Delete mail auth token after usage

src/function/authentication/index.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2021 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -31,7 +31,11 @@ export const createAuthTokenByMailAddress = async ({ mail, database, transaction
   return token
 }
 
-export const getMailByAuthToken = async ({ mailAuthToken, database, transaction }: { mailAuthToken: string, database: Database, transaction: Transaction }) => {
+export const getMailByAuthToken = async ({
+  mailAuthToken, database, transaction, invalidate
+}: {
+  mailAuthToken: string, database: Database, transaction: Transaction, invalidate: boolean
+}) => {
   const entry = await database.authtoken.findOne({
     where: {
       token: mailAuthToken
@@ -40,14 +44,31 @@ export const getMailByAuthToken = async ({ mailAuthToken, database, transaction
   })
 
   if (entry) {
+    if (invalidate) {
+      const rowCounter = await database.authtoken.destroy({
+        where: {
+          token: mailAuthToken
+        },
+        transaction
+      })
+
+      if (rowCounter !== 1) {
+        return null
+      }
+    }
+
     return entry.mail
   } else {
     return null
   }
 }
 
-export const requireMailByAuthToken = async ({ mailAuthToken, database, transaction }: { mailAuthToken: string, database: Database, transaction: Transaction }) => {
-  const mail = await getMailByAuthToken({ mailAuthToken, database, transaction })
+export const requireMailByAuthToken = async ({
+  mailAuthToken, database, transaction, invalidate
+}: {
+  mailAuthToken: string, database: Database, transaction: Transaction, invalidate: boolean
+}) => {
+  const mail = await getMailByAuthToken({ mailAuthToken, database, transaction, invalidate })
 
   if (!mail) {
     throw new Unauthorized()