Email Verification

User registers  -->  Verification email sent  -->  User submits code  -->  Email verified
                     (6-digit code, 30min TTL)     POST /verify-email      emailVerified=true

curl -X POST http://localhost:8081/api/v1/auth/verify-email \
  -H "Content-Type: application/json" \
  -d '{
    "email": "newuser@example.com",
    "code": "482917"
  }'

curl -X POST http://localhost:8081/api/v1/auth/resend-verification \
  -H "Content-Type: application/json" \
  -d '{
    "email": "newuser@example.com"
  }'

public void sendVerificationEmail(User user) {
    // Invalidate any existing tokens
    emailVerificationTokenRepository.invalidateAllForUser(user.getId(), Instant.now());
 
    // Create new verification token (30-minute validity)
    EmailVerificationToken token = EmailVerificationToken.createForUser(
        user, EMAIL_VERIFICATION_VALIDITY_MINUTES);
    emailVerificationTokenRepository.save(token);
 
    // Send via Notification Service
    notificationServiceClient.sendEmailWithTemplate(
        user.getTenantId(),
        null,
        user.getEmail(),
        "email-verification",
        Map.of(
            "userName", user.getFirstName() != null ? user.getFirstName() : "User",
            "verificationCode", token.getToken(),
            "validityMinutes", EMAIL_VERIFICATION_VALIDITY_MINUTES,
            "verificationUrl", "https://app.matih.ai/verify-email?code=" + token.getToken()
        )
    );
}

@Transactional
public void verifyEmail(VerifyEmailRequest request) {
    User user = userRepository.findByEmail(request.getEmail())
        .orElseThrow(() -> new BusinessException("User not found"));
 
    if (user.isEmailVerified()) {
        return;  // Already verified - idempotent
    }
 
    EmailVerificationToken token = emailVerificationTokenRepository
        .findValidTokenByCodeAndEmail(request.getCode(), request.getEmail(), Instant.now())
        .orElseThrow(() -> new BusinessException("Invalid or expired verification code"));
 
    if (token.tooManyAttempts()) {
        throw new BusinessException(
            "Too many failed attempts. Please request a new verification code.");
    }
 
    if (!token.getToken().equals(request.getCode())) {
        token.incrementAttempts();
        emailVerificationTokenRepository.save(token);
        throw new BusinessException("Invalid verification code");
    }
 
    // Mark token as used
    token.markAsUsed();
    emailVerificationTokenRepository.save(token);
 
    // Mark user email as verified
    user.setEmailVerified(true);
    userRepository.save(user);
}