From 39722d30afdef3f8573b5472047e724eb5e9607d Mon Sep 17 00:00:00 2001 From: miloschwartz Date: Mon, 31 Aug 2026 14:39:36 -0400 Subject: [PATCH] resolve security-key login only for a unique internal user --- server/routers/auth/securityKey.ts | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/server/routers/auth/securityKey.ts b/server/routers/auth/securityKey.ts index 2480ddd08..74ec2a710 100644 --- a/server/routers/auth/securityKey.ts +++ b/server/routers/auth/securityKey.ts @@ -533,18 +533,23 @@ export async function startAuthentication( // If email is provided, get security keys for that specific user if (email) { - const [user] = await db + const matchingUsers = await db .select() .from(users) - .where(eq(users.email, email)) - .limit(1); + .where( + and( + eq(users.email, email.toLowerCase()), + eq(users.type, UserType.Internal) + ) + ); - if (!user || user.type !== UserType.Internal) { + if (matchingUsers.length !== 1) { return next( createHttpError(HttpCode.BAD_REQUEST, "Invalid credentials") ); } + const user = matchingUsers[0]; userId = user.userId; const userSecurityKeys = await db