@oneuptime/common 12.0.13 → 12.0.15

package/build/dist/Server/API/UserCallAPI.js

@@ -1,17 +1,35 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, { VerificationCodeRateLimitBucket, } from "../Middleware/VerificationCodeRateLimit";
 import UserCallService from "../Services/UserCallService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import ChannelVerification, { ChannelVerificationOutcome, } from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserCall from "../../Models/DatabaseModels/UserCall";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserCallAPI extends BaseAPI {
     constructor() {
         super(UserCall, UserCallService);
-        this.router.post(`/user-call/verify`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
-            var _a, _b, _c;
+        this.router.post(`/user-call/verify`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Verify), async (req, res, next) => {
+            var _a;
             try {
                 req = req;
                 if (!req.body.itemId) {
@@ -20,45 +38,26 @@ export default class UserCallAPI extends BaseAPI {
                 if (!req.body.code) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
                 }
-                // Check if the code matches and verify the phone number.
-                const item = await this.service.findOneById({
-                    id: req.body["itemId"],
-                    props: {
-                        isRoot: true,
-                    },
-                    select: {
-                        userId: true,
-                        projectId: true,
-                        verificationCode: true,
-                    },
-                });
-                if (!item) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
-                }
-                //check user id
-                if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
-                    ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
+                const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+                if (!userId) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));
                 }
-                if (item.verificationCode !== req.body["code"]) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
-                }
-                await this.service.updateOneById({
-                    id: item.id,
-                    props: {
-                        isRoot: true,
-                    },
-                    data: {
-                        isVerified: true,
-                    },
+                const result = await ChannelVerification.verifyCode({
+                    service: this.service,
+                    itemId: new ObjectID(req.body["itemId"].toString()),
+                    userId: userId,
+                    code: req.body["code"].toString(),
                 });
-                // Create default notification rules for this verified call number
+                if (result.outcome !== ChannelVerificationOutcome.Verified) {
+                    return Response.sendErrorResponse(req, res, ChannelVerification.getFailureException(result.outcome));
+                }
+                /* Create default notification rules for this verified call number */
                 try {
                     await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod({
-                        projectId: new ObjectID(item.projectId.toString()),
-                        userId: new ObjectID(item.userId.toString()),
+                        projectId: new ObjectID(result.projectId.toString()),
+                        userId: new ObjectID(result.userId.toString()),
                         notificationMethod: {
-                            userCallId: item.id,
+                            userCallId: result.itemId,
                         },
                     });
                 }
@@ -71,7 +70,7 @@ export default class UserCallAPI extends BaseAPI {
                 return next(err);
             }
         });
-        this.router.post(`/user-call/resend-verification-code`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`/user-call/resend-verification-code`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Resend), async (req, res, next) => {
             var _a, _b, _c;
             try {
                 req = req;
@@ -90,6 +89,11 @@ export default class UserCallAPI extends BaseAPI {
                 if (!item) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
                 }
+                /*
+                 * A caller may only ask for a code to be sent to a row they own.
+                 * Without this the resend route is a way to make somebody else's
+                 * device ring on demand.
+                 */
                 if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
                     ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));

package/build/dist/Server/API/UserCallAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserCallAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserCallAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,eAEN,MAAM,6BAA6B,CAAC;AACrC,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAOlF,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAG5D,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,OAGxC;IACC;QACE,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mBAAmB,EACnB,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,yDAAyD;gBACzD,MAAM,IAAI,GAAmB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC1D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAI;wBACf,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,eAAe;gBAEf,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC/B,EAAE,EAAE,IAAI,CAAC,EAAG;oBACZ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI;qBACjB;iBACF,CAAC,CAAC;gBAEH,kEAAkE;gBAClE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC7C,kBAAkB,EAAE;4BAClB,UAAU,EAAE,IAAI,CAAC,EAAG;yBACrB;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,EACrC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC3D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"UserCallAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserCallAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,yBAAyB,EAAE,EAChC,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,eAEN,MAAM,6BAA6B,CAAC;AAOrC,OAAO,mBAAmB,EAAE,EAC1B,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAC5D,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAClF,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,OAGxC;IACC;QACE,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mBAAmB,EACnB,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;gBAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GACV,MAAM,mBAAmB,CAAC,UAAU,CAAC;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACnD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;iBAClC,CAAC,CAAC;gBAEL,IAAI,MAAM,CAAC,OAAO,KAAK,0BAA0B,CAAC,QAAQ,EAAE,CAAC;oBAC3D,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CACxD,CAAC;gBACJ,CAAC;gBAED,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACrD,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC/C,kBAAkB,EAAE;4BAClB,UAAU,EAAE,MAAM,CAAC,MAAO;yBAC3B;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,EACrC,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC3D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/UserEmailAPI.js

@@ -1,18 +1,36 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, { VerificationCodeRateLimitBucket, } from "../Middleware/VerificationCodeRateLimit";
 import UserEmailService from "../Services/UserEmailService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import ChannelVerification, { ChannelVerificationOutcome, } from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserEmail from "../../Models/DatabaseModels/UserEmail";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserEmailAPI extends BaseAPI {
     constructor() {
         var _a, _b;
         super(UserEmail, UserEmailService);
-        this.router.post(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/verify`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
-            var _a, _b, _c;
+        this.router.post(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/verify`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Verify), async (req, res, next) => {
+            var _a;
             try {
                 req = req;
                 if (!req.body.itemId) {
@@ -21,45 +39,26 @@ export default class UserEmailAPI extends BaseAPI {
                 if (!req.body.code) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
                 }
-                // Check if the code matches and verify the email.
-                const item = await this.service.findOneById({
-                    id: req.body["itemId"],
-                    props: {
-                        isRoot: true,
-                    },
-                    select: {
-                        userId: true,
-                        projectId: true,
-                        verificationCode: true,
-                    },
-                });
-                if (!item) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
-                }
-                //check user id
-                if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
-                    ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
+                const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+                if (!userId) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));
                 }
-                if (item.verificationCode !== req.body["code"]) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
-                }
-                await this.service.updateOneById({
-                    id: item.id,
-                    props: {
-                        isRoot: true,
-                    },
-                    data: {
-                        isVerified: true,
-                    },
+                const result = await ChannelVerification.verifyCode({
+                    service: this.service,
+                    itemId: new ObjectID(req.body["itemId"].toString()),
+                    userId: userId,
+                    code: req.body["code"].toString(),
                 });
-                // Create default notification rules for this verified email
+                if (result.outcome !== ChannelVerificationOutcome.Verified) {
+                    return Response.sendErrorResponse(req, res, ChannelVerification.getFailureException(result.outcome));
+                }
+                /* Create default notification rules for this verified email */
                 try {
                     await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod({
-                        projectId: new ObjectID(item.projectId.toString()),
-                        userId: new ObjectID(item.userId.toString()),
+                        projectId: new ObjectID(result.projectId.toString()),
+                        userId: new ObjectID(result.userId.toString()),
                         notificationMethod: {
-                            userEmailId: item.id,
+                            userEmailId: result.itemId,
                         },
                     });
                 }
@@ -73,7 +72,7 @@ export default class UserEmailAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_b = new this.entityType()
-            .getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/resend-verification-code`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/resend-verification-code`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Resend), async (req, res, next) => {
             var _a, _b, _c;
             try {
                 req = req;
@@ -92,6 +91,11 @@ export default class UserEmailAPI extends BaseAPI {
                 if (!item) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
                 }
+                /*
+                 * A caller may only ask for a code to be sent to a row they own.
+                 * Without this the resend route is a way to make somebody else's
+                 * device ring on demand.
+                 */
                 if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
                     ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));

package/build/dist/Server/API/UserEmailAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserEmailAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserEmailAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,gBAEN,MAAM,8BAA8B,CAAC;AACtC,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAOlF,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAE9D,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,OAGzC;IACC;;QACE,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,SAAS,EAC9D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,MAAM,IAAI,GAAqB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC5D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAI;wBACf,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,eAAe;gBAEf,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC/B,EAAE,EAAE,IAAI,CAAC,EAAG;oBACZ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI;qBACjB;iBACF,CAAC,CAAC;gBAEH,4DAA4D;gBAC5D,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC7C,kBAAkB,EAAE;4BAClB,WAAW,EAAE,IAAI,CAAC,EAAG;yBACtB;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,2BAA2B,EACzC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAqB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC5D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"UserEmailAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserEmailAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,yBAAyB,EAAE,EAChC,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,gBAEN,MAAM,8BAA8B,CAAC;AAOtC,OAAO,mBAAmB,EAAE,EAC1B,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAC9D,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAClF,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,OAGzC;IACC;;QACE,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,SAAS,EAC9D,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;gBAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GACV,MAAM,mBAAmB,CAAC,UAAU,CAAC;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACnD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;iBAClC,CAAC,CAAC;gBAEL,IAAI,MAAM,CAAC,OAAO,KAAK,0BAA0B,CAAC,QAAQ,EAAE,CAAC;oBAC3D,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CACxD,CAAC;gBACJ,CAAC;gBAED,+DAA+D;gBAC/D,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACrD,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC/C,kBAAkB,EAAE;4BAClB,WAAW,EAAE,MAAM,CAAC,MAAO;yBAC5B;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,2BAA2B,EACzC,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAqB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC5D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/UserIncomingCallNumberAPI.js

@@ -1,14 +1,33 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, { VerificationCodeRateLimitBucket, } from "../Middleware/VerificationCodeRateLimit";
 import UserIncomingCallNumberService from "../Services/UserIncomingCallNumberService";
+import ChannelVerification, { ChannelVerificationOutcome, } from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
 import UserIncomingCallNumber from "../../Models/DatabaseModels/UserIncomingCallNumber";
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserIncomingCallNumberAPI extends BaseAPI {
     constructor() {
         super(UserIncomingCallNumber, UserIncomingCallNumberService);
-        this.router.post(`/user-incoming-call-number/verify`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
-            var _a, _b, _c;
+        this.router.post(`/user-incoming-call-number/verify`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Verify), async (req, res, next) => {
+            var _a;
             try {
                 req = req;
                 if (!req.body.itemId) {
@@ -17,44 +36,26 @@ export default class UserIncomingCallNumberAPI extends BaseAPI {
                 if (!req.body.code) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
                 }
-                // Check if the code matches and verify the phone number
-                const item = await this.service.findOneById({
-                    id: req.body["itemId"],
-                    props: {
-                        isRoot: true,
-                    },
-                    select: {
-                        userId: true,
-                        verificationCode: true,
-                    },
-                });
-                if (!item) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
-                }
-                // Check user ID
-                if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
-                    ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
+                const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+                if (!userId) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));
                 }
-                if (item.verificationCode !== req.body["code"]) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
-                }
-                await this.service.updateOneById({
-                    id: item.id,
-                    props: {
-                        isRoot: true,
-                    },
-                    data: {
-                        isVerified: true,
-                    },
+                const result = await ChannelVerification.verifyCode({
+                    service: this.service,
+                    itemId: new ObjectID(req.body["itemId"].toString()),
+                    userId: userId,
+                    code: req.body["code"].toString(),
                 });
+                if (result.outcome !== ChannelVerificationOutcome.Verified) {
+                    return Response.sendErrorResponse(req, res, ChannelVerification.getFailureException(result.outcome));
+                }
                 return Response.sendEmptySuccessResponse(req, res);
             }
             catch (err) {
                 return next(err);
             }
         });
-        this.router.post(`/user-incoming-call-number/resend-verification-code`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`/user-incoming-call-number/resend-verification-code`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Resend), async (req, res, next) => {
             var _a, _b, _c;
             try {
                 req = req;
@@ -73,7 +74,11 @@ export default class UserIncomingCallNumberAPI extends BaseAPI {
                 if (!item) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
                 }
-                // Check user ID
+                /*
+                 * A caller may only ask for a code to be sent to a row they own.
+                 * Without this the resend route is a way to make somebody else's
+                 * device ring on demand.
+                 */
                 if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
                     ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));

package/build/dist/Server/API/UserIncomingCallNumberAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserIncomingCallNumberAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserIncomingCallNumberAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,6BAEN,MAAM,2CAA2C,CAAC;AAOnD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,sBAAsB,MAAM,oDAAoD,CAAC;AAExF,MAAM,CAAC,OAAO,OAAO,yBAA0B,SAAQ,OAGtD;IACC;QACE,KAAK,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mCAAmC,EACnC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,wDAAwD;gBACxD,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7B,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC,CAAC;gBAEL,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,gBAAgB;gBAChB,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC/B,EAAE,EAAE,IAAI,CAAC,EAAG;oBACZ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI;qBACjB;iBACF,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,EACrD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7B,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEL,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,gBAAgB;gBAChB,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"UserIncomingCallNumberAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserIncomingCallNumberAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,yBAAyB,EAAE,EAChC,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,6BAEN,MAAM,2CAA2C,CAAC;AAOnD,OAAO,mBAAmB,EAAE,EAC1B,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,sBAAsB,MAAM,oDAAoD,CAAC;AAExF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,OAAO,OAAO,yBAA0B,SAAQ,OAGtD;IACC;QACE,KAAK,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mCAAmC,EACnC,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;gBAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GACV,MAAM,mBAAmB,CAAC,UAAU,CAAC;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACnD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;iBAClC,CAAC,CAAC;gBAEL,IAAI,MAAM,CAAC,OAAO,KAAK,0BAA0B,CAAC,QAAQ,EAAE,CAAC;oBAC3D,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CACxD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,EACrD,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7B,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEL,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}