fix: shorten email otp length

[kangmingtay]

What kind of change does this PR introduce?

• Addresses concerns in fix: send otp in email link #379
• Shorten email otp length to range between 6-10 digits
• Email link token param is now a hash(email + otp)
• Values stored in xxx_token in the db is now hash(email + otp) instead of just the otp
• Email link verification works by matching the token param with the token field in the db (since both are hashed, we can just compare the hashes)
• Email otp works by taking hash(email + otp) and comparing the value with the token field in the db (for sms otps, the hash will be hash(phone + otp))
• support old otp format (to be deprecated within a week - current otps only last for 24 hrs so users will have to regenerate new ones regardless)
• Potentially a breaking change if user has already built a UI to account for the old token format (xxxxx-xxxxx-xxxxx-xxxxx)

To-Dos

• Fix tests
• Generate link endpoint should also return the raw unhashed otp

[hf]

Hey generally looks good, but I'd suggest using crypto/sha256 instead of crypto/md. It's quite old, and not particularly secure for this use case. It's only acceptable for computing message digests and not as a one-way function.

[hf]

Actually for even more security you could use Sum224 which is also resistant to padding attacks.

[hf]

One other remark, and this is really a nit, is to use encoding/hex as it expresses intent more clearly than fmt.Sprintf("%x", ...). I'd be OK with Base64 too.

[kangmingtay]

One other remark, and this is really a nit, is to use encoding/hex as it expresses intent more clearly than fmt.Sprintf("%x", ...). I'd be OK with Base64 too.

decided not to use the encoding/hex package and stuck to fmt.Sprintf("%x", ...) instead because EncodeToString takes in a byte slice while sha256.Sum224 returns a [28]byte array

[hf]

LGTM!

[hf]

One other remark, and this is really a nit, is to use encoding/hex as it expresses intent more clearly than fmt.Sprintf("%x", ...). I'd be OK with Base64 too.

decided not to use the encoding/hex package and stuck to fmt.Sprintf("%x", ...) instead because EncodeToString takes in a byte slice while sha256.Sum224 returns a [28]byte array

Usually you can just do something like:

hex.EncodeToString(array[:])

To convert the array to a slice...

No need to block the PR on this though, if you want you can change it in another PR -- do it, if not, c'est la vie. 😸

[hf]

Actually. This seems to not be working very well: https://go.dev/play/p/yKmLeyU2vmi

[hf]

Actually. This seems to not be working very well: https://go.dev/play/p/yKmLeyU2vmi

LOL. No this uses Println not Printf. This is good to go.

[github-actions]

🎉 This PR is included in version 2.7.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀