From 4915af06657cb1bcaff057585a62d9b15153418a Mon Sep 17 00:00:00 2001 From: Ryan Chen Date: Wed, 10 Jun 2026 19:07:18 -0400 Subject: [PATCH] Fix login on legacy DBs: drop NOT NULL phone/email from verification_codes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Old prod DBs had verification_codes.phone (or email) as NOT NULL with no default, so inserting a code via identifier-only failed silently — users received an emailed code that was never stored, and verify always said "Invalid or expired code." Drop the legacy columns in a migration and stop swallowing the CreateVerificationCode error. Co-Authored-By: Claude Fable 5 --- auth.go | 8 ++++++-- migrate.go | 6 ++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/auth.go b/auth.go index ec00f15..10e91e4 100644 --- a/auth.go +++ b/auth.go @@ -101,11 +101,15 @@ func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) { code := generateCode() expiresAt := time.Now().UTC().Add(10 * time.Minute) - s.q.CreateVerificationCode(r.Context(), db.CreateVerificationCodeParams{ + if err := s.q.CreateVerificationCode(r.Context(), db.CreateVerificationCodeParams{ Identifier: identifier, Code: code, ExpiresAt: expiresAt, - }) + }); err != nil { + log.Printf("failed to store verification code for %s: %v", identifier, err) + http.Error(w, "Internal error", 500) + return + } if err := sendVerificationEmail(identifier, code); err != nil { log.Printf("failed to send verification email to %s: %v", identifier, err) diff --git a/migrate.go b/migrate.go index 4a063eb..e7119c7 100644 --- a/migrate.go +++ b/migrate.go @@ -22,6 +22,12 @@ func runMigrations(database *sql.DB) { `DELETE FROM rsvps WHERE id NOT IN (SELECT MIN(id) FROM rsvps GROUP BY event_id, name COLLATE NOCASE)`, // Plus-one tracking for RSVPs. `ALTER TABLE rsvps ADD COLUMN plus_one INTEGER NOT NULL DEFAULT 0`, + // Drop legacy phone/email columns from verification_codes. They were + // NOT NULL with no default, so inserts using only identifier failed. + `DROP INDEX IF EXISTS idx_verification_codes_phone`, + `DROP INDEX IF EXISTS idx_verification_codes_email`, + `ALTER TABLE verification_codes DROP COLUMN phone`, + `ALTER TABLE verification_codes DROP COLUMN email`, // SMS consent logging for Twilio compliance. `CREATE TABLE IF NOT EXISTS sms_consents ( id INTEGER PRIMARY KEY AUTOINCREMENT,