fix: check for phone identity on Phone Change

internal/api/user.go

@@ -136,7 +136,7 @@ func (a *API) UserUpdate(w http.ResponseWriter, r *http.Request) error {
 	}
 
 	if params.Phone != "" && user.GetPhone() != params.Phone {
-		if exists, err := models.IsDuplicatedPhone(db, params.Phone, aud); err != nil {
+		if exists, err := models.HasPhoneIdentity(db, params.Phone, aud); err != nil {
 			return internalServerError("Database error checking phone").WithInternalError(err)
 		} else if exists {
 			return unprocessableEntityError(ErrorCodePhoneExists, DuplicatePhoneMsg)

internal/api/user_test.go

@@ -205,6 +205,12 @@ func (ts *UserTestSuite) TestUserUpdatePhoneAutoconfirmEnabled() {
 	require.NoError(ts.T(), err)
 	require.NoError(ts.T(), ts.API.db.Create(existingUser))
 
+	idPhone, err := models.NewIdentity(existingUser, "phone", map[string]interface{}{
+		"sub": "+29382983298",
+	})
+	require.NoError(ts.T(), err)
+	require.NoError(ts.T(), ts.API.db.Create(idPhone))
+
 	cases := []struct {
 		desc         string
 		userData     map[string]string

internal/models/user.go

@@ -759,6 +759,24 @@ func IsDuplicatedPhone(tx *storage.Connection, phone, aud string) (bool, error)
 	return true, nil
 }
 
+// TODO: Simplify this, check if it is safe to do this in admin create user too
+// HasPhoneIdentity checks if the phone number already exists in the identities table
+func HasPhoneIdentity(tx *storage.Connection, phone, aud string) (bool, error) {
+	query := `SELECT 1 FROM users
+        JOIN identities ON users.id = identities.user_id
+        WHERE users.phone = ? AND users.aud = ? AND identities.provider = ?
+        LIMIT 1`
+
+	var exists bool
+	q := tx.RawQuery(query, phone, aud, "phone")
+	exists, err := q.Exists(&exists)
+	if err != nil {
+		return false, err
+	}
+
+	return exists, nil
+}
+
 // Ban a user for a given duration.
 func (u *User) Ban(tx *storage.Connection, duration time.Duration) error {
 	if duration == time.Duration(0) {