Method authenticateEmailCodeLogin

backend/api/v1/auth_service.go:1813–1898

authenticateEmailCodeLogin handles the email + 6-digit code flow. Existing users: verify code → return user (downstream pipeline handles workspace-level gates). Unknown emails: verify code → gate checks on pre-invited workspace → create user + provision workspace.

(ctx context.Context, request *v1pb.LoginRequest)

// Existing users: verify code → return user (downstream pipeline handles workspace-level gates).
// Unknown emails: verify code → gate checks on pre-invited workspace → create user + provision workspace.
func (s *AuthService) authenticateEmailCodeLogin(ctx context.Context, request *v1pb.LoginRequest) (*store.UserMessage, error) {
	if request.Password != "" || request.GetIdpName() != "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("email_code is mutually exclusive with password and idp_name"))
	}
	email := strings.ToLower(strings.TrimSpace(request.Email))
	if email == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("email is required"))
	}

	codeRow, err := s.verifyEmailCode(ctx, email, storepb.EmailVerificationCodePurpose_LOGIN, *request.EmailCode)
	if err != nil {
		return nil, err
	}

	// Existing user → return. allow_email_code_signin is checked later in validateLoginPermissions
	// against the actually-resolved login workspace (which may not match the send-time workspace
	// for multi-workspace users — resolveWorkspaceForLogin prefers LastLoginWorkspace).
	user, err := s.store.GetUserByEmail(ctx, email)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to find user"))
	}
	if user != nil {
		return user, nil
	}

	// Unknown email → signup path. Validate email format to prevent reserved-namespace collisions.
	if err := validateEndUserEmail(email); err != nil {
		return nil, err
	}

	// Gate checks run BEFORE user creation to prevent orphan accounts.
	// We only consult AllowEmailCodeSignin here: DisallowSignup governs password self-service
	// signup (the Signup RPC), not email-code onboarding — the two paths are independent.
	// Admins who want to block new users via email-code set AllowEmailCodeSignin=false.
	restriction, err := getAccountRestriction(ctx, s.store, s.licenseService, s.profile.SaaS, codeRow.Workspace)
	if err != nil {
		return nil, err
	}
	if !restriction.AllowEmailCodeSignin {
		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Errorf("email code login is not enabled for this workspace"))
	}
	// Signup is always allowed for SaaS
	if !s.profile.SaaS {
		if restriction.DisallowSignup {
			return nil, connect.NewError(connect.CodePermissionDenied, errors.Errorf("sign up is disallowed for this workspace"))
		}
	}

	// Provision workspace BEFORE creating the user so retries are self-healing: if user
	// creation fails, the next attempt's FindWorkspace(email) finds the already-provisioned
	// workspace via its IAM binding and returns it. The reverse order would leave a user
	// without a workspace, and subsequent retries would early-return via GetUserByEmail and
	// never re-run provisioning — permanently stuck. Matches the Signup RPC's ordering.
	if _, err := s.provisionWorkspaceForNewUser(ctx, email); err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to provision workspace"))
	}

	// Create principal with random bcrypt password.