fix: check verificationRequest.Identifier for login method in VerifyEmail (#495)

* fix: check verificationRequest.Identifier for login method in VerifyEmail

The loginMethod variable was compared to VerificationTypeMagicLinkLogin
right after being set to AuthRecipeMethodBasicAuth, making the condition
always false. Now checks verificationRequest.Identifier instead.

Fixes #484

* test: add test for verify email login method detection

Author: lakhansamani

internal/graphql/verify_email.go

@@ -140,7 +140,7 @@ func (g *graphqlProvider) VerifyEmail(ctx context.Context, params *model.VerifyE
 	}
 
 	loginMethod := constants.AuthRecipeMethodBasicAuth
-	if loginMethod == constants.VerificationTypeMagicLinkLogin {
+	if verificationRequest.Identifier == constants.VerificationTypeMagicLinkLogin {
 		loginMethod = constants.AuthRecipeMethodMagicLinkLogin
 	}
 

internal/integration_tests/verify_email_test.go

@@ -47,6 +47,30 @@ func TestVerifyEmail(t *testing.T) {
 		assert.Nil(t, verificationRes)
 	})
 
+	t.Run("should verify email and use correct login method for basic auth", func(t *testing.T) {
+		basicAuthEmail := "verify_email_basic_" + uuid.New().String() + "@authorizer.dev"
+		_, err := ts.GraphQLProvider.SignUp(ctx, &model.SignUpRequest{
+			Email:           &basicAuthEmail,
+			Password:        password,
+			ConfirmPassword: password,
+		})
+		assert.NoError(t, err)
+
+		vreq, err := ts.StorageProvider.GetVerificationRequestByEmail(ctx, basicAuthEmail, constants.VerificationTypeBasicAuthSignup)
+		assert.NoError(t, err)
+		assert.NotNil(t, vreq)
+		// Identifier should be basic_auth_signup, not magic_link_login
+		assert.Equal(t, constants.VerificationTypeBasicAuthSignup, vreq.Identifier)
+
+		verifyRes, err := ts.GraphQLProvider.VerifyEmail(ctx, &model.VerifyEmailRequest{
+			Token: vreq.Token,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, verifyRes)
+		assert.NotEmpty(t, verifyRes.AccessToken)
+		assert.NotNil(t, verifyRes.User)
+		assert.True(t, verifyRes.User.EmailVerified)
+	})
 	t.Run("should fail for revoked user", func(t *testing.T) {
 		revokedEmail := "verify_email_revoked_" + uuid.New().String() + "@authorizer.dev"
 		revokedSignupReq := &model.SignUpRequest{