fix: add checks for cases where more than 1 identity is returned

internal/api/verify.go

@@ -334,7 +334,13 @@ func (a *API) signupVerify(r *http.Request, ctx context.Context, conn *storage.C
 		//
 		// we still check for the length of the identities slice to be safe.
 		if len(user.Identities) != 0 {
+			if len(user.Identities) > 1 {
+				return internalServerError("User has more than one identity on signup")
+			}
 			emailIdentity := user.Identities[0]
+			if emailIdentity.Email != user.Email {
+				return internalServerError("User email identity does not match user email")
+			}
 			if terr = emailIdentity.UpdateIdentityData(tx, map[string]interface{}{
 				"email_verified": true,
 			}); terr != nil {

internal/api/verify_test.go

@@ -52,6 +52,7 @@ func (ts *VerifyTestSuite) SetupTest() {
 	// Create identity
 	i, err := models.NewIdentity(u, "email", map[string]interface{}{
 		"sub":            u.ID.String(),
+		"email":          "[email protected]",
 		"email_verified": false,
 	})
 	require.NoError(ts.T(), err, "Error creating test identity model")