Method verifyTokenHash

internal/api/verify.go:643–696

(conn *storage.Connection, params *VerifyParams)

}

func (a *API) verifyTokenHash(conn *storage.Connection, params *VerifyParams) (*models.User, error) {
	config := a.config

	var user *models.User
	var err error
	switch params.Type {
	case mail.EmailOTPVerification:
		// need to find user by confirmation token or recovery token with the token hash
		user, err = models.FindUserByConfirmationOrRecoveryToken(conn, params.TokenHash)
	case mail.SignupVerification, mail.InviteVerification:
		user, err = models.FindUserByConfirmationToken(conn, params.TokenHash)
	case mail.RecoveryVerification, mail.MagicLinkVerification:
		user, err = models.FindUserByRecoveryToken(conn, params.TokenHash)
	case mail.EmailChangeVerification:
		user, err = models.FindUserByEmailChangeToken(conn, params.TokenHash)
	default:
		return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Invalid email verification type")
	}

	if err != nil {
		if models.IsNotFoundError(err) {
			return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeOTPExpired, "Email link is invalid or has expired").WithInternalError(err)
		}
		return nil, apierrors.NewInternalServerError("Database error finding user from email link").WithInternalError(err)
	}

	if user.IsBanned() {
		return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeUserBanned, "User is banned")
	}

	var isExpired bool
	switch params.Type {
	case mail.EmailOTPVerification:
		sentAt := user.ConfirmationSentAt
		params.Type = "signup"
		if user.RecoveryToken == params.TokenHash {
			sentAt = user.RecoverySentAt
			params.Type = "magiclink"
		}
		isExpired = isOtpExpired(sentAt, config.Mailer.OtpExp)
	case mail.SignupVerification, mail.InviteVerification:
		isExpired = isOtpExpired(user.ConfirmationSentAt, config.Mailer.OtpExp)
	case mail.RecoveryVerification, mail.MagicLinkVerification:
		isExpired = isOtpExpired(user.RecoverySentAt, config.Mailer.OtpExp)
	case mail.EmailChangeVerification:
		isExpired = isOtpExpired(user.EmailChangeSentAt, config.Mailer.OtpExp)
	}

	if isExpired {
		return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeOTPExpired, "Email link is invalid or has expired").WithInternalMessage("email link has expired")
	}

	return user, nil
}

// verifyUserAndToken verifies the token associated to the user based on the verify type
func (a *API) verifyUserAndToken(conn *storage.Connection, params *VerifyParams, aud string) (*models.User, error) {