 minuter.\n\nOm du inte begärde detta kan du ignorera detta meddelande.\n\n(Eller om du gillar att leva farligt: {verify_link})",
account_deletion_subject: "Begäran om kontoradering - {hostname}",
account_deletion_body: "Hej @{handle},\n\nDin bekräftelsekod för kontoradering är: {code}\n\nDenna kod upphör om 10 minuter.\n\nOm du inte begärde detta, skydda ditt konto omedelbart.",
plc_operation_subject: "{hostname} - PLC-operationstoken",
@@ -153,20 +151,20 @@ static STRINGS_SV: NotificationStrings = NotificationStrings {
passkey_recovery_subject: "Kontoåterställning - {hostname}",
passkey_recovery_body: "Hej @{handle},\n\nDu begärde att återställa ditt endast nyckelkonto.\n\nKlicka på länken nedan för att ställa in ett tillfälligt lösenord och återfå åtkomst:\n{url}\n\nDenna länk upphör om 1 timme.\n\nOm du inte begärde detta kan du ignorera detta meddelande. Ditt konto förblir säkert.",
signup_verification_subject: "Verifiera ditt konto - {hostname}",
- signup_verification_body: "Välkommen! Din kontoverifieringskod är: {code}\n\nDenna kod upphör om 30 minuter.\n\nAnge denna kod för att slutföra din registrering på {hostname}.",
+ signup_verification_body: "Välkommen! Din verifieringskod är:\n{code}\n\nKopiera koden ovan och ange den på:\n{verify_page}\n\nDenna kod upphör om 30 minuter.\n\nOm du inte skapade ett konto på {hostname}, ignorera detta meddelande.\n\n(Eller om du gillar att leva farligt: {verify_link})",
legacy_login_subject: "Säkerhetsvarning: Äldre inloggning upptäckt - {hostname}",
legacy_login_body: "Hej @{handle},\n\nEn inloggning till ditt konto upptäcktes med en äldre app (som Bluesky) som inte stöder TOTP-verifiering.\n\nDetaljer:\n- Tid: {timestamp}\n- IP-adress: {ip}\n\nDitt TOTP-skydd kringgicks för denna inloggning. Sessionen har begränsade behörigheter för känsliga operationer.\n\nOm detta inte var du:\n1. Ändra ditt lösenord omedelbart\n2. Granska dina aktiva sessioner\n3. Överväg att inaktivera äldre appinloggningar i dina säkerhetsinställningar\n\nVar försiktig,\n{hostname}",
+ migration_verification_subject: "Verifiera din e-post - {hostname}",
+ migration_verification_body: "Välkommen till {hostname}!\n\nDitt konto har migrerats framgångsrikt. För att slutföra installationen, verifiera din e-postadress.\n\nDin verifieringskod är:\n{code}\n\nKopiera koden ovan och ange den på:\n{verify_page}\n\nDenna kod upphör om 48 timmar.\n\nOm du inte migrerade ditt konto kan du ignorera detta meddelande.\n\n(Eller om du gillar att leva farligt: {verify_link})",
};
static STRINGS_FI: NotificationStrings = NotificationStrings {
welcome_subject: "Tervetuloa palveluun {hostname}",
welcome_body: "Tervetuloa palveluun {hostname}!\n\nKäyttäjänimesi on: @{handle}\n\nKiitos liittymisestä.",
- email_verification_subject: "Vahvista sähköpostisi - {hostname}",
- email_verification_body: "Hei @{handle},\n\nSähköpostin vahvistuskoodisi on: {code}\n\nTämä koodi vanhenee 10 minuutissa.\n\nJos et pyytänyt tätä, voit jättää tämän viestin huomiotta.",
password_reset_subject: "Salasanan palautus - {hostname}",
password_reset_body: "Hei @{handle},\n\nSalasanan palautuskoodisi on: {code}\n\nTämä koodi vanhenee 10 minuutissa.\n\nJos et pyytänyt tätä, voit jättää tämän viestin huomiotta.",
- email_update_subject: "Vahvista uusi sähköpostiosoitteesi - {hostname}",
- email_update_body: "Hei @{handle},\n\nSähköpostin päivityksen vahvistuskoodisi on: {code}\n\nTämä koodi vanhenee 10 minuutissa.\n\nJos et pyytänyt tätä, voit jättää tämän viestin huomiotta.",
+ email_update_subject: "Vahvista uusi sähköpostisi - {hostname}",
+ email_update_body: "Hei @{handle},\n\nVahvistuskoodisi on:\n{code}\n\nKopioi koodi yllä ja syötä se osoitteessa:\n{verify_page}\n\nTämä koodi vanhenee 10 minuutissa.\n\nJos et pyytänyt tätä, voit jättää tämän viestin huomiotta.\n\n(Tai jos pidät vaarallisesta elämästä: {verify_link})",
account_deletion_subject: "Tilin poistopyyntö - {hostname}",
account_deletion_body: "Hei @{handle},\n\nTilin poiston vahvistuskoodisi on: {code}\n\nTämä koodi vanhenee 10 minuutissa.\n\nJos et pyytänyt tätä, suojaa tilisi välittömästi.",
plc_operation_subject: "{hostname} - PLC-toimintotunniste",
@@ -176,9 +174,11 @@ static STRINGS_FI: NotificationStrings = NotificationStrings {
passkey_recovery_subject: "Tilin palautus - {hostname}",
passkey_recovery_body: "Hei @{handle},\n\nPyysit palauttamaan vain pääsyavaintilisi.\n\nKlikkaa alla olevaa linkkiä asettaaksesi väliaikaisen salasanan ja saadaksesi pääsyn takaisin:\n{url}\n\nTämä linkki vanhenee tunnissa.\n\nJos et pyytänyt tätä, voit jättää tämän viestin huomiotta. Tilisi pysyy turvassa.",
signup_verification_subject: "Vahvista tilisi - {hostname}",
- signup_verification_body: "Tervetuloa! Tilin vahvistuskoodisi on: {code}\n\nTämä koodi vanhenee 30 minuutissa.\n\nSyötä tämä koodi viimeistelläksesi rekisteröintisi palveluun {hostname}.",
+ signup_verification_body: "Tervetuloa! Vahvistuskoodisi on:\n{code}\n\nKopioi koodi yllä ja syötä se osoitteessa:\n{verify_page}\n\nTämä koodi vanhenee 30 minuutissa.\n\nJos et luonut tiliä palveluun {hostname}, jätä tämä viesti huomiotta.\n\n(Tai jos pidät vaarallisesta elämästä: {verify_link})",
legacy_login_subject: "Turvallisuushälytys: Vanha kirjautuminen havaittu - {hostname}",
legacy_login_body: "Hei @{handle},\n\nTilillesi havaittiin kirjautuminen vanhalla sovelluksella (kuten Bluesky), joka ei tue TOTP-vahvistusta.\n\nTiedot:\n- Aika: {timestamp}\n- IP-osoite: {ip}\n\nTOTP-suojauksesi ohitettiin tässä kirjautumisessa. Istunnolla on rajoitetut oikeudet arkaluontoisiin toimintoihin.\n\nJos tämä et ollut sinä:\n1. Vaihda salasanasi välittömästi\n2. Tarkista aktiiviset istuntosi\n3. Harkitse vanhojen sovellusten kirjautumisen poistamista käytöstä turvallisuusasetuksissa\n\nOle varovainen,\n{hostname}",
+ migration_verification_subject: "Vahvista sähköpostisi - {hostname}",
+ migration_verification_body: "Tervetuloa palveluun {hostname}!\n\nTilisi on siirretty onnistuneesti. Viimeistele asennus vahvistamalla sähköpostiosoitteesi.\n\nVahvistuskoodisi on:\n{code}\n\nKopioi koodi yllä ja syötä se osoitteessa:\n{verify_page}\n\nTämä koodi vanhenee 48 tunnissa.\n\nJos et siirtänyt tiliäsi, voit jättää tämän viestin huomiotta.\n\n(Tai jos pidät vaarallisesta elämästä: {verify_link})",
};
pub fn format_message(template: &str, vars: &[(&str, &str)]) -> String {
diff --git a/src/comms/mod.rs b/src/comms/mod.rs
index 2ebe6bb..bed85f8 100644
--- a/src/comms/mod.rs
+++ b/src/comms/mod.rs
@@ -10,7 +10,7 @@ pub use sender::{
pub use service::{
CommsService, channel_display_name, enqueue_2fa_code, enqueue_account_deletion, enqueue_comms,
- enqueue_email_update, enqueue_email_verification, enqueue_passkey_recovery,
+ enqueue_email_update, enqueue_migration_verification, enqueue_passkey_recovery,
enqueue_password_reset, enqueue_plc_operation, enqueue_signup_verification, enqueue_welcome,
queue_legacy_login_notification,
};
diff --git a/src/comms/service.rs b/src/comms/service.rs
index 271f7f9..358212f 100644
--- a/src/comms/service.rs
+++ b/src/comms/service.rs
@@ -313,34 +313,6 @@ pub async fn enqueue_welcome(
.await
}
-pub async fn enqueue_email_verification(
- db: &PgPool,
- user_id: Uuid,
- email: &str,
- handle: &str,
- code: &str,
- hostname: &str,
-) -> Result {
- let prefs = get_user_comms_prefs(db, user_id).await?;
- let strings = get_strings(&prefs.locale);
- let body = format_message(
- strings.email_verification_body,
- &[("handle", handle), ("code", code)],
- );
- let subject = format_message(strings.email_verification_subject, &[("hostname", hostname)]);
- enqueue_comms(
- db,
- NewComms::email(
- user_id,
- super::types::CommsType::EmailVerification,
- email.to_string(),
- subject,
- body,
- ),
- )
- .await
-}
-
pub async fn enqueue_password_reset(
db: &PgPool,
user_id: Uuid,
@@ -378,9 +350,21 @@ pub async fn enqueue_email_update(
) -> Result {
let prefs = get_user_comms_prefs(db, user_id).await?;
let strings = get_strings(&prefs.locale);
+ let encoded_email = urlencoding::encode(new_email);
+ let encoded_token = urlencoding::encode(code);
+ let verify_page = format!("https://{}/#/verify", hostname);
+ let verify_link = format!(
+ "https://{}/#/verify?token={}&identifier={}",
+ hostname, encoded_token, encoded_email
+ );
let body = format_message(
strings.email_update_body,
- &[("handle", handle), ("code", code)],
+ &[
+ ("handle", handle),
+ ("code", code),
+ ("verify_page", &verify_page),
+ ("verify_link", &verify_link),
+ ],
);
let subject = format_message(strings.email_update_subject, &[("hostname", hostname)]);
enqueue_comms(
@@ -530,14 +514,33 @@ pub async fn enqueue_signup_verification(
_ => CommsChannel::Email,
};
let strings = get_strings(locale.unwrap_or("en"));
+ let (verify_page, verify_link) = if comms_channel == CommsChannel::Email {
+ let encoded_email = urlencoding::encode(recipient);
+ let encoded_token = urlencoding::encode(code);
+ (
+ format!("https://{}/#/verify", hostname),
+ format!(
+ "https://{}/#/verify?token={}&identifier={}",
+ hostname, encoded_token, encoded_email
+ ),
+ )
+ } else {
+ (String::new(), String::new())
+ };
let body = format_message(
strings.signup_verification_body,
- &[("code", code), ("hostname", &hostname)],
+ &[
+ ("code", code),
+ ("hostname", &hostname),
+ ("verify_page", &verify_page),
+ ("verify_link", &verify_link),
+ ],
);
let subject = match comms_channel {
- CommsChannel::Email => {
- Some(format_message(strings.signup_verification_subject, &[("hostname", &hostname)]))
- }
+ CommsChannel::Email => Some(format_message(
+ strings.signup_verification_subject,
+ &[("hostname", &hostname)],
+ )),
_ => None,
};
enqueue_comms(
@@ -554,6 +557,48 @@ pub async fn enqueue_signup_verification(
.await
}
+pub async fn enqueue_migration_verification(
+ db: &PgPool,
+ user_id: Uuid,
+ email: &str,
+ token: &str,
+ hostname: &str,
+) -> Result {
+ let prefs = get_user_comms_prefs(db, user_id).await?;
+ let strings = get_strings(&prefs.locale);
+ let encoded_email = urlencoding::encode(email);
+ let encoded_token = urlencoding::encode(token);
+ let verify_page = format!("https://{}/#/verify", hostname);
+ let verify_link = format!(
+ "https://{}/#/verify?token={}&identifier={}",
+ hostname, encoded_token, encoded_email
+ );
+ let body = format_message(
+ strings.migration_verification_body,
+ &[
+ ("code", token),
+ ("hostname", hostname),
+ ("verify_page", &verify_page),
+ ("verify_link", &verify_link),
+ ],
+ );
+ let subject = format_message(
+ strings.migration_verification_subject,
+ &[("hostname", hostname)],
+ );
+ enqueue_comms(
+ db,
+ NewComms::email(
+ user_id,
+ super::types::CommsType::MigrationVerification,
+ email.to_string(),
+ subject,
+ body,
+ ),
+ )
+ .await
+}
+
pub async fn queue_legacy_login_notification(
db: &PgPool,
user_id: Uuid,
@@ -563,7 +608,9 @@ pub async fn queue_legacy_login_notification(
) -> Result {
let prefs = get_user_comms_prefs(db, user_id).await?;
let strings = get_strings(&prefs.locale);
- let timestamp = chrono::Utc::now().format("%Y-%m-%d %H:%M:%S UTC").to_string();
+ let timestamp = chrono::Utc::now()
+ .format("%Y-%m-%d %H:%M:%S UTC")
+ .to_string();
let body = format_message(
strings.legacy_login_body,
&[
diff --git a/src/comms/types.rs b/src/comms/types.rs
index 43441b7..a21e1b0 100644
--- a/src/comms/types.rs
+++ b/src/comms/types.rs
@@ -34,6 +34,7 @@ pub enum CommsType {
TwoFactorCode,
PasskeyRecovery,
LegacyLoginAlert,
+ MigrationVerification,
}
#[derive(Debug, Clone, FromRow)]
diff --git a/src/config.rs b/src/config.rs
index 05d6aa4..578ba45 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -114,8 +114,11 @@ impl AuthConfig {
.expect("HKDF expansion failed");
let mut device_cookie_key = [0u8; 32];
- hk.expand(b"tranquil-pds-device-cookie-signing", &mut device_cookie_key)
- .expect("HKDF expansion failed");
+ hk.expand(
+ b"tranquil-pds-device-cookie-signing",
+ &mut device_cookie_key,
+ )
+ .expect("HKDF expansion failed");
AuthConfig {
jwt_secret,
diff --git a/src/lib.rs b/src/lib.rs
index 021a6f9..363162f 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -295,6 +295,14 @@ pub fn app(state: AppState) -> Router {
"/xrpc/com.atproto.server.reserveSigningKey",
post(api::server::reserve_signing_key),
)
+ .route(
+ "/xrpc/com.atproto.server.verifyMigrationEmail",
+ post(api::server::verify_migration_email),
+ )
+ .route(
+ "/xrpc/com.atproto.server.resendMigrationVerification",
+ post(api::server::resend_migration_verification),
+ )
.route(
"/xrpc/com.atproto.identity.updateHandle",
post(api::identity::update_handle),
@@ -550,6 +558,10 @@ pub fn app(state: AppState) -> Router {
"/xrpc/com.tranquil.account.confirmChannelVerification",
post(api::verification::confirm_channel_verification),
)
+ .route(
+ "/xrpc/com.tranquil.account.verifyToken",
+ post(api::server::verify_token),
+ )
.route("/xrpc/{*method}", any(api::proxy::proxy_handler))
.layer(middleware::from_fn(metrics::metrics_middleware))
.layer(
diff --git a/src/oauth/endpoints/metadata.rs b/src/oauth/endpoints/metadata.rs
index 6d35ca6..942d514 100644
--- a/src/oauth/endpoints/metadata.rs
+++ b/src/oauth/endpoints/metadata.rs
@@ -172,7 +172,8 @@ pub async fn frontend_client_metadata(
"refresh_token".to_string(),
],
response_types: vec!["code".to_string()],
- scope: "atproto repo:*?action=create repo:*?action=update repo:*?action=delete blob:*/*".to_string(),
+ scope: "atproto repo:*?action=create repo:*?action=update repo:*?action=delete blob:*/*"
+ .to_string(),
token_endpoint_auth_method: "none".to_string(),
application_type: "web".to_string(),
dpop_bound_access_tokens: true,
diff --git a/src/rate_limit.rs b/src/rate_limit.rs
index 663a78e..6430055 100644
--- a/src/rate_limit.rs
+++ b/src/rate_limit.rs
@@ -74,9 +74,10 @@ impl RateLimiters {
email_update: Arc::new(RateLimiter::keyed(Quota::per_hour(
NonZeroU32::new(5).unwrap(),
))),
- totp_verify: Arc::new(RateLimiter::keyed(Quota::with_period(std::time::Duration::from_secs(60))
- .unwrap()
- .allow_burst(NonZeroU32::new(5).unwrap()),
+ totp_verify: Arc::new(RateLimiter::keyed(
+ Quota::with_period(std::time::Duration::from_secs(60))
+ .unwrap()
+ .allow_burst(NonZeroU32::new(5).unwrap()),
)),
}
}
diff --git a/src/validation/mod.rs b/src/validation/mod.rs
index 5ce440a..6141f76 100644
--- a/src/validation/mod.rs
+++ b/src/validation/mod.rs
@@ -458,19 +458,57 @@ pub fn validate_password(password: &str) -> Result<(), PasswordValidationError>
fn is_common_password(password: &str) -> bool {
const COMMON_PASSWORDS: &[&str] = &[
- "password", "Password1", "Password123", "Passw0rd", "Passw0rd!",
- "12345678", "123456789", "1234567890",
- "qwerty123", "Qwerty123", "qwertyui", "Qwertyui",
- "letmein1", "Letmein1", "welcome1", "Welcome1",
- "admin123", "Admin123", "password1", "Password1!",
- "iloveyou", "Iloveyou1", "monkey123", "Monkey123",
- "dragon12", "Dragon123", "master12", "Master123",
- "login123", "Login123", "abc12345", "Abc12345",
- "football", "Football1", "baseball", "Baseball1",
- "trustno1", "Trustno1", "sunshine", "Sunshine1",
- "princess", "Princess1", "computer", "Computer1",
- "whatever", "Whatever1", "nintendo", "Nintendo1",
- "bluesky1", "Bluesky1", "Bluesky123",
+ "password",
+ "Password1",
+ "Password123",
+ "Passw0rd",
+ "Passw0rd!",
+ "12345678",
+ "123456789",
+ "1234567890",
+ "qwerty123",
+ "Qwerty123",
+ "qwertyui",
+ "Qwertyui",
+ "letmein1",
+ "Letmein1",
+ "welcome1",
+ "Welcome1",
+ "admin123",
+ "Admin123",
+ "password1",
+ "Password1!",
+ "iloveyou",
+ "Iloveyou1",
+ "monkey123",
+ "Monkey123",
+ "dragon12",
+ "Dragon123",
+ "master12",
+ "Master123",
+ "login123",
+ "Login123",
+ "abc12345",
+ "Abc12345",
+ "football",
+ "Football1",
+ "baseball",
+ "Baseball1",
+ "trustno1",
+ "Trustno1",
+ "sunshine",
+ "Sunshine1",
+ "princess",
+ "Princess1",
+ "computer",
+ "Computer1",
+ "whatever",
+ "Whatever1",
+ "nintendo",
+ "Nintendo1",
+ "bluesky1",
+ "Bluesky1",
+ "Bluesky123",
];
let lower = password.to_lowercase();
diff --git a/tests/account_notifications.rs b/tests/account_notifications.rs
index 87ba309..a8cb906 100644
--- a/tests/account_notifications.rs
+++ b/tests/account_notifications.rs
@@ -92,16 +92,24 @@ async fn test_verify_channel_discord() {
.await
.expect("User not found");
- let code: String = sqlx::query_scalar!(
- "SELECT code FROM channel_verifications WHERE user_id = $1 AND channel = 'discord'",
+ let row = sqlx::query!(
+ "SELECT body, metadata FROM comms_queue WHERE user_id = $1 AND comms_type = 'channel_verification' ORDER BY created_at DESC LIMIT 1",
user_id
)
.fetch_one(&pool)
.await
.expect("Verification code not found");
+ let code = row
+ .metadata
+ .as_ref()
+ .and_then(|m| m.get("code"))
+ .and_then(|c| c.as_str())
+ .expect("No code in metadata");
+
let input = json!({
"channel": "discord",
+ "identifier": "123456789",
"code": code
});
let resp = client
@@ -153,7 +161,8 @@ async fn test_verify_channel_invalid_code() {
let input = json!({
"channel": "telegram",
- "code": "000000"
+ "identifier": "testuser",
+ "code": "XXXX-XXXX-XXXX-XXXX"
});
let resp = client
.post(format!(
@@ -165,7 +174,11 @@ async fn test_verify_channel_invalid_code() {
.send()
.await
.unwrap();
- assert_eq!(resp.status(), 400);
+ assert!(
+ resp.status() == 400 || resp.status() == 422,
+ "Expected 400 or 422, got {}",
+ resp.status()
+ );
}
#[tokio::test]
@@ -176,7 +189,8 @@ async fn test_verify_channel_not_set() {
let input = json!({
"channel": "signal",
- "code": "123456"
+ "identifier": "123456",
+ "code": "XXXX-XXXX-XXXX-XXXX"
});
let resp = client
.post(format!(
@@ -188,7 +202,11 @@ async fn test_verify_channel_not_set() {
.send()
.await
.unwrap();
- assert_eq!(resp.status(), 400);
+ assert!(
+ resp.status() == 400 || resp.status() == 422,
+ "Expected 400 or 422, got {}",
+ resp.status()
+ );
}
#[tokio::test]
@@ -226,16 +244,34 @@ async fn test_update_email_via_notification_prefs() {
.await
.expect("User not found");
- let code: String = sqlx::query_scalar!(
- "SELECT code FROM channel_verifications WHERE user_id = $1 AND channel = 'email'",
+ let body_text: String = sqlx::query_scalar!(
+ "SELECT body FROM comms_queue WHERE user_id = $1 AND comms_type = 'email_update' ORDER BY created_at DESC LIMIT 1",
user_id
)
.fetch_one(&pool)
.await
.expect("Verification code not found");
+ let code = body_text
+ .lines()
+ .skip_while(|line| !line.contains("verification code"))
+ .nth(1)
+ .map(|line| line.trim().to_string())
+ .filter(|line| !line.is_empty() && line.contains('-'))
+ .unwrap_or_else(|| {
+ body_text
+ .lines()
+ .find(|line| {
+ let trimmed = line.trim();
+ trimmed.starts_with("MX") && trimmed.contains('-')
+ })
+ .map(|s| s.trim().to_string())
+ .unwrap_or_default()
+ });
+
let input = json!({
"channel": "email",
+ "identifier": unique_email,
"code": code
});
let resp = client
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index f820f93..7e4fd74 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -297,14 +297,34 @@ pub async fn verify_new_account(client: &Client, did: &str) -> String {
.connect(&conn_str)
.await
.expect("Failed to connect to test database");
- let verification_code: String = sqlx::query_scalar!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
+ let body_text: String = sqlx::query_scalar!(
+ "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1",
did
)
.fetch_one(&pool)
.await
.expect("Failed to get verification code");
+ let verification_code = body_text
+ .lines()
+ .find(|line| line.contains("verification code:") || line.contains("code is:"))
+ .and_then(|line| {
+ if line.contains("verification code:") {
+ line.split("verification code:")
+ .nth(1)
+ .map(|s| s.trim().to_string())
+ } else {
+ line.split("code is:").nth(1).map(|s| s.trim().to_string())
+ }
+ })
+ .unwrap_or_else(|| {
+ body_text
+ .lines()
+ .find(|line| line.trim().starts_with("MX") && line.contains('-'))
+ .map(|s| s.trim().to_string())
+ .unwrap_or_default()
+ });
+
let confirm_payload = json!({
"did": did,
"verificationCode": verification_code
@@ -453,13 +473,36 @@ async fn create_account_and_login_internal(client: &Client, make_admin: bool) ->
if let Some(access_jwt) = body["accessJwt"].as_str() {
return (access_jwt.to_string(), did);
}
- let verification_code: String = sqlx::query_scalar!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
+ let body_text: String = sqlx::query_scalar!(
+ "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1",
&did
)
.fetch_one(&pool)
.await
- .expect("Failed to get verification code");
+ .expect("Failed to get verification from comms_queue");
+ let verification_code = body_text
+ .lines()
+ .find(|line| line.contains("verification code:") || line.contains("code is:"))
+ .and_then(|line| {
+ if line.contains("verification code:") {
+ line.split("verification code:")
+ .nth(1)
+ .map(|s| s.trim().to_string())
+ } else if line.contains("code is:") {
+ line.split("code is:").nth(1).map(|s| s.trim().to_string())
+ } else {
+ None
+ }
+ })
+ .unwrap_or_else(|| {
+ body_text
+ .split_whitespace()
+ .find(|word| {
+ word.contains('-') && word.chars().filter(|c| *c == '-').count() >= 3
+ })
+ .unwrap_or(&body_text)
+ .to_string()
+ });
let confirm_payload = json!({
"did": did,
diff --git a/tests/did_web.rs b/tests/did_web.rs
index 194578e..79f7e32 100644
--- a/tests/did_web.rs
+++ b/tests/did_web.rs
@@ -1,6 +1,6 @@
mod common;
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use common::*;
use k256::ecdsa::{SigningKey, signature::Signer};
use reqwest::StatusCode;
@@ -387,13 +387,14 @@ async fn test_did_web_byod_flow() {
let mock_uri = mock_server.uri();
let mock_addr = mock_uri.trim_start_matches("http://");
let unique_id = uuid::Uuid::new_v4().to_string().replace("-", "");
- let did = format!("did:web:{}:byod:{}", mock_addr.replace(":", "%3A"), unique_id);
+ let did = format!(
+ "did:web:{}:byod:{}",
+ mock_addr.replace(":", "%3A"),
+ unique_id
+ );
let handle = format!("byod_{}", uuid::Uuid::new_v4());
let pds_endpoint = base_url().await.replace("http://", "https://");
- let pds_did = format!(
- "did:web:{}",
- pds_endpoint.trim_start_matches("https://")
- );
+ let pds_did = format!("did:web:{}", pds_endpoint.trim_start_matches("https://"));
let temp_key = SigningKey::random(&mut rand::thread_rng());
let public_key_multibase = signing_key_to_multibase(&temp_key);
@@ -443,16 +444,19 @@ async fn test_did_web_byod_flow() {
let body: Value = res.json().await.expect("Response was not JSON");
let returned_did = body["did"].as_str().expect("No DID in response");
assert_eq!(returned_did, did, "Returned DID should match requested DID");
- let access_jwt = body["accessJwt"]
- .as_str()
- .expect("No accessJwt in response");
+ assert_eq!(
+ body["verificationRequired"], true,
+ "BYOD accounts should require verification"
+ );
+
+ let access_jwt = common::verify_new_account(&client, returned_did).await;
let res = client
.get(format!(
"{}/xrpc/com.atproto.server.checkAccountStatus",
base_url().await
))
- .bearer_auth(access_jwt)
+ .bearer_auth(&access_jwt)
.send()
.await
.expect("Failed to check account status");
@@ -468,7 +472,7 @@ async fn test_did_web_byod_flow() {
"{}/xrpc/com.atproto.identity.getRecommendedDidCredentials",
base_url().await
))
- .bearer_auth(access_jwt)
+ .bearer_auth(&access_jwt)
.send()
.await
.expect("Failed to get recommended credentials");
@@ -491,7 +495,7 @@ async fn test_did_web_byod_flow() {
"{}/xrpc/com.atproto.server.activateAccount",
base_url().await
))
- .bearer_auth(access_jwt)
+ .bearer_auth(&access_jwt)
.send()
.await
.expect("Failed to activate account");
@@ -506,7 +510,7 @@ async fn test_did_web_byod_flow() {
"{}/xrpc/com.atproto.server.checkAccountStatus",
base_url().await
))
- .bearer_auth(access_jwt)
+ .bearer_auth(&access_jwt)
.send()
.await
.expect("Failed to check account status");
@@ -522,7 +526,7 @@ async fn test_did_web_byod_flow() {
"{}/xrpc/com.atproto.repo.createRecord",
base_url().await
))
- .bearer_auth(access_jwt)
+ .bearer_auth(&access_jwt)
.json(&json!({
"repo": did,
"collection": "app.bsky.feed.post",
diff --git a/tests/email_update.rs b/tests/email_update.rs
index 00bba9c..6ae0c0c 100644
--- a/tests/email_update.rs
+++ b/tests/email_update.rs
@@ -12,6 +12,30 @@ async fn get_pool() -> PgPool {
.expect("Failed to connect to test database")
}
+async fn get_email_update_token(pool: &PgPool, did: &str) -> String {
+ let body_text: String = sqlx::query_scalar!(
+ "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_update' ORDER BY created_at DESC LIMIT 1",
+ did
+ )
+ .fetch_one(pool)
+ .await
+ .expect("Verification not found");
+
+ body_text
+ .lines()
+ .skip_while(|line| !line.contains("verification code"))
+ .nth(1)
+ .map(|line| line.trim().to_string())
+ .filter(|line| !line.is_empty() && line.contains('-'))
+ .unwrap_or_else(|| {
+ body_text
+ .lines()
+ .find(|line| line.trim().starts_with("MX") && line.contains('-'))
+ .map(|s| s.trim().to_string())
+ .unwrap_or_default()
+ })
+}
+
async fn create_verified_account(
client: &reqwest::Client,
base_url: &str,
@@ -61,19 +85,7 @@ async fn test_email_update_flow_success() {
let body: Value = res.json().await.expect("Invalid JSON");
assert_eq!(body["tokenRequired"], true);
- let verification = sqlx::query!(
- "SELECT pending_identifier, code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
- did
- )
- .fetch_one(&pool)
- .await
- .expect("Verification not found");
-
- assert_eq!(
- verification.pending_identifier.as_deref(),
- Some(new_email.as_str())
- );
- let code = verification.code;
+ let code = get_email_update_token(&pool, &did).await;
let res = client
.post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url))
.bearer_auth(&access_jwt)
@@ -90,15 +102,6 @@ async fn test_email_update_flow_success() {
.await
.expect("User not found");
assert_eq!(user.email, Some(new_email));
-
- let verification = sqlx::query!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
- did
- )
- .fetch_optional(&pool)
- .await
- .expect("DB error");
- assert!(verification.is_none());
}
#[tokio::test]
@@ -180,14 +183,7 @@ async fn test_confirm_email_wrong_email() {
.await
.expect("Failed to request email update");
assert_eq!(res.status(), StatusCode::OK);
- let verification = sqlx::query!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
- did
- )
- .fetch_one(&pool)
- .await
- .expect("Verification not found");
- let code = verification.code;
+ let code = get_email_update_token(&pool, &did).await;
let res = client
.post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url))
.bearer_auth(&access_jwt)
@@ -200,17 +196,18 @@ async fn test_confirm_email_wrong_email() {
.expect("Failed to confirm email");
assert_eq!(res.status(), StatusCode::BAD_REQUEST);
let body: Value = res.json().await.expect("Invalid JSON");
- assert_eq!(body["message"], "Email does not match pending update");
+ assert!(
+ body["message"].as_str().unwrap().contains("mismatch") || body["error"] == "InvalidToken"
+ );
}
#[tokio::test]
-async fn test_update_email_success_no_token_required() {
+async fn test_update_email_requires_token() {
let client = common::client();
let base_url = common::base_url().await;
- let pool = get_pool().await;
let handle = format!("emailup_direct_{}", uuid::Uuid::new_v4());
let email = format!("{}@example.com", handle);
- let (access_jwt, did) = create_verified_account(&client, &base_url, &handle, &email).await;
+ let (access_jwt, _) = create_verified_account(&client, &base_url, &handle, &email).await;
let new_email = format!("direct_{}@example.com", handle);
let res = client
.post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url))
@@ -219,12 +216,9 @@ async fn test_update_email_success_no_token_required() {
.send()
.await
.expect("Failed to update email");
- assert_eq!(res.status(), StatusCode::OK);
- let user = sqlx::query!("SELECT email FROM users WHERE did = $1", did)
- .fetch_one(&pool)
- .await
- .expect("User not found");
- assert_eq!(user.email, Some(new_email));
+ assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+ let body: Value = res.json().await.expect("Invalid JSON");
+ assert_eq!(body["error"], "TokenRequired");
}
#[tokio::test]
@@ -299,14 +293,7 @@ async fn test_update_email_with_valid_token() {
.await
.expect("Failed to request email update");
assert_eq!(res.status(), StatusCode::OK);
- let verification = sqlx::query!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
- did
- )
- .fetch_one(&pool)
- .await
- .expect("Verification not found");
- let code = verification.code;
+ let code = get_email_update_token(&pool, &did).await;
let res = client
.post(format!("{}/xrpc/com.atproto.server.updateEmail", base_url))
.bearer_auth(&access_jwt)
@@ -323,14 +310,6 @@ async fn test_update_email_with_valid_token() {
.await
.expect("User not found");
assert_eq!(user.email, Some(new_email));
- let verification = sqlx::query!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
- did
- )
- .fetch_optional(&pool)
- .await
- .expect("DB error");
- assert!(verification.is_none());
}
#[tokio::test]
@@ -387,7 +366,11 @@ async fn test_update_email_already_taken() {
assert_eq!(res.status(), StatusCode::BAD_REQUEST);
let body: Value = res.json().await.expect("Invalid JSON");
assert!(
- body["message"].as_str().unwrap().contains("already in use")
+ body["error"] == "TokenRequired"
+ || body["message"]
+ .as_str()
+ .unwrap_or("")
+ .contains("already in use")
|| body["error"] == "InvalidRequest"
);
}
diff --git a/tests/jwt_security.rs b/tests/jwt_security.rs
index c8ec477..5c885e0 100644
--- a/tests/jwt_security.rs
+++ b/tests/jwt_security.rs
@@ -688,10 +688,29 @@ async fn test_refresh_token_replay_protection() {
.connect(&get_db_connection_string().await)
.await
.unwrap();
- let code: String = sqlx::query_scalar!(
- "SELECT code FROM channel_verifications WHERE user_id = (SELECT id FROM users WHERE did = $1) AND channel = 'email'",
+ let body_text: String = sqlx::query_scalar!(
+ "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1",
did
).fetch_one(&pool).await.unwrap();
+ let code = body_text
+ .lines()
+ .find(|line| line.contains("verification code:") || line.contains("code is:"))
+ .and_then(|line| {
+ if line.contains("verification code:") {
+ line.split("verification code:")
+ .nth(1)
+ .map(|s| s.trim().to_string())
+ } else {
+ line.split("code is:").nth(1).map(|s| s.trim().to_string())
+ }
+ })
+ .unwrap_or_else(|| {
+ body_text
+ .lines()
+ .find(|line| line.trim().starts_with("MX") && line.contains('-'))
+ .map(|s| s.trim().to_string())
+ .unwrap_or_default()
+ });
let confirm = http_client
.post(format!("{}/xrpc/com.atproto.server.confirmSignup", url))