Internal request for verify_account

[ilyacherevkov]

I'm attempting to use internal_request to verify an account, but I'm encountering an error related to an invalid verify_account_key. Here's the error message I'm receiving:

Rodauth::InternalRequestError at /invitations/accept/34786c803d69ee2599c2
Unable to verify account (invalid_verify_account_key) (Rodauth::InternalRequestError)

According to the Rodauth documentation:

"If an :account_id or :account_login option is provided, this will verify the account without requiring the verify account key value."

am I using internal_request incorrectly?

  hash_branch('invitations') do |r|
    r.on 'accept', String do |key|
      invitation = ScopeInvitation.pending_invitation(key).first
      invitee = invitation.invitee
      invitee.update(status_id: 2)
      invitation.update(accepted_at: Time.now)
      
      rodauth.verify_account(account_id: invitee.id)

      r.redirect '/dashboard'
    end
  end

[jeremyevans]

It should work in general. Maybe it has issues in your case because the invitee.update(status_id: 2) code? If that sets the account to verified state, I'm not sure why you would want to call verify_account, since that's basically what verify_account does.

[jeremyevans]

I confirmed with tests that you will get the error if you try to verify an already verified account. The reason for this is that internal_request still enforces the status id is what expected, even when you provide the :account_id option. Because the account was already verified, the account wasn't found even though :account_id was provided, so it continued to look for the verify account key, and that failed as it wasn't provided.

[ilyacherevkov]

Nice, thank you!

I also need to auto-login users when they accept an invitation. I have email auth enabled, I was thinking to generate email token with internal_request and then just redirect user to the appropriate magic URL, but it seems (at least from the docs) internal_request cannot generate this token.

[jeremyevans]

You should be able to use the email_auth_request internal request method if you want to send them an email with the magic URL. If you don't want to send them an email, and want to auto log the user in after request verification, that's the default behavior (verify_account_autologin? true). I'm not sure what would be the advantage of generating the magic URL and redirecting there, compared to autologin upon verification.

[ilyacherevkov]

Ok, I see. I still wasn't able to make App.rodauth.verify_account work (even after removing manual status update and reverting status back to "1"). The error is the same. Probably missed something, will check.

[ilyacherevkov]

It turns out that the previous error was due to the fact that I manually created an invitee account, so no verification keys were ever generated for the invited user.

I see the invitation logic as follows:

1. User creates an account as usual (visit /create-account), with a verification email sent to the user.
2. "Scope" (or project) is automatically provisioned to user after successful rodauth verification.
3. User can then invite other admins to his scope with a custom invitation email with join link (not part of rodauth).
4. Clicking on this join link will automatically create rodauth account (if it doesn't exist) without sending a verification email, add the user to the scope as a member and automatically log him in or redirect to project's dashboard.

To achieve point 4, I figured I can somehow use auth methods with internal_request feature using internal_request_eval and get_verify_account_key and then redirect user to verification page. But I can't figure out which parameters to pass to make it work correctly.

This doesn't seem to work (not sure hot to set account_id correctly)

verify_account_key =
          App.rodauth.internal_request_eval(env:, account_id: invitee.id) do
            account_id = invitee.id
            get_verify_account_key(account_id)
          end

with error:

127.0.0.1 - - [30/Jan/2025:12:53:49 +0800] "GET /invitations/0ca56238504476587780/accept HTTP/1.1" 302 - 0.0104
127.0.0.1 - - [30/Jan/2025:12:53:49 +0800] "GET /verify-account?key=lCSLwoGAByLcQk_dyRbQmFdGxIjINWKu5zkE3zShhGA HTTP/1.1" 302 - 0.0004
E, [2025-01-30T12:53:49.833653 #18471] ERROR -- : PG::InvalidTextRepresentation: ERROR:  invalid input syntax for type uuid: "lCSLwoGAByLcQk"
CONTEXT:  unnamed portal parameter $1 = '...': SELECT "key" FROM "account_verification_keys" WHERE ("id" = $1) LIMIT 1; ["lCSLwoGAByLcQk"]
Sequel::DatabaseError: PG::InvalidTextRepresentation: ERROR:  invalid input syntax for type uuid: "lCSLwoGAByLcQk"
CONTEXT:  unnamed portal parameter $1 = '...'

Full code:

class App
  # ...
  plugin :rodauth, :csrf=>:route_csrf do
      enable :login, :logout, :email_auth, :create_account, :verify_account, :internal_request
      create_account_set_password? false
      verify_account_set_password? false
      force_email_auth? true
      login_redirect "/dashboard"
      verify_account_redirect "/dashboard"
      template_opts layout: 'layouts/public'
      domain ENV["RACK_ENV"] == "development" ? "localhost" : "domain.org"

      send_verify_account_email do
        return if internal_request? 
        super()
      end
  end
  hash_branch('invitations') do |r|
    # Accept invitation /invitations/:key/accept
    r.on String do |key|
      r.is 'accept' do
        invitation = ScopeInvitation.pending_invitations(key:).first
        unless invitation
          flash[:error] = "Invalid or expired invitation."
          r.redirect '/'
        end

        login = invitation.email
        scope_id = invitation.scope.id
        role_id = invitation.role_id
        email = invitation.email
        
        if !App.rodauth.account_exists?(login:)
          App.rodauth.create_account(login:)
        end

        invitee = Account.find(email:)
      
        if !invitee.scope_members_dataset.member_of(scope_id:)
          invitee.add_scope_member(scope_id:, role_id:)
        end

        if !invitee.default_scope
          AccountDefaultScope.create(account_id: invitee.id, scope_id:)
        end
        
        verify_account_key =
          App.rodauth.internal_request_eval(env:, account_id: invitee.id) do
            account_id = invitee.id
            get_verify_account_key(account_id)
          end

        invitation.update(accepted_at: Time.now)
        if invitee.status_id == 1
          r.redirect "/verify-account?key=#{verify_account_key}"
        else
          r.redirect '/dashboard'
        end
      end
    end
  end
  # ...
end

[ilyacherevkov]

I figured the token link was incorrect because key parameter is basically <id>_<key>
Since token_link method is private i just hardcoded redirect link and now it seems to work like I wanted
r.redirect "/verify-account?key=#{invitee.id}_#{verify_account_token_key}"