Neilk1021 opened a new pull request, #7978:
URL: https://github.com/apache/texera/pull/7978
### What changes were proposed in this PR?
An email address a user types is now proved by a code mailed to it before it
is accepted at registration, and when a signed-in account with no address on
file supplies one. An address a provider already asserts as verified (Google's
`email_verified`) is trusted and never re-checked.
The hole this closes: a dataset contributor placeholder is a real account
that contributor rows already point at, and until now anyone could claim it by
typing a colleague's address.
**Codes are derived, not stored.** `EmailCodeVerifier` computes a 6-digit
code as a truncated HMAC (RFC 4226 style) over `purpose | scope | address |
time-step`, keyed from the JWT secret, and checks it by recomputing for the
current and previous step:
```
register(user, email, pw) ──> derive code ──> mail it ──> 200, no account yet
│
registerVerify(user, email, pw, code)
│
recompute & compare ──> account + token
```
Consequences of that choice:
| | |
| --- | --- |
| No `email_verification` table | no migration, no DDL, no changelog entry
in this PR |
| Nothing pending is written down | no password or hash waits anywhere while
a signup is in flight |
| A restart loses nothing | the code is a function of the secret and the
clock |
| The client re-submits its fields | which is why `registerVerify` takes the
password again |
A code is valid 5–10 minutes (one step plus the previous). Resend cooldown,
a per-scope
attempt cap, and eviction of stale trackers live in an in-memory map;
`/auth/register` is
unauthenticated, so that map is bounded deliberately rather than
incidentally.
**Defaults.** `user-sys.email-verification` ships **on** — an unproven
address is the weaker
position, so a deployment opts out of checking rather than into it. It must
agree with
`user-sys.google.smtp.gmail`: on with no sender configured is a
misconfiguration, not a
degraded mode, and both entry points refuse with a 503 naming the two
settings rather than
logging the code where anyone with log access could spend it.
`bin/local-dev.sh` sets
`USER_SYS_EMAIL_VERIFICATION=false`, since a local stack has no sender; an
explicit export
still wins.
New endpoints: `POST /auth/register/verify` and `POST /auth/email/code`.
`POST /auth/register`
now answers with `RegistrationResponse`, whose null `accessToken` *is* the
"a code was mailed"
signal — it is not reported separately, so the two cannot drift apart.
### Any related issues, documentation, discussions?
Closes #7977
Discussion #7818
### How was this PR tested?
Automated, all run on this branch:
```bash
# backend — the verifier and both endpoint flows
sbt "WorkflowExecutionService/testOnly
org.apache.texera.web.resource.auth.AuthResourceSpec
org.apache.texera.web.resource.auth.EmailCodeVerifierSpec"
# => Tests: succeeded 75, failed 0
# the config flag's default and its exposure to the anonymous config payload
sbt "Config/testOnly org.apache.texera.common.config.UserSystemConfigSpec"
# => Tests: succeeded 3, failed 0
sbt "ConfigService/testOnly
org.apache.texera.service.resource.ConfigResourceSpec"
# => Tests: succeeded 33, failed 0
# frontend, full suite
cd frontend && yarn test --watch=false
# => Test Files 201 passed | Tests 5067 passed, 1 skipped
```
`EmailCodeVerifierSpec` is new (20 cases): code derivation and its
independence from any
stored state, acceptance across the step boundary, rejection of a code
minted for a different
address / scope / purpose / secret, the resend cooldown, the attempt cap,
and the refusal when
SMTP is unconfigured. `AuthResourceSpec` gains 12 cases covering both
endpoint flows with the
verification seam pinned on.
Note for anyone running these locally:
`AuthResource.emailVerificationRequired` reads
`UserSystemConfig`, an object val resolved once per JVM. Both suites pin the
flag explicitly
rather than inheriting it, so they pass whether or not
`USER_SYS_EMAIL_VERIFICATION` is
exported in your shell — verified both ways.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Opus 5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
