Noticed that too. The question is more of “why not wrap it in a transaction and have such scenarios covered?” Is there a reason other than simply “nobody felt a need to”?
As for requesting new token and instruction, there are two aspects that raise a bit of concern to my un-phoenix-trained eye too:
- said requesting does not seem to require any authorisation (like after authentication/logging-in first for example)
- upon requesting new token, all the previous ones remain stored in the database. Until the account is “confirmed” (removing of them is nicely transactional, BTW).
Doesn’t that (the latter especially) mean that even a third party can easily flood the database with tons of records, potentially leading to a DOS in an extreme case?
