Make mail code verification less strict

src/function/authentication/login-by-mail.ts

@@ -18,7 +18,7 @@
 import { Forbidden, Gone, InternalServerError, TooManyRequests } from 'http-errors'
 import { Database } from '../../database'
 import { sendAuthenticationMail } from '../../util/mail'
-import { randomWords } from '../../util/random-words'
+import { areWordSequencesEqual, randomWords } from '../../util/random-words'
 import { checkMailSendLimit } from '../../util/ratelimit-authmail'
 import { generateAuthToken } from '../../util/token'
 import { createAuthTokenByMailAddress } from './index'
@@ -78,7 +78,7 @@ export const signInByMailCode = async ({ mailLoginToken, receivedCode, database
       }
     }
 
-    if (entry.receivedCode !== receivedCode) {
+    if (!areWordSequencesEqual(entry.receivedCode, receivedCode)) {
       entry.remainingAttempts--
 
       await entry.save({ transaction })

src/util/random-words.ts

@@ -31,3 +31,13 @@ export const randomWords = (numberOfWords: number) => (
     .map((item) => randomWord())
     .join(' ')
 )
+
+const preprocessStringForComparing = (input: string) => (
+  input
+    .replace(/ |\*/g, '')
+    .toLowerCase()
+)
+
+export const areWordSequencesEqual = (a: string, b: string) => (
+  preprocessStringForComparing(a) === preprocessStringForComparing(b)
+)