From ae478713cf49d2dcaacc3cf10cd5d33eb4258237 Mon Sep 17 00:00:00 2001
From: Kaya Kayathiri <kayathirikaya33@gmail.com>
Date: Tue, 7 Jan 2025 20:08:32 +0530
Subject: [PATCH] Fix invalidating recovery code

---
 .../internal/service/impl/UserAccountRecoveryManager.java  | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/components/org.wso2.carbon.identity.recovery/src/main/java/org/wso2/carbon/identity/recovery/internal/service/impl/UserAccountRecoveryManager.java b/components/org.wso2.carbon.identity.recovery/src/main/java/org/wso2/carbon/identity/recovery/internal/service/impl/UserAccountRecoveryManager.java
index e9c5e32d8..70db65c81 100644
--- a/components/org.wso2.carbon.identity.recovery/src/main/java/org/wso2/carbon/identity/recovery/internal/service/impl/UserAccountRecoveryManager.java
+++ b/components/org.wso2.carbon.identity.recovery/src/main/java/org/wso2/carbon/identity/recovery/internal/service/impl/UserAccountRecoveryManager.java
@@ -172,8 +172,13 @@ public RecoveryChannelInfoDTO retrieveUsersRecoveryInformationForUsername(Map<St
                         user, recoveryScenario, RecoverySteps.RESEND_CONFIRMATION_CODE);
 
                 notificationChannelList = getNotificationChannelListForRecovery(notificationChannels);
-                recoveryCode = UUID.randomUUID().toString();
                 recoveryFlowId = UUID.randomUUID().toString();
+                // Skip recovery code generation for question based recovery as it is not required.
+                if (StringUtils.equals(QUESTION_BASED_PWD_RECOVERY.name(), recoveryScenario.name())) {
+                    return buildUserRecoveryInformationResponseDTO(username, recoveryFlowId, null,
+                            notificationChannelDTOS);
+                }
+                recoveryCode = UUID.randomUUID().toString();
 
                 if (Utils.reIssueExistingConfirmationCode(recoveryDataDO,
                         NotificationChannels.EMAIL_CHANNEL.getChannelType())) {