fix verification cache for redis-backed challenges

server/store/tenant_store_test.go

@@ -2,7 +2,9 @@ package store
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/tinode/chat/server/store/types"
 )
@@ -41,3 +43,56 @@ func TestValidateMessageHeadersProductContract(t *testing.T) {
 		}
 	}
 }
+
+func TestVerificationCodeCachePreservesInternalFields(t *testing.T) {
+	tokenHash := "verify-token-hash"
+	now := time.Now().UTC().Round(time.Millisecond)
+	vc := &types.VerificationCode{
+		ID:                    11,
+		TenantID:              7,
+		ChallengeID:           "challenge-1",
+		Scene:                 "register",
+		Action:                "signup",
+		PhoneHash:             "phone-hash",
+		PhoneMask:             "+861****000",
+		CodeHash:              "code-hash",
+		VerificationTokenHash: &tokenHash,
+		State:                 types.VerificationStateVerified,
+		Attempts:              2,
+		MaxAttempts:           5,
+		ExpiresAt:             now.Add(5 * time.Minute),
+		ResendAfter:           now.Add(time.Minute),
+		VerifiedAt:            &now,
+		CreatedAt:             now,
+		UpdatedAt:             now,
+	}
+
+	publicPayload, err := json.Marshal(vc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(publicPayload), "code-hash") || strings.Contains(string(publicPayload), "phone-hash") {
+		t.Fatalf("public verification JSON leaked internal fields: %s", publicPayload)
+	}
+
+	cachePayload, err := json.Marshal(verificationCodeCacheFromType(vc))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(cachePayload), `"code_hash":"code-hash"`) ||
+		!strings.Contains(string(cachePayload), `"phone_hash":"phone-hash"`) ||
+		!strings.Contains(string(cachePayload), `"max_attempts":5`) {
+		t.Fatalf("cache verification JSON missing internal fields: %s", cachePayload)
+	}
+
+	var cached verificationCodeCache
+	if err := json.Unmarshal(cachePayload, &cached); err != nil {
+		t.Fatal(err)
+	}
+	got := cached.toType()
+	if got.CodeHash != vc.CodeHash || got.PhoneHash != vc.PhoneHash ||
+		got.State != vc.State || got.Attempts != vc.Attempts || got.MaxAttempts != vc.MaxAttempts ||
+		got.VerificationTokenHash == nil || *got.VerificationTokenHash != tokenHash {
+		t.Fatalf("cache round trip lost fields: got %#v", got)
+	}
+}