Surreal DB - Sign up doesn't validate if user already exists and sign in works with any random credentials?

Question

I have created a scope as follows:

CURL POST /sql:

DEFINE SCOPE user SESSION 1d
        SIGNUP ( CREATE user SET user = $user, pass = crypto::argon2::generate($pass) )
        SIGNIN ( SELECT * FROM user WHERE user = $user AND crypto::argon2::compare(pass, $pass));

then I Signed up as following:

{
    "ns": "test",
    "db": "test",
    "sc": "user",
    "email": "[email protected]",
    "pass": "some password",
    "marketing": true,
    "tags": [
        "rust",
        "golang",
        "javascript"
    ]
}

Here I recieve:

{
    "code": 200,
    "details": "Authentication succeeded",
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOEQiI6InRlc3QiLCJTQyI6InVzZXIiLCJJRCI6InVzZXI6czFiN3JzcnlxNW9jdDVmM2FrdHEifQ.oy7ox2QCqNDAyZnvRmGPoU2t3QmzB38J67ynpRVPfd8nXfRw0RQPunQ04KTrtzfQeNHB5Zv8-nN0HrOuqxG78w"
}

After which i try to sign in:

{
    "ns": "test",
    "db": "test",
    "sc": "user",
    "email": "[email protected]",
    "pass": "some password"
}

which succeeds:

{
    "code": 200,
    "details": "Authentication succeeded",
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpYXQiOjE2NzIwMzc4NTAsIm5iZiI6MTY3MjAzNzg1MCwiZXhwIjoxNjcyMTI0MjUwLCJpY-l8cGbHeW72CbBIswIro-Tlan-QZuJFHVTIhUCP-1k1m-z8-YM7JYbXWT9IgPskKgzRDCJSt6iXmV-jw"
}

however when I do:

{
    "ns": "test",
    "db": "test",
    "sc": "user",
    "email": "[email protected]",
    "pass": "some password"
}

As you can see I added some random characters in email which is not signed up still I get a 200 response. And similarly when I try to sign up with a duplicate email, that succeeds too.

Any explanation that could possibly help to understand what's happening here?

Answer 1

In the root setting, you should enable this

---define SCHEMAFULL and PERMISSIONS
DEFINE TABLE user SCHEMAFULL
  PERMISSIONS
    FOR select, update WHERE id = $auth.id, 
    FOR create, delete NONE;
--- define FIELD's
DEFINE FIELD user ON user TYPE string;
DEFINE FIELD pass ON user TYPE string;
DEFINE FIELD settings.* ON user TYPE object;
DEFINE FIELD settings.marketing ON user TYPE string;
DEFINE FIELD tags ON user TYPE array;
-- Give the user table an email field. Store it in a string
DEFINE FIELD email ON TABLE user TYPE string
  -- Make this field required
  ASSERT $value != NONE 
  -- Check if the value is a properly formatted email address
  AND is::email($value);
--- define INDEX's
---DEFINE INDEX idx_user ON user COLUMNS user UNIQUE;
DEFINE INDEX idx_email ON user COLUMNS email UNIQUE;

As you can see from that line AND is::email($value); it makes sure it's unique. Also please be sure that you don't send request to signup endpoint

Answer 2

if a user is already logged in you must signout before trying the new user. you should use db.invalidate() to wipe out any previous authentication information and try with the new user , if you do that you should not be able to authenticate with random user credentials . source : https://surrealdb.com/docs/integration/sdks/nodejs#invalidate