fix(auth): store mail OTP codes as bcrypt hashes

[AmanGIT07]

Summary

Mail OTP and magic link codes are stored in the flows table as bcrypt hashes instead of the raw string. Verification compares the submitted code against the stored hash.

Changes

• core/authenticate/service.go: hash the emailed code before saving the flow; verify with bcrypt.CompareHashAndPassword; OIDC flows unchanged
• core/authenticate/service_test.go: TestService_StartFlow now checks the stored hash; new TestService_FinishFlow covers valid, wrong, and capped attempts; new sequence test covers a wrong attempt followed by the right code

Technical Details

• bcrypt cost is 12 (~200ms per hash). The cost is a package var so tests can drop it to bcrypt.MinCost.
• No DB migration: the nonce column is text and fits the 60-character hash.
• Deployment impact: anyone who requested an OTP before the deploy cannot finish that login — the stored code predates hashing and is rejected. The impact window is at most the 10-minute flow validity; affected users request a new code.

Test Plan

• make lint — 0 issues
• make test — full suite passes
• E2E authentication regression suite passes, including a mail OTP login against real Postgres

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 24, 2026 8:44am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 865a8bea-89b7-4a73-8b26-b04fe1ad8baa

📥 Commits

Reviewing files that changed from the base of the PR and between 7c2964c and 71047c2.

📒 Files selected for processing (1)

• core/authenticate/service_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• core/authenticate/service_test.go

---

📝 Walkthrough

Summary by CodeRabbit

• Security Enhancements
  • One-time passwords and email-link codes are now securely hashed before storage.
  • Submitted codes are checked against their secure hashes to strengthen verification.
• Bug Fixes
  • Authentication flows now correctly allow retrying after an incorrect one-time password.
  • Improved handling and validation of OTP-based sign-in flows, ensuring the correct flow behavior across attempts.

Walkthrough

Changes

OTP hashing and verification

Layer / File(s)	Summary
Hash nonces during flow creation core/authenticate/service.go, core/authenticate/service_test.go	Mail OTP and link flow nonces are bcrypt-hashed with configurable cost before storage, with updated start-flow assertions.
Verify and consume mail OTP flows core/authenticate/service.go, core/authenticate/service_test.go	Submitted codes are bcrypt-compared, and tests cover attempt tracking and wrong-then-right OTP submission.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

core/authenticate/service_test.go (1)

472-476: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Lock down legacy-flow rejection.

Add a raw Nonce: "111111" fixture and assert a matching submitted code returns ErrInvalidMailOTP. The new cases only construct bcrypt hashes, so the stated deployment contract for pre-existing plaintext rows is untested.

Also applies to: 590-594

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e6e95930-c6b3-4da6-812c-2e0dee3f84b9

📥 Commits

Reviewing files that changed from the base of the PR and between ae5e60a and 7c2964c.

📒 Files selected for processing (2)

• core/authenticate/service.go
• core/authenticate/service_test.go

[coveralls]

Coverage Report for CI Build 30079965546

Coverage increased (+0.1%) to 46.866%

Details

• Coverage increased (+0.1%) from the base build.
• Patch coverage: 12 uncovered changes across 1 file (3 of 15 lines covered, 20.0%).
• 3 coverage regressions across 1 file.

Uncovered Changes

File	Changed	Covered	%
core/authenticate/service.go	15	3	20.0%

Coverage Regressions

3 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
core/authenticate/service.go	3	24.16%

---

Coverage Stats

Relevant Lines:	38981
Covered Lines:	18269
Line Coverage:	46.87%
Coverage Strength:	14.33 hits per line

---

💛 - Coveralls