Method hashEmailCode

backend/api/v1/auth_service.go:1619–1623

hashEmailCode returns HMAC-SHA256(code) hex-encoded, keyed with the server's auth secret. HMAC with a server-side secret (vs. bare SHA-256) prevents offline brute force of the 10^6-size code space if the DB is ever compromised — the attacker would also need the auth secret to verify candidate codes.

(code string)

// 10^6-size code space if the DB is ever compromised — the attacker would also need the
// auth secret to verify candidate codes.
func (s *AuthService) hashEmailCode(code string) string {
	mac := hmac.New(sha256.New, []byte(s.secret))
	mac.Write([]byte(code))
	return hex.EncodeToString(mac.Sum(nil))
}

// SendEmailLoginCode sends a 6-digit verification code. Always returns success
// (no email enumeration). Rate limit: 60-sec resend cooldown enforced atomically