forked from
willdot.net/cocoon
A fork of the Cocoon PDS but being made more distributed.
implement enabling / disabling email auth factor (not currently checked on auth checks though)
Signed-off-by: Will Andrews <did:plc:dadhhalkfcq3gucaq25hjqon>
author
![]()
willdot.net
committer
Tangled
date
(Jan 4, 2026, 9:34 PM UTC)
commit
c006f078
c006f078a2e94b832de49101d968a548af853ac1
parent
110228ad
110228ad2e79f798c137e25deae1104bb94c7bad
+29
-11
+3
-2
models/models.go
+3
-2
models/models.go
···
29
29
Root []byte
30
30
Preferences []byte
31
31
Deactivated bool
32
+
EmailAuthFactor bool
32
33
}
33
34
34
35
func (r *Repo) SignFor(ctx context.Context, did string, msg []byte) ([]byte, error) {
···
121
122
}
122
123
123
124
type ReservedKey struct {
124
-
KeyDid string `gorm:"primaryKey"`
125
-
Did *string `gorm:"index"`
125
+
KeyDid string `gorm:"primaryKey"`
126
+
Did *string `gorm:"index"`
126
127
PrivateKey []byte
127
128
CreatedAt time.Time `gorm:"index"`
128
129
}
+1
-1
server/handle_server_create_session.go
+1
-1
server/handle_server_create_session.go
+1
-1
server/handle_server_get_session.go
+1
-1
server/handle_server_get_session.go
+24
-7
server/handle_server_update_email.go
+24
-7
server/handle_server_update_email.go
···
11
11
type ComAtprotoServerUpdateEmailRequest struct {
12
12
Email string `json:"email" validate:"required"`
13
13
EmailAuthFactor bool `json:"emailAuthFactor"`
14
-
Token string `json:"token" validate:"required"`
14
+
Token string `json:"token"`
15
15
}
16
16
17
17
func (s *Server) handleServerUpdateEmail(e echo.Context) error {
···
30
30
return helpers.InputError(e, nil)
31
31
}
32
32
33
-
if urepo.EmailUpdateCode == nil || urepo.EmailUpdateCodeExpiresAt == nil {
33
+
// To disable email auth factor a token is required.
34
+
// To enable email auth factor a token is not required.
35
+
// If updating an email address, a token will be sent anyway
36
+
if urepo.EmailAuthFactor && req.EmailAuthFactor == false && req.Token == "" {
34
37
return helpers.InvalidTokenError(e)
35
38
}
36
39
37
-
if *urepo.EmailUpdateCode != req.Token {
38
-
return helpers.InvalidTokenError(e)
40
+
if req.Token != "" {
41
+
if urepo.EmailUpdateCode == nil || urepo.EmailUpdateCodeExpiresAt == nil {
42
+
return helpers.InvalidTokenError(e)
43
+
}
44
+
45
+
if *urepo.EmailUpdateCode != req.Token {
46
+
return helpers.InvalidTokenError(e)
47
+
}
48
+
49
+
if time.Now().UTC().After(*urepo.EmailUpdateCodeExpiresAt) {
50
+
return helpers.ExpiredTokenError(e)
51
+
}
39
52
}
40
53
41
-
if time.Now().UTC().After(*urepo.EmailUpdateCodeExpiresAt) {
42
-
return helpers.ExpiredTokenError(e)
54
+
query := "UPDATE repos SET email_update_code = NULL, email_update_code_expires_at = NULL, email_auth_factor = ?, email = ?"
55
+
56
+
if urepo.Email != req.Email {
57
+
query += ",email_confirmed_at = NULL"
43
58
}
44
59
45
-
if err := s.db.Exec(ctx, "UPDATE repos SET email_update_code = NULL, email_update_code_expires_at = NULL, email_confirmed_at = NULL, email = ? WHERE did = ?", nil, req.Email, urepo.Repo.Did).Error; err != nil {
60
+
query += " WHERE did = ?"
61
+
62
+
if err := s.db.Exec(ctx, query, nil, req.EmailAuthFactor, req.Email, urepo.Repo.Did).Error; err != nil {
46
63
logger.Error("error updating repo", "error", err)
47
64
return helpers.ServerError(e, nil)
48
65
}