Method verifyEmailCode

backend/api/v1/auth_service.go:1786–1808

verifyEmailCode checks a submitted code against the stored row. Enforces expiry, attempt limit (5), and constant-time hash compare. On successful match, deletes the row (one-time use) and returns it so the caller can use its captured workspace context (e.g. for gate checks and workspace assignment o

(ctx context.Context, email string, purpose storepb.EmailVerificationCodePurpose, submittedCode string)

// caller can use its captured workspace context (e.g. for gate checks and
// workspace assignment on the email-code signup path).
func (s *AuthService) verifyEmailCode(ctx context.Context, email string, purpose storepb.EmailVerificationCodePurpose, submittedCode string) (*store.EmailVerificationCodeMessage, error) {
	row, err := s.store.GetEmailVerificationCode(ctx, email, purpose)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to get email verification code"))
	}
	if row == nil {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.Errorf("invalid or expired code"))
	}
	if time.Now().After(row.ExpiresAt) {
		_ = s.store.DeleteEmailVerificationCodeIfMatch(ctx, email, purpose, row.CodeHash)
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.Errorf("invalid or expired code"))
	}
	if row.Attempts >= emailCodeMaxAttempts {
		_ = s.store.DeleteEmailVerificationCodeIfMatch(ctx, email, purpose, row.CodeHash)
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.Errorf("too many attempts"))
	}
	if subtle.ConstantTimeCompare([]byte(s.hashEmailCode(submittedCode)), []byte(row.CodeHash)) != 1 {
		_ = s.store.IncrementEmailVerificationCodeAttempts(ctx, email, purpose)
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.Errorf("invalid or expired code"))
	}
	_ = s.store.DeleteEmailVerificationCodeIfMatch(ctx, email, purpose, row.CodeHash)
	return row, nil
}

// authenticateEmailCodeLogin handles the email + 6-digit code flow.
// Existing users: verify code → return user (downstream pipeline handles workspace-level gates).