From e2b421c88479857831e938acb311aef5127f38b4 Mon Sep 17 00:00:00 2001
From: Ellie Huxtable <ellie@atuin.sh>
Date: Tue, 27 Jan 2026 13:56:18 -0800
Subject: feat: remove user verification functionality (#3108)

<!-- Thank you for making a PR! Bug fixes are always welcome, but if
you're adding a new feature or changing an existing one, we'd really
appreciate if you open an issue, post on the forum, or drop in on
Discord -->

## Checks
- [ ] I am happy for maintainers to push small adjustments to this PR,
to speed up the review cycle
- [ ] I have checked that there are no existing pull requests for the
same thing

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---
 crates/atuin-server-sqlite/src/lib.rs | 99 ++++-------------------------------
 1 file changed, 10 insertions(+), 89 deletions(-)

(limited to 'crates/atuin-server-sqlite/src/lib.rs')

diff --git a/crates/atuin-server-sqlite/src/lib.rs b/crates/atuin-server-sqlite/src/lib.rs
index 83d05ea5..d69258c4 100644
--- a/crates/atuin-server-sqlite/src/lib.rs
+++ b/crates/atuin-server-sqlite/src/lib.rs
@@ -1,10 +1,7 @@
 use std::str::FromStr;
 
 use async_trait::async_trait;
-use atuin_common::{
-    record::{EncryptedData, HostId, Record, RecordIdx, RecordStatus},
-    utils::crypto_random_string,
-};
+use atuin_common::record::{EncryptedData, HostId, Record, RecordIdx, RecordStatus};
 use atuin_server_database::{
     Database, DbError, DbResult, DbSettings,
     models::{History, NewHistory, NewSession, NewUser, Session, User},
@@ -67,9 +64,9 @@ impl Database for Sqlite {
     #[instrument(skip_all)]
     async fn get_session_user(&self, token: &str) -> DbResult<User> {
         sqlx::query_as(
-            "select users.id, users.username, users.email, users.password, users.verified_at from users 
-            inner join sessions 
-            on users.id = sessions.user_id 
+            "select users.id, users.username, users.email, users.password from users
+            inner join sessions
+            on users.id = sessions.user_id
             and sessions.token = $1",
         )
         .bind(token)
@@ -99,14 +96,12 @@ impl Database for Sqlite {
 
     #[instrument(skip_all)]
     async fn get_user(&self, username: &str) -> DbResult<User> {
-        sqlx::query_as(
-            "select id, username, email, password, verified_at from users where username = $1",
-        )
-        .bind(username)
-        .fetch_one(&self.pool)
-        .await
-        .map_err(fix_error)
-        .map(|DbUser(user)| user)
+        sqlx::query_as("select id, username, email, password from users where username = $1")
+            .bind(username)
+            .fetch_one(&self.pool)
+            .await
+            .map_err(fix_error)
+            .map(|DbUser(user)| user)
     }
 
     #[instrument(skip_all)]
@@ -141,80 +136,6 @@ impl Database for Sqlite {
         Ok(res.0)
     }
 
-    #[instrument(skip_all)]
-    async fn user_verified(&self, id: i64) -> DbResult<bool> {
-        let res: (bool,) =
-            sqlx::query_as("select verified_at is not null from users where id = $1")
-                .bind(id)
-                .fetch_one(&self.pool)
-                .await
-                .map_err(fix_error)?;
-
-        Ok(res.0)
-    }
-
-    #[instrument(skip_all)]
-    async fn verify_user(&self, id: i64) -> DbResult<()> {
-        sqlx::query(
-            "update users set verified_at = (current_timestamp at time zone 'utc') where id=$1",
-        )
-        .bind(id)
-        .execute(&self.pool)
-        .await
-        .map_err(fix_error)?;
-
-        Ok(())
-    }
-
-    #[instrument(skip_all)]
-    async fn user_verification_token(&self, id: i64) -> DbResult<String> {
-        const TOKEN_VALID_MINUTES: i64 = 15;
-
-        // First we check if there is a verification token
-        let token: Option<(String, sqlx::types::time::OffsetDateTime)> = sqlx::query_as(
-            "select token, valid_until from user_verification_token where user_id = $1",
-        )
-        .bind(id)
-        .fetch_optional(&self.pool)
-        .await
-        .map_err(fix_error)?;
-
-        let token = if let Some((token, valid_until)) = token {
-            // We have a token, AND it's still valid
-            if valid_until > time::OffsetDateTime::now_utc() {
-                token
-            } else {
-                // token has expired. generate a new one, return it
-                let token = crypto_random_string::<24>();
-
-                sqlx::query("update user_verification_token set token = $2, valid_until = $3 where user_id=$1")
-                    .bind(id)
-                    .bind(&token)
-                    .bind(time::OffsetDateTime::now_utc() + time::Duration::minutes(TOKEN_VALID_MINUTES))
-                    .execute(&self.pool)
-                    .await
-                    .map_err(fix_error)?;
-
-                token
-            }
-        } else {
-            // No token in the database! Generate one, insert it
-            let token = crypto_random_string::<24>();
-
-            sqlx::query("insert into user_verification_token (user_id, token, valid_until) values ($1, $2, $3)")
-                .bind(id)
-                .bind(&token)
-                .bind(time::OffsetDateTime::now_utc() + time::Duration::minutes(TOKEN_VALID_MINUTES))
-                .execute(&self.pool)
-                .await
-                .map_err(fix_error)?;
-
-            token
-        };
-
-        Ok(token)
-    }
-
     #[instrument(skip_all)]
     async fn update_user_password(&self, user: &User) -> DbResult<()> {
         sqlx::query(
-- 
cgit v1.3.1