{{ message }}
Repository navigation
Conversation
Contributor
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Meldiron
reviewed
Sep 15, 2026
Contributor
Meldiron
approved these changes
Sep 15, 2026
Meldiron
approved these changes
Sep 15, 2026
Meldiron
reviewed
Sep 15, 2026
…t-for-email-verification-password-recovery # Conflicts: # tests/e2e/Services/Account/AccountCustomClientTest.php
imtia33
force-pushed
the
feat/add-OTP-support-for-email-verification-password-recovery
branch
from
September 15, 2026 15:48
2567955 to
b09c2e4
Compare
Adds a unit regression on User::tokenVerify asserting a verification OTP and a link secret are not interchangeable, plus the expired OTP case that e2e cannot reach without a clock shim. Adds the matching e2e case: an active OTP is rejected by PUT /v1/account/verifications/email, and the missing USER_EMAIL_NOT_FOUND guard on the create endpoint. Derives the wrong-secret value from the delivered code so the negative case cannot collide with the active OTP. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
testCreateEmailVerificationOTP started from setupAccountWithSession(), which returns a process-wide cached account shared by every test the ParaTest worker runs. setupAccountWithUpdatedEmail() rotates that user's email server-side but only refreshes self::$updatedEmailData, leaving self::$sessionData['email'] stale. The OTP mail is therefore sent to the rotated address while the test polls maildev for the old one, so the lookup fails. It is order dependent, which is why it passes under --filter=OTP (the rotating tests never run) and failed in the full CI suite. Use createFreshAccountWithSession(), the existing helper for this, so the account is unverified, uniquely addressed and cannot be mutated by other tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds support for OTP-based Email Verification and Password Recovery in the Account API, making it easy and seamless for mobile application developers to verify emails and reset passwords without requiring web redirects or deep linking.
4 new endpoints are introduced:
POST /v1/account/verifications/email/otp(createEmailVerificationOTP): Generates and emails a 6-digit OTP code to verify the user's email address.PUT /v1/account/verifications/email/otp(updateEmailVerificationOTP): Validates the 6-digit OTP code and marks the email as verified.POST /v1/account/recovery/otp(createRecoveryOTP): Generates and emails a 6-digit OTP code for password reset.PUT /v1/account/recovery/otp(updateRecoveryOTP): Validates the 6-digit OTP code and updates the user's password.Note: I know this looks like a huge PR but actual changes are minimal. Reused existing architecture of email verification and password recovery. This PR creates new endpoints for OTP support for both methods mentioned. This can be scoped down to one method at a time if required.
Update: Now the PR is scoped down to email verification only .
Implementation Rationale & Reuse
The implementation reuses Appwrite's existing architecture and patterns:
TOKEN_TYPE_VERIFICATION(2) andTOKEN_TYPE_RECOVERY(3).TOKEN_EXPIRATION_OTP- 15 minutes).MAIL_TEMPLATE_OTP/email-otp.tpl) and security phrase mechanism (Phrase()).ProofsToken) with 6-digit OTP generation (ProofsCode). Net-new logic additions are minimal.Test Plan
Added end-to-end unit and integration test coverage in
tests/e2e/Services/Account/AccountCustomClientTest.php:testCreateEmailVerificationOTP: Verifies creation of verification OTP and email delivery.testUpdateEmailVerificationOTP: Tests successful verification with OTP, as well as failure cases (expired code, wrong user, invalid code).testCreateRecoveryOTP: Verifies creation of recovery OTP and email delivery.testUpdateRecoveryOTP: Tests password reset with OTP, verifying password changes and invalid attempt failures.Local Verification
Executed PHPUnit E2E tests inside the Appwrite container:
docker compose exec appwrite vendor/bin/phpunit tests/e2e/Services/Account/AccountCustomClientTest.php --filter=OTPOutput:
Related PRs and Issues
Draft PR to gather feedback on OTP-based email verification and password recovery endpoints for mobile developers.
Checklist