fix(canSendEmailOtp): use a query to find whitelist match, rather than fetching the whole table

[timotheeg]

Problem

We have a whitelist of domains and specific allowed emails in DB. Before we allow a OTP to be sent to an email, we check against the whitelist if the input email is allowed.

The way this is done is to fetch the entire table content (with a slight filter for expiry) and do a match in code 😑

It would be much more efficient to use the database query capabilities to run the match on the DB directly. We can expect that to be both faster and transfer much less data.

Solution

Run a raw efficient query to return an easy yes/no state on whether an email matches an entry in the whitelist.

We can not use the ORM capability because we are not matching a cell value to some input. Instead we are matching the input against the cell value with a endsWith behaviour. This is done by using the <input> like concat ('%', field) syntax.

As we want the query to exit as early as possible (any match is enough), we run the query to return 1 on match and limit 1.

While DB engine do not offer guarantees of early exit, in principle, this can exit on the first match found and is thus as efficient as it can be made.

For email which do not match, there will be a full traversal of the table, which is about the same as the previous code, which was also doing a full table scan.

We return the whitelist entry that matched so we can log and verify