feat: refactor one-time tokens for performance

[hf]

Refactors all One-Time Tokens (OTP) used for sign-in with email, SMS, email confirmation, phone confirmation, change... to achieve:

• Performance (as current method does not use an index due to the use of partial indexes which cannot be used in practice)
• Future enhancements (such as OTP verification counters, adaptive OTP lengths, etc.)

Summary of the change:

• A new one_time_tokens table is added which uses a double-write mechanism with users.
• Each new OTP is both written in the corresponding users column and as a new row in one_time_tokens.
• Lookup for an OTP hash is performed first in one_time_tokens and if not found, using the traditional users approach.
• In a few days, once all OTPs using the users columns have expired, a new change will be deployed which removes the users lookup. This completely solves the performance issue for looking up OTPs.
• In a future change, the one_time_tokens table can be used to add a verification counter based on lookups on the relates_to (email or phone number) column, enabling new security features.

[coveralls]

Pull Request Test Coverage Report for Build 8970405577

Details

• 202 of 339 (59.59%) changed or added relevant lines in 6 files are covered.
• 5 unchanged lines in 2 files lost coverage.
• Overall coverage decreased (-0.2%) to 65.474%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/phone.go	9	17	52.94%
internal/api/verify.go	9	17	52.94%
internal/models/user.go	16	41	39.02%
internal/api/mail.go	28	62	45.16%
internal/models/one_time_token.go	138	200	69.0%

Files with Coverage Reduction	New Missed Lines	%
internal/models/user.go	2	75.22%
internal/api/mail.go	3	60.82%

Totals
Change from base Build 8906588569:	-0.2%
Covered Lines:	8365
Relevant Lines:	12776

---

💛 - Coveralls

[kangmingtay]

While testing the different OTP flows, I noticed that when secure email change is disabled, a row is created in one_time_tokens for email_change_token_current but no token_hash is present.

We should only be creating a one_time_token for email_change_token_new and not for email_change_token_current

[hf]

While testing the different OTP flows, I noticed that when secure email change is disabled, a row is created in one_time_tokens for email_change_token_current but no token_hash is present.

Right this is because the code maps 1:1 to the column. Because we set the column to be '' it also ends up in one_time_tokens. I'll fix that.

[kangmingtay]

While testing the different OTP flows, I noticed that when secure email change is disabled, a row is created in one_time_tokens for email_change_token_current but no token_hash is present.

Right this is because the code maps 1:1 to the column. Because we set the column to be '' it also ends up in one_time_tokens. I'll fix that.

yeah i think it's better if we simply don't insert a row into one_time_tokens if the token_hash is empty