fix(auth): scope OTP invalidation to selected token instance and verify race condition (#2221)

Author: Tomasz Nuri

apps/web/__tests__/unit/verification-token.test.ts

@@ -103,4 +103,120 @@ describe("useVerificationToken", () => {
 		expect(result).toBeNull();
 		expect(deleted).toBe(false);
 	});
+
+	it("prevents race condition by checking rowsAffected on token consumption", async () => {
+		let deletePredicate1: unknown = null;
+		const mockDb1 = {
+			select: () => ({
+				from: () => ({
+					where: () => ({
+						limit: async () => [
+							{
+								identifier: "user@example.com",
+								token: "123456",
+								expires: new Date(Date.now() + 600000),
+							},
+						],
+					}),
+				}),
+			}),
+			delete: () => ({
+				where: (pred: unknown) => {
+					deletePredicate1 = pred;
+					return Promise.resolve({ rowsAffected: 1 });
+				},
+			}),
+		} as unknown as MySql2Database;
+
+		const adapter1 = DrizzleAdapter(mockDb1);
+
+		let deletePredicate2: unknown = null;
+		const mockDb2 = {
+			select: () => ({
+				from: () => ({
+					where: () => ({
+						limit: async () => [
+							{
+								identifier: "user@example.com",
+								token: "123456",
+								expires: new Date(Date.now() + 600000),
+							},
+						],
+					}),
+				}),
+			}),
+			delete: () => ({
+				where: (pred: unknown) => {
+					deletePredicate2 = pred;
+					return Promise.resolve({ rowsAffected: 0 });
+				},
+			}),
+		} as unknown as MySql2Database;
+
+		const adapter2 = DrizzleAdapter(mockDb2);
+
+		const firstResult = await adapter1.useVerificationToken?.({
+			identifier: "USER@example.com",
+			token: "123456",
+		});
+
+		expect(firstResult).not.toBeNull();
+		expect(deletePredicate1).not.toBeNull();
+
+		const secondResult = await adapter2.useVerificationToken?.({
+			identifier: "USER@example.com",
+			token: "123456",
+		});
+
+		expect(secondResult).toBeNull();
+		expect(deletePredicate2).not.toBeNull();
+	});
+
+	it("deletes only the selected token instance and preserves replacement tokens for the same user", async () => {
+		let table = [
+			{
+				identifier: "user@example.com",
+				token: "123456",
+				expires: new Date(Date.now() + 600000),
+			},
+			{
+				identifier: "user@example.com",
+				token: "replacement_token",
+				expires: new Date(Date.now() + 600000),
+			},
+		];
+
+		const mockDb = {
+			select: () => ({
+				from: () => ({
+					where: () => ({
+						limit: async () => [table[0]],
+					}),
+				}),
+			}),
+			delete: () => ({
+				where: () => {
+					const initialCount = table.length;
+					table = table.filter(
+						(row) =>
+							!(
+								row.identifier === "user@example.com" && row.token === "123456"
+							),
+					);
+					const rowsAffected = initialCount - table.length;
+					return Promise.resolve({ rowsAffected });
+				},
+			}),
+		} as unknown as MySql2Database;
+
+		const adapter = DrizzleAdapter(mockDb);
+		const result = await adapter.useVerificationToken?.({
+			identifier: "USER@example.com",
+			token: "999999",
+		});
+
+		expect(result).toBeNull();
+		expect(table.some((r) => r.token === "123456")).toBe(false);
+		expect(table.some((r) => r.token === "replacement_token")).toBe(true);
+	});
 });

packages/database/auth/drizzle-adapter.ts

@@ -522,7 +522,10 @@ export function DrizzleAdapter(
 				return null;
 			}
 			const storedIdentifier = row.identifier?.toLowerCase() ?? "";
-			await db
+
+			// Invalidate the specific token instance that was selected. This burns wrong guesses
+			// while scoping deletion to both identifier AND row.token to protect newly issued replacement tokens.
+			const result = await db
 				.delete(verificationTokens)
 				.where(
 					and(
@@ -531,10 +534,20 @@ export function DrizzleAdapter(
 					),
 				);
 
+			// If database reports 0 rows affected, token was consumed or rotated concurrently
+			const rowsAffected = (result as { rowsAffected?: number })?.rowsAffected;
+			if (rowsAffected === 0) {
+				console.warn(
+					"[useVerificationToken] Token already consumed or invalid during deletion.",
+				);
+				return null;
+			}
+
 			if (row.token !== token) {
 				console.warn("[useVerificationToken] Token mismatch");
 				return null;
 			}
+
 			return { ...row, identifier: storedIdentifier };
 		},
 	};