fix(auth): allow identical login codes for different emails

apps/web/__tests__/integration/sso-database.test.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import {
 	accounts,
 	organizationInvites,
@@ -346,6 +346,42 @@ describe.runIf(Boolean(databaseUrl))(
 			).toHaveLength(0);
 		});
 
+		it("keeps identical OTP codes independent across email addresses", async () => {
+			const first = `${id()}@example.com`;
+			const second = `${id()}@example.com`;
+			const token = createHash("sha256")
+				.update("123456test-secret")
+				.digest("hex");
+			const expires = new Date(Date.now() + 600_000);
+			const { createVerificationToken, useVerificationToken } = DrizzleAdapter(
+				database(),
+			);
+			if (!createVerificationToken || !useVerificationToken) {
+				throw new Error("Missing verification token adapter.");
+			}
+
+			await createVerificationToken({ identifier: first, token, expires });
+			await expect(
+				createVerificationToken({ identifier: second, token, expires }),
+			).resolves.toMatchObject({ identifier: second, token });
+			await expect(
+				createVerificationToken({ identifier: second, token, expires }),
+			).resolves.toMatchObject({ identifier: second, token });
+
+			await expect(
+				useVerificationToken({ identifier: first, token: "wrong-guess" }),
+			).resolves.toBeNull();
+			await expect(
+				useVerificationToken({ identifier: first, token }),
+			).resolves.toBeNull();
+			await expect(
+				useVerificationToken({ identifier: second, token }),
+			).resolves.toMatchObject({ identifier: second, token });
+			await expect(
+				useVerificationToken({ identifier: second, token }),
+			).resolves.toBeNull();
+		});
+
 		it("burns an email OTP exactly once under concurrent guesses", async () => {
 			const identifier = `${id()}@example.com`;
 			const token = "482913";

packages/database/auth/drizzle-adapter.ts

@@ -458,7 +458,7 @@ export function DrizzleAdapter(
 			const rows = await db
 				.select()
 				.from(verificationTokens)
-				.where(eq(verificationTokens.token, verificationToken.token))
+				.where(eq(verificationTokens.identifier, normalizedIdentifier))
 				.limit(1);
 			const row = rows[0];
 			if (!row) throw new Error("Error: inserted verification token not found");

packages/database/migrations/0052_chubby_rick_jones.sql

@@ -0,0 +1 @@
+ALTER TABLE `verification_tokens` DROP INDEX `verification_tokens_token_unique`;