From a4d11e169fb8130fdd099533c801f90f9be053d3 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Fri, 12 Dec 2025 07:45:23 +0100
Subject: [PATCH] Replace custom code generator with Base32

---
 app/models/magic_link/code.rb       | 15 +++++++--------
 test/models/magic_link/code_test.rb |  2 +-
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/app/models/magic_link/code.rb b/app/models/magic_link/code.rb
index 2bcc0c4e6..0a7d97e59 100644
--- a/app/models/magic_link/code.rb
+++ b/app/models/magic_link/code.rb
@@ -1,18 +1,17 @@
 module MagicLink::Code
-  CODE_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ".chars.freeze
   CODE_SUBSTITUTIONS = { "O" => "0", "I" => "1", "L" => "1" }.freeze
 
   class << self
     def generate(length)
-      Array.new(length) { CODE_ALPHABET[SecureRandom.random_number(CODE_ALPHABET.length)] }.join
+      SecureRandom.base32(length)
     end
 
     def sanitize(code)
-      return nil if code.blank?
-
-      normalize_code(code)
-        .then { apply_substitutions(_1) }
-        .then { remove_invalid_characters(_1) }
+      if code.present?
+        normalize_code(code)
+          .then { apply_substitutions(it) }
+          .then { remove_invalid_characters(it) }
+      end
     end
 
     private
@@ -25,7 +24,7 @@ module MagicLink::Code
       end
 
       def remove_invalid_characters(code)
-        code.gsub(/[^#{CODE_ALPHABET.join}]/, "")
+        code.gsub(/[^#{SecureRandom::BASE32_ALPHABET.join}]/, "")
       end
   end
 end
diff --git a/test/models/magic_link/code_test.rb b/test/models/magic_link/code_test.rb
index 685f26d69..2382b5494 100644
--- a/test/models/magic_link/code_test.rb
+++ b/test/models/magic_link/code_test.rb
@@ -5,7 +5,7 @@ class MagicLink::CodeTest < ActiveSupport::TestCase
     code = MagicLink::Code.generate(6)
 
     assert_equal 6, code.length
-    assert_match(/\A[#{MagicLink::Code::CODE_ALPHABET.join}]+\z/, code)
+    assert_match(/\A[#{SecureRandom::BASE32_ALPHABET.join}]+\z/, code)
   end
 
   test "sanitize" do