chore: Adding organizationId in email verification#39892
Conversation
WalkthroughThis pull request introduces an Changes
Sequence Diagram(s)sequenceDiagram
participant US as UserServiceCEImpl
participant DB as Database
participant Token as EmailVerificationToken
Note over US: User Creation Flow
US->>US: setOrganizationIdForUser(user)
US->>Token: Create token with organizationId
Token-->>US: Token created
US->>Token: verifyEmailVerificationToken(token, providedOrganizationId)
Token-->>US: Validate organizationId match or error
sequenceDiagram
participant M as Migration070_AddOrganizationIdToEmailVerificationToken
participant DB as Database
participant Org as Organization
M->>DB: Query for Organization instance
alt Organization exists
DB-->>M: Return organization with organizationId
M->>DB: Update EmailVerificationToken docs missing organizationId
DB-->>M: Return count of modified documents
else No organization found
M-->>M: Log warning and skip migration
end
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
github-actions
bot
added
the
skip-changelog
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
app/server/appsmith-server/src/main/java/com/appsmith/server/migrations/db/ce/Migration070_AddOrganizationIdToEmailVerificationToken.java (2)
16-17: Use a descriptive author or remove if unnecessary.
Providing the author's identity can help trace future migration issues.
25-46: Consider multi-organization scenarios.
The migration currently assumes only one organization. If new organizations exist or arrive later, tokens might be assigned an incorrect organizationId.app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/UserServiceCEImpl.java (2)
115-115: Check for potential PII exposure.
Embedding organizationId in the URL can leak info if logged or shared. Consider masking or limiting logs.
758-772: Anonymous profile creation is neat.
If anonymous users ever need org-specific data, consider an optional org ID. Currently, this is fine.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
app/server/appsmith-server/src/main/java/com/appsmith/server/domains/EmailVerificationToken.java(1 hunks)app/server/appsmith-server/src/main/java/com/appsmith/server/migrations/db/ce/Migration070_AddOrganizationIdToEmailVerificationToken.java(1 hunks)app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/UserServiceCEImpl.java(12 hunks)
🧰 Additional context used
🧬 Code Definitions (1)
app/server/appsmith-server/src/main/java/com/appsmith/server/migrations/db/ce/Migration070_AddOrganizationIdToEmailVerificationToken.java (1)
app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/UserServiceCEImpl.java (1)
Slf4j(90-1007)
⏰ Context from checks skipped due to timeout of 90000ms (5)
- GitHub Check: perform-test / rts-build / build
- GitHub Check: perform-test / server-build / server-unit-tests
- GitHub Check: perform-test / client-build / client-build
- GitHub Check: server-unit-tests / server-unit-tests
- GitHub Check: server-spotless / spotless-check
🔇 Additional comments (15)
app/server/appsmith-server/src/main/java/com/appsmith/server/domains/EmailVerificationToken.java (1)
21-21: New field addition looks good.
Please ensure null or empty scenarios are consistently handled downstream.app/server/appsmith-server/src/main/java/com/appsmith/server/migrations/db/ce/Migration070_AddOrganizationIdToEmailVerificationToken.java (1)
48-51: Rollback not supported.
This is acceptable if changes are irreversible. Just ensure it's documented for future clarity.app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/UserServiceCEImpl.java (13)
110-110: Be mindful of widening visibility.
Making this constant protected instead of private might unintentionally expose it to subclasses.
418-419: Good layering for setting organizationId.
This ensures the user object always has an organizationId before being saved.
532-546: Helper method keeps code clean.
Nicely encapsulated logic for assigning organizationId. Consider error handling for null returns fromgetCurrentUserOrganizationId.
587-595: Sequential flow is clear.
Retrieving org ID before creation aligns with the new approach.
713-716: Anonymous user handling is well isolated.
This check simplifies your user profile flow nicely.
718-718: No concerns here.
Transition to regular user flow is straightforward.
926-928: Error handling is robust.
Catching these exceptions and redirecting is a good defensive approach.
933-936: Null token check is properly handled.
Returning early avoids unnecessary processing and confusion.
939-940: Graceful handling for missing email tokens.
Prevents unexpected null referencing.
942-945: Organization-specific user lookup is appropriate.
Ensures the verified user matches the correct organization.
949-949: Security context usage is consistent.
No issues found.
966-971: Organization mismatch check is a good security measure.
Prevents cross-organization token usage.
1000-1000: Final email verification flag set.
Confirms user is verified with minimal overhead.
## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /test sanity ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/14053389188> > Commit: 62fa250 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=14053389188&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Tue, 25 Mar 2025 07:24:44 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced email verification: links now include organization details for improved security. - Existing verification tokens have been updated to carry organization-specific information. - **Refactor** - Streamlined user onboarding and profile management workflows to better incorporate organization data. - Improved error messages during email verification to clearly indicate organization mismatches. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 participants
Description
Tip
Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team).
Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR.
Fixes #
Issue Numberor
Fixes
Issue URLWarning
If no issue exists, please create an issue first, and check with the maintainers if the issue is valid.
Automation
/test sanity
🔍 Cypress test results
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/14053389188
Commit: 62fa250
Cypress dashboard.
Tags:
@tag.SanitySpec:
Tue, 25 Mar 2025 07:24:44 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?
Summary by CodeRabbit
New Features
Refactor