fix: otp read in otp verification jsx

Author: yash-pouranik

apps/dashboard-api/src/controllers/auth.controller.js

@@ -116,7 +116,7 @@ module.exports.register = async (req, res) => {
         const salt = await bcrypt.genSalt(10);
         const hashedPassword = await bcrypt.hash(password, salt);
 
-        const newDev = new Developer({ email, password: hashedPassword });
+        const newDev = new Developer({ email: email.toLowerCase().trim(), password: hashedPassword });
         await newDev.save();
 
         res.status(201).json({ message: "Registered successfully" });
@@ -132,7 +132,7 @@ module.exports.login = async (req, res) => {
     try {
         const { email, password } = loginSchema.parse(req.body);
 
-        const dev = await Developer.findOne({ email });
+        const dev = await Developer.findOne({ email: email.toLowerCase().trim() });
         if (!dev) return res.status(400).json({ error: "User not found" });
 
         const validPass = await bcrypt.compare(password, dev.password);
@@ -200,12 +200,14 @@ module.exports.deleteAccount = async (req, res) => {
 module.exports.sendOtp = async (req, res) => {
     try {
         const { email } = onlyEmailSchema.parse(req.body);
+        const normalizedEmail = email.toLowerCase().trim();
 
-        const existingUser = await Developer.findOne({ email });
+        const existingUser = await Developer.findOne({ email: normalizedEmail });
         if (!existingUser) {
             return res.status(400).json({ error: "User not found. Ensure you are using the correct email." });
         }
 
+
         if (existingUser.isVerified) {
             return res.status(400).json({ error: "Account is already verified. Please login." });
         }

apps/public-api/src/controllers/userAuth.controller.js

@@ -939,6 +939,7 @@ module.exports.signup = async (req, res) => {
         const project = req.project;
 
         const { email, password, username, ...otherData } = userSignupSchema.parse(req.body);
+        const normalizedEmail = email.toLowerCase().trim();
 
         // Get Mongoose Model
         const usersColConfig = project.collections.find(c => c.name === 'users');
@@ -947,7 +948,8 @@ module.exports.signup = async (req, res) => {
         const connection = await getConnection(project._id);
         const Model = getCompiledModel(connection, usersColConfig, project._id, project.resources.db.isExternal);
 
-        const existingUser = await Model.findOne({ email });
+        const existingUser = await Model.findOne({ email: normalizedEmail });
+
         if (existingUser) {
             // Check if user is unverified. If so, we can trigger a resend instead of a hard error.
             const verificationField = getVerificationField(usersColConfig);
@@ -1040,14 +1042,16 @@ module.exports.login = async (req, res) => {
     try {
         const project = req.project;
         const { email, password } = loginSchema.parse(req.body);
+        const normalizedEmail = email.toLowerCase().trim();
 
         const usersColConfig = project.collections.find(c => c.name === 'users');
         if (!usersColConfig) return res.status(404).json({ error: "Auth collection not found" });
 
         const connection = await getConnection(project._id);
         const Model = getCompiledModel(connection, usersColConfig, project._id, project.resources.db.isExternal);
 
-        const user = await Model.findOne({ email });
+        const user = await Model.findOne({ email: normalizedEmail });
+
         if (!user) return res.status(400).json({ error: "Invalid email or password" });
 
         const validPass = await bcrypt.compare(password, user.password);
@@ -1222,11 +1226,13 @@ module.exports.verifyEmail = async (req, res) => {
     try {
         const project = req.project;
         const { email, otp } = verifyOtpSchema.parse(req.body);
+        const normalizedEmail = email.toLowerCase().trim();
 
-        const redisKey = `project:${project._id}:otp:verification:${email}`;
+        const redisKey = `project:${project._id}:otp:verification:${normalizedEmail}`;
         const storedOtp = await redis.get(redisKey);
 
         if (!storedOtp || storedOtp !== otp) {
+
             return res.status(400).json({ error: "Invalid or expired OTP" });
         }
 
@@ -1261,11 +1267,13 @@ module.exports.resendVerificationOtp = async (req, res) => {
     try {
         const project = req.project;
         const { email } = onlyEmailSchema.parse(req.body);
+        const normalizedEmail = email.toLowerCase().trim();
 
         const { usersColConfig, Model } = await getUsersModel(project);
         if (!Model) return res.status(404).json({ error: "Auth collection not found" });
 
-        const user = await Model.findOne({ email });
+        const user = await Model.findOne({ email: normalizedEmail });
+
         if (!user) {
             return res.status(400).json({ error: "User not found with this email." });
         }

apps/web-dashboard/src/pages/OtpVerification.jsx

@@ -10,8 +10,8 @@ function OtpVerification() {
     const { user, login, isLoading: authLoading } = useAuth(); // Destructure login
     const [otp, setOtp] = useState('');
 
-    // Derived email to avoid stale state if user is still loading
-    const email = location.state?.email || user?.email || '';
+    // Derived email with normalization to avoid stale/incorrect state
+    const email = (location.state?.email || user?.email || '').toLowerCase().trim();
 
     // Ref to track if we have already auto-sent OTP to prevent double sends in StrictMode
     const hasSentOtp = useRef(false);