How to Build a Custom Email Verification System in FlutterFlow

1// functions/index.js
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4const sgMail = require('@sendgrid/mail');
5const crypto = require('crypto');
6
7admin.initializeApp();
8
9exports.sendVerificationCode = functions.https.onCall(async (data, context) => {
10  if (!context.auth) {
11    throw new functions.https.HttpsError('unauthenticated', 'Must be signed in');
12  }
13
14  const email = context.auth.token.email;
15  if (!email) {
16    throw new functions.https.HttpsError('invalid-argument', 'No email on account');
17  }
18
19  const docId = email.replace(/\./g, ',');
20  const db = admin.firestore();
21  const ref = db.collection('verification_codes').doc(docId);
22
23  // Rate limit: one code per 60 seconds
24  const existing = await ref.get();
25  if (existing.exists) {
26    const createdAt = existing.data().createdAt?.toDate();
27    if (createdAt && Date.now() - createdAt.getTime() < 60000) {
28      throw new functions.https.HttpsError(
29        'resource-exhausted',
30        'Please wait 60 seconds before requesting a new code'
31      );
32    }
33  }
34
35  const code = crypto.randomInt(100000, 999999).toString();
36  const expiresAt = new Date(Date.now() + 10 * 60 * 1000);
37
38  await ref.set({
39    code,
40    userId: context.auth.uid,
41    expiresAt: admin.firestore.Timestamp.fromDate(expiresAt),
42    createdAt: admin.firestore.FieldValue.serverTimestamp(),
43    attempts: 0,
44    verified: false,
45  });
46
47  const apiKey = process.env.SENDGRID_API_KEY;
48  sgMail.setApiKey(apiKey);
49
50  await sgMail.send({
51    to: email,
52    from: 'noreply@yourapp.com',
53    subject: 'Your verification code',
54    html: `<p>Your code is: <strong style="font-size:24px;letter-spacing:4px">${code}</strong></p><p>Expires in 10 minutes.</p>`,
55  });
56
57  return { success: true };
58});

1exports.verifyCode = functions.https.onCall(async (data, context) => {
2  if (!context.auth) {
3    throw new functions.https.HttpsError('unauthenticated', 'Must be signed in');
4  }
5
6  const { code } = data;
7  const email = context.auth.token.email;
8  const docId = email.replace(/\./g, ',');
9  const db = admin.firestore();
10  const ref = db.collection('verification_codes').doc(docId);
11
12  const doc = await ref.get();
13  if (!doc.exists) {
14    throw new functions.https.HttpsError('not-found', 'No code found. Request a new one.');
15  }
16
17  const { code: storedCode, expiresAt, attempts, verified } = doc.data();
18
19  if (verified) return { success: true, alreadyVerified: true };
20
21  if (expiresAt.toDate() < new Date()) {
22    throw new functions.https.HttpsError('deadline-exceeded', 'Code expired. Request a new one.');
23  }
24
25  if (attempts >= 5) {
26    throw new functions.https.HttpsError('resource-exhausted', 'Too many attempts. Request a new code.');
27  }
28
29  if (code !== storedCode) {
30    await ref.update({ attempts: admin.firestore.FieldValue.increment(1) });
31    if (attempts + 1 >= 5) {
32      await ref.update({ expiresAt: admin.firestore.Timestamp.fromDate(new Date()) });
33    }
34    throw new functions.https.HttpsError('invalid-argument', 'Incorrect code.');
35  }
36
37  await ref.update({ verified: true });
38  await admin.auth().setCustomUserClaims(context.auth.uid, { emailVerified: true });
39
40  return { success: true };
41});