Emit ID for verification code

[whaught]

Issue #109

Proposed Changes

• Include the Database ID for the issued verification code. This will be later used in a new API to check the claimed/unclaimed status of the code.

Open Question

• Are there any security concerns with using this DB handle / do we need to create an artificial GUID key for this purpose. The DB key is an auto-increment uint which may allow for scraping or counting; However the user must be authenticated to retrieve code status.

Release Note

Include ID in the issue VerificationCode response

[icco]

Google API best practices say that we should use a string for all publicly visible IDs. If it's not a significant amount of work, we should use a GUID instead of an incrementing int.

[sethvargo]

/lgtm

[sethvargo]

Are there any security concerns with using this DB handle / do we need to create an artificial GUID key for this purpose. The DB key is an auto-increment uint which may allow for scraping or counting; However the user must be authenticated to retrieve code status.

I don't think this vector is a concern in this case. If we go with UUIDs, we'd want to do that at the database layer and use that as the primary key instead of having two primary keys (example).

[sethvargo]

It's also worth noting that we already use IDs in the URLs for API keys. If we want to switch to UUIDs, we might consider doing that as a wholesale change across all models as a followup?

[sethvargo]

You'll probably want URLEncoding here instead, since this will be used as part of a URL. However, it's probably better to use hex here (even though it's longer).

[sethvargo]

Also document this 😄

[sethvargo]

/lgtm

[google-oss-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sethvargo, whaught

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sethvargo,whaught]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment