supabase / auth / 35354476053

72%

push

github

feat(otp): add one_time_tokens query helpers (#2797)

## What kind of change does this PR introduce?
Feature

## What is the current behavior?
There is no single-query lookup for a token hash and its
`pkce_`-prefixed form, and no lookup by `relates_to`.

Callers such as `FindUserByEmailChangeCurrentAndAudience` run two
`FindOneTimeToken` queries to cover the prefix, which is inefficient.

## What is the new behavior?
Adds two parent query methods used by the upcoming
OTT-as-source-of-truth work:
- `FindOneTimeTokenWithPKCEFallback`: single-query lookup that accepts
either an exact token hash or its `pkce_`-prefixed form, preferring the
exact match.
- `FindOneTimeTokenByRelatesTo`: looks up the newest token row for a
given `relates_to` value (e.g. phone number) and token type.

Along with:
- `PKCEPrefix` is now a constant in `models` that we reference vs.
string literals
- `FindOneTimeToken` and `FindOneTimeTokenWithPKCEFallback` now share
`findOneTimeToken`, guided by a `pkceFallback` flag.

Adds tests for those methods. Not updating existing callers for now to
reduce the radius of this change.

## Additional context
Contributes to AUTH-1553 but does not close.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

27 of 29 new or added lines in 1 file covered. (93.1%)

16498 of 23099 relevant lines covered (71.42%)

495.0 hits per line