supabase / gotrue / 8258879978

65%

Build Type

push

github

Committed by web-flow

Commit Message

feat: clean up expired factors (#1371)

## What kind of change does this PR introduce?

Currently, unverified MFA factors can build up in the database quickly.
Supabase developers can toggle Maximum unverified factors ( `Maximum
number of per-user MFA factors`) via the dashboard but developers will
have to look for the toggle. Developers can also call `unenroll` but it
requires an additional step.


This PR proposes periodic cleanup of stale factors on each request. A
stale factor is:

- Unverified
- Has no associated Challenges 
- Older than five minutes

Why five minutes? 
- Most enrolment or verification flow should be completed within the
five minute window

Factors which are unverified but have associated challenges will be
cleaned up [after the developer makes successful
verification](https://github.com/supabase/gotrue/blob/master/internal/api/mfa.go#L314)

Alternatives considered:
- Return the same factor and QR code if the same user calls `/enroll`
twice. We unfortunately can't reuse the QR code as it poses a security
risk.
- Increase the initial number of default unverified factors (currently
10)
- Drop the unverified factor check. I think this was initially
introduced to prevent a malicious user from creating excessive entries
in the database


Address #979.

---------

Co-authored-by: joel@joellee.org <joel@joellee.org>
Co-authored-by: joel <joel@joels-MacBook-Pro.local>

Run Details

20 of 28 new or added lines in 3 files covered. (71.43%)

1 existing line in 1 file now uncovered.

7852 of 12023 relevant lines covered (65.31%)

60.67 hits per line