fixed verification code

api/server/go.mod

@@ -84,7 +84,7 @@ require (
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
-	github.com/klauspost/compress v1.18.3 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc v1.0.6 // indirect
@@ -136,7 +136,7 @@ require (
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/crypto v0.47.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.33.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
 )

api/server/go.sum

@@ -123,8 +123,8 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnV
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
-github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -332,8 +332,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=

api/server/interface/accountservice/internal/service.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"slices"
+	"time"
 	"unicode"
 
 	"github.com/tech/sendico/pkg/auth"
@@ -13,13 +14,12 @@ import (
 	"github.com/tech/sendico/pkg/db/account"
 	"github.com/tech/sendico/pkg/db/organization"
 	"github.com/tech/sendico/pkg/db/policy"
-	"github.com/tech/sendico/pkg/db/transaction"
+	"github.com/tech/sendico/pkg/db/verification"
 	"github.com/tech/sendico/pkg/merrors"
 	"github.com/tech/sendico/pkg/mlogger"
 	"github.com/tech/sendico/pkg/model"
 	"github.com/tech/sendico/pkg/mutil/mzap"
 	"github.com/tech/sendico/server/interface/middleware"
-	"github.com/tech/sendico/server/internal/mutil/flrstring"
 	"go.mongodb.org/mongo-driver/v2/bson"
 	"go.uber.org/zap"
 )
@@ -31,9 +31,9 @@ type service struct {
 	enforcer    auth.Enforcer
 	roleManager management.Role
 	config      *middleware.PasswordConfig
-	tf          transaction.Factory
 
 	policyDB policy.DB
+	vdb      verification.DB
 }
 
 func validateUserRequest(u *model.Account) error {
@@ -112,7 +112,6 @@ func (s *service) ValidateAccount(acct *model.Account) error {
 		return err
 	}
 
-	acct.VerifyToken = flrstring.CreateRandString(s.config.TokenLength)
 	return nil
 }
 
@@ -121,32 +120,50 @@ func (s *service) CreateAccount(
 	org *model.Organization,
 	acct *model.Account,
 	roleDescID bson.ObjectID,
-) error {
+) (string, error) {
 	if org == nil {
-		return merrors.InvalidArgument("Organization must not be nil")
+		return "", merrors.InvalidArgument("Organization must not be nil")
 	}
 	if acct == nil || len(acct.Login) == 0 {
-		return merrors.InvalidArgument("Account must have a non-empty login")
+		return "", merrors.InvalidArgument("Account must have a non-empty login")
 	}
 	if roleDescID == bson.NilObjectID {
-		return merrors.InvalidArgument("Role description must be provided")
+		return "", merrors.InvalidArgument("Role description must be provided")
 	}
+
 	// 1) Create the account
+	acct.Status = model.AccountPendingVerification
 	if err := s.accountDB.Create(ctx, acct); err != nil {
 		if errors.Is(err, merrors.ErrDataConflict) {
 			s.logger.Info("Username is already taken", zap.String("login", acct.Login))
 		} else {
 			s.logger.Warn("Failed to signup a user", zap.Error(err), zap.String("login", acct.Login))
 		}
-		return err
+		return "", err
 	}
 
 	// 2) Add to organization
 	if err := s.JoinOrganization(ctx, org, acct, roleDescID); err != nil {
 		s.logger.Warn("Failed to register new organization member", zap.Error(err), mzap.StorableRef(acct))
-		return err
+		return "", err
 	}
-	return nil
+
+	// 3) Issue verification token
+	return s.VerifyAccount(ctx, acct)
+}
+
+func (s *service) VerifyAccount(
+	ctx context.Context,
+	acct *model.Account,
+) (verificationToken string, err error) {
+	verificationToken, err = s.vdb.Create(ctx, *acct.GetID(), model.PurposeAccountActivation, "", time.Duration(time.Hour*24))
+	if err != nil {
+		s.logger.Warn("Failed to create verification token for new account", zap.Error(err), mzap.StorableRef(acct))
+		return "", err
+	}
+
+	return verificationToken, nil
+
 }
 
 func (s *service) DeleteAccount(
@@ -213,20 +230,16 @@ func (s *service) RemoveAccountFromOrganization(
 func (s *service) ResetPassword(
 	ctx context.Context,
 	acct *model.Account,
-) error {
-	acct.ResetPasswordToken = flrstring.CreateRandString(s.config.TokenLength)
-	return s.accountDB.Update(ctx, acct)
+) (string, error) {
+	return s.vdb.Create(ctx, *acct.GetID(), model.PurposePasswordReset, "", time.Duration(time.Hour*1))
 }
 
 func (s *service) UpdateLogin(
 	ctx context.Context,
 	acct *model.Account,
 	newLogin string,
-) error {
-	acct.EmailBackup = acct.Login
-	acct.Login = newLogin
-	acct.VerifyToken = flrstring.CreateRandString(s.config.TokenLength)
-	return s.accountDB.Update(ctx, acct)
+) (string, error) {
+	return s.vdb.Create(ctx, *acct.GetID(), model.PurposeEmailChange, newLogin, time.Duration(time.Hour*1))
 }
 
 func (s *service) JoinOrganization(
@@ -311,27 +324,19 @@ func (s *service) DeleteOrganization(
 	s.logger.Info("Starting organization deletion", mzap.StorableRef(org))
 
 	// Use transaction to ensure atomicity
-	_, err := s.tf.CreateTransaction().Execute(ctx, func(ctx context.Context) (any, error) {
-		// 8. Delete all roles and role descriptions in the organization
-		if err := s.deleteOrganizationRoles(ctx, org.ID); err != nil {
-			return nil, err
-		}
+	// 8. Delete all roles and role descriptions in the organization
+	if err := s.deleteOrganizationRoles(ctx, org.ID); err != nil {
+		return err
+	}
 
-		// 9. Delete all policies in the organization
-		if err := s.deleteOrganizationPolicies(ctx, org.ID); err != nil {
-			return nil, err
-		}
+	// 9. Delete all policies in the organization
+	if err := s.deleteOrganizationPolicies(ctx, org.ID); err != nil {
+		return err
+	}
 
-		// 10. Finally, delete the organization itself
-		if err := s.orgDB.Delete(ctx, bson.NilObjectID, org.ID); err != nil {
-			s.logger.Warn("Failed to delete organization", zap.Error(err), mzap.StorableRef(org))
-			return nil, err
-		}
-
-		return nil, nil
-	})
-	if err != nil {
-		s.logger.Error("Failed to delete organization", zap.Error(err), mzap.StorableRef(org))
+	// 10. Finally, delete the organization itself
+	if err := s.orgDB.Delete(ctx, bson.NilObjectID, org.ID); err != nil {
+		s.logger.Warn("Failed to delete organization", zap.Error(err), mzap.StorableRef(org))
 		return err
 	}
 
@@ -347,23 +352,14 @@ func (s *service) DeleteAll(
 	s.logger.Info("Starting complete deletion (organization + account)",
 		mzap.StorableRef(org), mzap.ObjRef("account_ref", accountRef))
 
-	// Use transaction to ensure atomicity
-	_, err := s.tf.CreateTransaction().Execute(ctx, func(ctx context.Context) (any, error) {
-		// 1. First delete the organization and all its data
-		if err := s.DeleteOrganization(ctx, org); err != nil {
-			return nil, err
-		}
+	// 1. First delete the organization and all its data
+	if err := s.DeleteOrganization(ctx, org); err != nil {
+		return err
+	}
 
-		// 2. Then delete the account
-		if err := s.accountDB.Delete(ctx, accountRef); err != nil {
-			s.logger.Warn("Failed to delete account", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
-			return nil, err
-		}
-
-		return nil, nil
-	})
-	if err != nil {
-		s.logger.Error("Failed to delete all data", zap.Error(err), mzap.StorableRef(org), mzap.ObjRef("account_ref", accountRef))
+	// 2. Then delete the account
+	if err := s.accountDB.Delete(ctx, accountRef); err != nil {
+		s.logger.Warn("Failed to delete account", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
 		return err
 	}
 
@@ -390,7 +386,6 @@ func NewAccountService(
 		enforcer:    enforcer,
 		roleManager: ra,
 		config:      config,
-		tf:          dbf.TransactionFactory(),
 	}
 	var err error
 	if res.accountDB, err = dbf.NewAccountDB(); err != nil {
@@ -407,6 +402,9 @@ func NewAccountService(
 		logger.Warn("Failed to create policies database", zap.Error(err))
 		return nil, err
 	}
-
+	if res.vdb, err = dbf.NewVerificationsDB(); err != nil {
+		logger.Warn("Failed to create verification database", zap.Error(err))
+		return nil, err
+	}
 	return res, nil
 }

api/server/interface/accountservice/internal/service_test.go

@@ -113,8 +113,6 @@ func TestValidateAccount(t *testing.T) {
 
 		// Password should be hashed after validation
 		assert.NotEqual(t, originalPassword, account.Password)
-		assert.NotEmpty(t, account.VerifyToken)
-		assert.Equal(t, config.TokenLength, len(account.VerifyToken))
 	})
 
 	t.Run("AccountMissingName", func(t *testing.T) {
@@ -245,54 +243,3 @@ func TestPasswordConfiguration(t *testing.T) {
 	})
 }
 
-// TestTokenGeneration verifies that verification tokens are generated with correct length
-func TestTokenGeneration(t *testing.T) {
-	testCases := []struct {
-		name        string
-		tokenLength int
-	}{
-		{"Short", 8},
-		{"Medium", 32},
-		{"Long", 64},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			config := &apiconfig.PasswordConfig{
-				Check: apiconfig.PasswordChecks{
-					MinLength: 8,
-					Digit:     true,
-					Upper:     true,
-					Lower:     true,
-					Special:   true,
-				},
-				TokenLength: tc.tokenLength,
-			}
-
-			logger := zap.NewNop() // Use no-op logger for tests
-			service := &service{
-				config: config,
-				logger: logger,
-			}
-
-			account := &model.Account{
-				AccountPublic: model.AccountPublic{
-					AccountBase: model.AccountBase{
-						Describable: model.Describable{
-							Name: "Test User",
-						},
-					},
-					UserDataBase: model.UserDataBase{
-						Login: "test@example.com",
-					},
-				},
-				Password: "TestPassword123!",
-			}
-
-			err := service.ValidateAccount(account)
-			require.NoError(t, err)
-
-			assert.Equal(t, tc.tokenLength, len(account.VerifyToken))
-		})
-	}
-}

api/server/interface/accountservice/types.go

@@ -35,7 +35,7 @@ type AccountService interface {
 	ResetPassword(
 		ctx context.Context,
 		acct *model.Account,
-	) error
+	) (verificationToken string, err error)
 
 	// CreateAccount will:
 	//   1) create the account
@@ -46,7 +46,12 @@ type AccountService interface {
 		org *model.Organization,
 		acct *model.Account,
 		roleDescID bson.ObjectID,
-	) error
+	) (verificationToken string, err error)
+
+	VerifyAccount(
+		ctx context.Context,
+		acct *model.Account,
+	) (verificationToken string, err error)
 
 	JoinOrganization(
 		ctx context.Context,
@@ -59,7 +64,7 @@ type AccountService interface {
 		ctx context.Context,
 		acct *model.Account,
 		newLogin string,
-	) error
+	) (verificationToken string, err error)
 
 	// DeleteAccount deletes the account and removes it from the org.
 	DeleteAccount(

api/server/internal/api/routers/public/login.go

@@ -33,7 +33,7 @@ func (pr *PublicRouter) logUserIn(ctx context.Context, _ *http.Request, req *sre
 		return response.Internal(pr.logger, pr.service, err)
 	}
 
-	if account.VerifyToken != "" {
+	if !account.IsActive() {
 		return response.Forbidden(pr.logger, pr.service, "account_not_verified", "Account verification required")
 	}
 

api/server/internal/server/accountapiimp/account.go

@@ -43,12 +43,8 @@ func (a *AccountAPI) getProfile(_ *http.Request, u *model.Account, token *srespo
 	return sresponse.Account(a.logger, u, token)
 }
 
-func (a *AccountAPI) reportTokenNotFound() http.HandlerFunc {
-	return response.NotFound(a.logger, a.Name(), "No account found associated with given verifcation token")
-}
-
-func (a *AccountAPI) sendWelcomeEmail(account *model.Account) error {
-	if err := a.producer.SendMessage(an.AccountCreated(a.Name(), *account.GetID())); err != nil {
+func (a *AccountAPI) sendWelcomeEmail(account *model.Account, token string) error {
+	if err := a.producer.SendMessage(an.AccountCreated(a.Name(), *account.GetID(), token)); err != nil {
 		a.logger.Warn("Failed to send account creation notification", zap.Error(err))
 		return err
 	}
@@ -63,27 +59,23 @@ func (a *AccountAPI) sendVerificationMail(r *http.Request, paramGetter func(ctx
 		return response.Internal(a.logger, a.Name(), err)
 	}
 
-	// Get the account
-	// accnt, err := a.db.GetByEmail(ctx, paramGetter(u))
-	// if err != nil || accnt == nil {
-	// 	a.logger.Warn("Failed to ger user from db with", zap.Error(err), mzap.StorableRef(u))
-	// 	return response.Internal(a.logger, a.Name(), err)
-	// }
-	accnt, err := paramGetter(r.Context(), a.db, u)
+	ctx := r.Context()
+	accnt, err := paramGetter(ctx, a.db, u)
 	if err != nil || accnt == nil {
 		a.logger.Warn("Failed to ger user from db with", zap.Error(err), mzap.StorableRef(u))
 		return response.Internal(a.logger, a.Name(), err)
 	}
 
-	if accnt.VerifyToken == "" {
-		a.logger.Debug("Verification token is empty", zap.Error(err), mzap.StorableRef(u))
-		return a.reportTokenNotFound()
+	token, err := a.accService.VerifyAccount(ctx, accnt)
+	if err != nil {
+		a.logger.Warn("Failed to create verification token for account", zap.Error(err), mzap.StorableRef(accnt))
+		return response.Internal(a.logger, a.Name(), err)
 	}
 
 	// Send welcome email
-	if err = a.sendWelcomeEmail(accnt); err != nil {
+	if err = a.sendWelcomeEmail(accnt, token); err != nil {
 		a.logger.Warn("Failed to send verification email",
-			zap.Error(err), mzap.StorableRef(u), zap.String("email", accnt.Login))
+			zap.Error(err), mzap.StorableRef(accnt), zap.String("email", accnt.Login))
 		return response.Internal(a.logger, a.Name(), err)
 	}
 	return response.Success(a.logger)

api/server/internal/server/accountapiimp/delete.go

@@ -1,6 +1,7 @@
 package accountapiimp
 
 import (
+	"context"
 	"errors"
 	"net/http"
 
@@ -108,8 +109,14 @@ func (a *AccountAPI) deleteAll(r *http.Request, account *model.Account, token *s
 	}
 
 	// Delete everything (organization + account)
-	if err := a.accService.DeleteAll(ctx, &org, account.ID); err != nil {
-		a.logger.Error("Failed to delete all data", zap.Error(err), mzap.StorableRef(&org), mzap.StorableRef(account))
+	if _, err := a.tf.CreateTransaction().Execute(ctx, func(c context.Context) (any, error) {
+		if err := a.accService.DeleteAll(c, &org, account.ID); err != nil {
+			a.logger.Warn("Failed to delete all data", zap.Error(err), mzap.StorableRef(&org), mzap.StorableRef(account))
+			return nil, err
+		}
+		return nil, nil
+	}); err != nil {
+		a.logger.Warn("Failed to execute delete transaction", zap.Error(err), mzap.StorableRef(&org), mzap.StorableRef(account))
 		return response.Auto(a.logger, a.Name(), err)
 	}
 

api/server/internal/server/accountapiimp/email.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/tech/sendico/pkg/api/http/response"
 	"github.com/tech/sendico/pkg/merrors"
+	"github.com/tech/sendico/pkg/model"
 	mutil "github.com/tech/sendico/server/internal/mutil/param"
 	"go.uber.org/zap"
 )
@@ -15,19 +16,30 @@ func (a *AccountAPI) verify(r *http.Request) http.HandlerFunc {
 	token := mutil.GetToken(r)
 	// Get user
 	ctx := r.Context()
-	user, err := a.db.GetByToken(ctx, token)
-	if errors.Is(err, merrors.ErrNoData) {
-		a.logger.Debug("Verification token not found", zap.Error(err))
-		return a.reportTokenNotFound()
-	}
+	// Delete verification token to confirm account
+	t, err := a.vdb.Consume(ctx, token)
 	if err != nil {
+		a.logger.Debug("Failed to consume verification token", zap.Error(err))
+		return a.mapTokenErrorToResponse(err)
+	}
+
+	if t.Purpose != model.PurposeAccountActivation {
+		a.logger.Warn("Invalid token purpose", zap.String("expected", string(model.PurposeAccountActivation)), zap.String("actual", string(t.Purpose)))
+		return response.DataConflict(a.logger, a.Name(), "Invalid token purpose")
+	}
+
+	var user model.Account
+	if err := a.db.Get(ctx, t.AccountRef, &user); err != nil {
+		if errors.Is(err, merrors.ErrNoData) {
+			a.logger.Debug("Verified user not found", zap.Error(err))
+			return response.NotFound(a.logger, a.Name(), "User not found")
+		}
 		a.logger.Warn("Failed to fetch account", zap.Error(err))
 		return response.Internal(a.logger, a.Name(), err)
 	}
 
-	// Delete verification token to confirm account
-	user.VerifyToken = ""
-	if err = a.db.Update(ctx, user); err != nil {
+	user.Status = model.AccountActive
+	if err = a.db.Update(ctx, &user); err != nil {
 		a.logger.Warn("Failed to save account while verifying account", zap.Error(err))
 		return response.Internal(a.logger, a.Name(), err)
 	}

api/server/internal/server/accountapiimp/empupdate.go

@@ -55,7 +55,8 @@ func (a *AccountAPI) updateEmployee(r *http.Request, account *model.Account, tok
 	}
 	if acc.Login != u.Login {
 		// Change email address
-		if err := a.accService.UpdateLogin(ctx, &acc, u.Login); err != nil {
+		verificationToken, err := a.accService.UpdateLogin(ctx, &acc, u.Login)
+		if err != nil {
 			if errors.Is(err, merrors.ErrDataConflict) {
 				a.logger.Debug("Duplicate login, denying change...", zap.Error(err), mzap.ObjRef("employee_ref", u.ID))
 				return a.reportDuplicateEmail()
@@ -65,7 +66,7 @@ func (a *AccountAPI) updateEmployee(r *http.Request, account *model.Account, tok
 		}
 
 		// Send verification email
-		if err = a.sendWelcomeEmail(&acc); err != nil {
+		if err = a.sendWelcomeEmail(&acc, verificationToken); err != nil {
 			a.logger.Warn("Failed to send verification email", zap.Error(err), mzap.StorableRef(&acc))
 			return response.Internal(a.logger, a.Name(), err)
 		}

api/server/internal/server/accountapiimp/password.go

@@ -84,13 +84,14 @@ func (a *AccountAPI) forgotPassword(r *http.Request) http.HandlerFunc {
 	}
 
 	// Generate reset password token
-	if err := a.accService.ResetPassword(ctx, user); err != nil {
+	verificationToken, err := a.accService.ResetPassword(ctx, user)
+	if err != nil {
 		a.logger.Warn("Failed to generate reset password token", zap.Error(err), mzap.StorableRef(user))
 		return response.Auto(a.logger, a.Name(), err)
 	}
 
 	// Send reset password email
-	if err = a.sendPasswordResetEmail(user, user.ResetPasswordToken); err != nil {
+	if err = a.sendPasswordResetEmail(user, verificationToken); err != nil {
 		a.logger.Warn("Failed to send reset password email", zap.Error(err), mzap.StorableRef(user))
 		return response.Auto(a.logger, a.Name(), err)
 	}
@@ -127,15 +128,20 @@ func (a *AccountAPI) resetPassword(r *http.Request) http.HandlerFunc {
 		return response.Auto(a.logger, a.Name(), err)
 	}
 
-	// Validate reset token
-	if user.ResetPasswordToken == "" {
-		a.logger.Debug("No reset token found for user", mzap.StorableRef(&user))
-		return response.BadRequest(a.logger, a.Name(), "no_reset_token", "No password reset token found for this user")
+	t, err := a.vdb.Consume(ctx, token)
+	if err != nil {
+		a.logger.Warn("Failed to consume password reset token", zap.Error(err), zap.String("token", token))
+		return a.mapTokenErrorToResponse(err)
 	}
 
-	if user.ResetPasswordToken != token {
-		a.logger.Debug("Reset token mismatch", mzap.StorableRef(&user))
-		return response.BadRequest(a.logger, a.Name(), "invalid_token", "Invalid or expired reset token")
+	if t.Purpose != model.PurposePasswordReset {
+		a.logger.Warn("Invalid token purpose for password reset", zap.String("expected", string(model.PurposePasswordReset)), zap.String("actual", string(t.Purpose)))
+		return response.DataConflict(a.logger, a.Name(), "Invalid token purpose")
+	}
+
+	if t.AccountRef != accountRef {
+		a.logger.Warn("Token account reference does not match request account reference", zap.String("token_account_ref", t.AccountRef.Hex()), zap.String("request_account_ref", accountRef.Hex()))
+		return response.DataConflict(a.logger, a.Name(), "Token does not match account")
 	}
 
 	// Parse new password from request body
@@ -145,11 +151,6 @@ func (a *AccountAPI) resetPassword(r *http.Request) http.HandlerFunc {
 		return response.BadPayload(a.logger, a.Name(), err)
 	}
 
-	if req.Password == "" {
-		a.logger.Debug("New password is empty")
-		return response.BadRequest(a.logger, a.Name(), "empty_password", "New password cannot be empty")
-	}
-
 	// Validate new password
 	if err := a.accService.ValidatePassword(req.Password, nil); err != nil {
 		a.logger.Debug("Password validation failed", zap.Error(err), mzap.StorableRef(&user))
@@ -172,7 +173,6 @@ func (a *AccountAPI) resetPassword(r *http.Request) http.HandlerFunc {
 func (a *AccountAPI) resetPasswordTransactionBody(ctx context.Context, user *model.Account, newPassword string) (any, error) {
 	// Update user with new password and clear reset token
 	user.Password = newPassword
-	user.ResetPasswordToken = "" // Clear the token after use
 
 	// Hash the new password
 	if err := user.HashPassword(); err != nil {

api/server/internal/server/accountapiimp/password_test.go

@@ -4,92 +4,9 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/tech/sendico/pkg/model"
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
-// TestPasswordResetTokenGeneration tests the token generation logic
-func TestPasswordResetTokenGeneration(t *testing.T) {
-	// Test that ResetPassword service method generates a token
-	account := &model.Account{
-		AccountPublic: model.AccountPublic{
-			AccountBase: model.AccountBase{
-				Describable: model.Describable{
-					Name: "Test User",
-				},
-			},
-			UserDataBase: model.UserDataBase{
-				Login: "test@example.com",
-			},
-		},
-	}
-
-	// Initially no reset token
-	assert.Empty(t, account.ResetPasswordToken, "Account should not have reset token initially")
-
-	// Simulate what ResetPassword service method does
-	account.ResetPasswordToken = "generated-token-123"
-	assert.NotEmpty(t, account.ResetPasswordToken, "Reset token should be generated")
-	assert.Equal(t, "generated-token-123", account.ResetPasswordToken, "Reset token should match generated value")
-}
-
-// TestPasswordResetTokenValidation tests token validation logic
-func TestPasswordResetTokenValidation(t *testing.T) {
-	tests := []struct {
-		name          string
-		storedToken   string
-		providedToken string
-		shouldBeValid bool
-	}{
-		{
-			name:          "ValidToken_ShouldMatch",
-			storedToken:   "valid-token-123",
-			providedToken: "valid-token-123",
-			shouldBeValid: true,
-		},
-		{
-			name:          "InvalidToken_ShouldNotMatch",
-			storedToken:   "valid-token-123",
-			providedToken: "invalid-token-456",
-			shouldBeValid: false,
-		},
-		{
-			name:          "EmptyStoredToken_ShouldBeInvalid",
-			storedToken:   "",
-			providedToken: "any-token",
-			shouldBeValid: false,
-		},
-		{
-			name:          "EmptyProvidedToken_ShouldBeInvalid",
-			storedToken:   "valid-token-123",
-			providedToken: "",
-			shouldBeValid: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			account := &model.Account{
-				AccountPublic: model.AccountPublic{
-					AccountBase: model.AccountBase{
-						Describable: model.Describable{
-							Name: "Test User",
-						},
-					},
-					UserDataBase: model.UserDataBase{
-						Login: "test@example.com",
-					},
-				},
-				ResetPasswordToken: tt.storedToken,
-			}
-
-			// Test token validation logic (what the resetPassword handler does)
-			isValid := account.ResetPasswordToken != "" && account.ResetPasswordToken == tt.providedToken
-			assert.Equal(t, tt.shouldBeValid, isValid, "Token validation should match expected result")
-		})
-	}
-}
-
 // TestPasswordResetFlowLogic tests the logical flow without database dependencies
 func TestPasswordResetFlowLogic(t *testing.T) {
 	t.Run("CompleteFlow", func(t *testing.T) {

api/server/internal/server/accountapiimp/service.go

@@ -15,6 +15,7 @@ import (
 	"github.com/tech/sendico/pkg/db/policy"
 	"github.com/tech/sendico/pkg/db/refreshtokens"
 	"github.com/tech/sendico/pkg/db/transaction"
+	"github.com/tech/sendico/pkg/db/verification"
 	"github.com/tech/sendico/pkg/domainprovider"
 	"github.com/tech/sendico/pkg/merrors"
 	"github.com/tech/sendico/pkg/messaging"
@@ -36,6 +37,7 @@ type AccountAPI struct {
 	tf                    transaction.Factory
 	rtdb                  refreshtokens.DB
 	plcdb                 policy.DB
+	vdb                   verification.DB
 	domain                domainprovider.DomainProvider
 	avatars               mservice.MicroService
 	producer              messaging.Producer
@@ -91,6 +93,10 @@ func CreateAPI(a eapi.API) (*AccountAPI, error) {
 		p.logger.Error("Failed to create policies database", zap.Error(err))
 		return nil, err
 	}
+	if p.vdb, err = a.DBFactory().NewVerificationsDB(); err != nil {
+		p.logger.Error("Failed to create verification database", zap.Error(err))
+		return nil, err
+	}
 
 	p.domain = a.DomainProvider()
 	p.producer = a.Register().Messaging().Producer()

api/server/internal/server/accountapiimp/signup.go

@@ -91,7 +91,8 @@ func (a *AccountAPI) signup(r *http.Request) http.HandlerFunc {
 		return response.BadPayload(a.logger, a.Name(), res)
 	}
 
-	if err := a.executeSignupTransaction(r.Context(), &sr, newAccount); err != nil {
+	verificationToken, err := a.executeSignupTransaction(r.Context(), &sr, newAccount)
+	if err != nil {
 		if errors.Is(err, merrors.ErrDataConflict) {
 			a.logger.Warn("Failed to register account", zap.Error(err), zap.String("login", newAccount.Login))
 			return response.DataConflict(a.logger, "user_already_registered", "User has already been registered")
@@ -100,7 +101,7 @@ func (a *AccountAPI) signup(r *http.Request) http.HandlerFunc {
 		return response.Internal(a.logger, a.Name(), err)
 	}
 
-	if err := a.sendWelcomeEmail(newAccount); err != nil {
+	if err := a.sendWelcomeEmail(newAccount, verificationToken); err != nil {
 		a.logger.Warn("Failed to send welcome email", zap.Error(err), mzap.StorableRef(newAccount))
 	}
 
@@ -127,11 +128,14 @@ func (a *AccountAPI) signupAvailability(r *http.Request) http.HandlerFunc {
 	}
 }
 
-func (a *AccountAPI) executeSignupTransaction(ctxt context.Context, sr *srequest.Signup, newAccount *model.Account) error {
-	_, err := a.tf.CreateTransaction().Execute(ctxt, func(ctx context.Context) (any, error) {
+func (a *AccountAPI) executeSignupTransaction(ctxt context.Context, sr *srequest.Signup, newAccount *model.Account) (string, error) {
+	res, err := a.tf.CreateTransaction().Execute(ctxt, func(ctx context.Context) (any, error) {
 		return a.signupTransactionBody(ctx, sr, newAccount)
 	})
-	return err
+	if token, ok := res.(string); token != "" || ok {
+		return token, err
+	}
+	return "", err
 }
 
 func (a *AccountAPI) signupTransactionBody(ctx context.Context, sr *srequest.Signup, newAccount *model.Account) (any, error) {
@@ -165,13 +169,14 @@ func (a *AccountAPI) signupTransactionBody(ctx context.Context, sr *srequest.Sig
 	}
 	a.logger.Info("Organization owner role permissions granted", mzap.StorableRef(org), zap.String("account", sr.Account.Login))
 
-	if err := a.accService.CreateAccount(ctx, org, newAccount, roleDescription.ID); err != nil {
+	token, err := a.accService.CreateAccount(ctx, org, newAccount, roleDescription.ID)
+	if err != nil {
 		a.logger.Warn("Failed to create account", zap.Error(err), zap.String("login", newAccount.Login))
 		return nil, err
 	}
 	a.logger.Info("Organization owner account registered", mzap.StorableRef(org), zap.String("account", sr.Account.Login))
 
-	return nil, nil
+	return token, nil
 }
 
 func (a *AccountAPI) grantAllPermissions(ctx context.Context, organizationRef bson.ObjectID, roleID bson.ObjectID, newAccount *model.Account) error {

api/server/internal/server/accountapiimp/token.go

@@ -0,0 +1,31 @@
+package accountapiimp
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/tech/sendico/pkg/api/http/response"
+	"github.com/tech/sendico/pkg/db/verification"
+	"go.uber.org/zap"
+)
+
+func (a *AccountAPI) mapTokenErrorToResponse(err error) http.HandlerFunc {
+	if errors.Is(err, verification.ErrTokenNotFound) {
+		a.logger.Debug("Verification token not found during consume", zap.Error(err))
+		return response.NotFound(a.logger, a.Name(), "No account found associated with given verifcation token")
+	}
+	if errors.Is(err, verification.ErrTokenExpired) {
+		a.logger.Debug("Verification token expired during consume", zap.Error(err))
+		return response.Gone(a.logger, a.Name(), "token_expired", "verification token has expired")
+	}
+	if errors.Is(err, verification.ErrTokenAlreadyUsed) {
+		a.logger.Debug("Verification token already used during consume", zap.Error(err))
+		return response.DataConflict(a.logger, a.Name(), "verification token has already been used")
+	}
+	if err != nil {
+		a.logger.Warn("Uenxpected error during token verification", zap.Error(err))
+		return response.Auto(a.logger, a.Name(), err)
+	}
+	a.logger.Debug("No token verification error found")
+	return response.Success(a.logger)
+}

api/server/internal/server/accountapiimp/update.go

@@ -31,7 +31,8 @@ func (a *AccountAPI) updateProfile(r *http.Request, account *model.Account, toke
 
 	if account.Login != u.Login {
 		// Change email address
-		if err := a.accService.UpdateLogin(ctx, account, u.Login); err != nil {
+		verificationToken, err := a.accService.UpdateLogin(ctx, account, u.Login)
+		if err != nil {
 			if errors.Is(err, merrors.ErrDataConflict) {
 				a.logger.Debug("Duplicate login, denying change...", zap.Error(err), mzap.StorableRef(u))
 				return a.reportDuplicateEmail()
@@ -41,7 +42,7 @@ func (a *AccountAPI) updateProfile(r *http.Request, account *model.Account, toke
 		}
 
 		// Send verification email
-		if err = a.sendWelcomeEmail(account); err != nil {
+		if err = a.sendWelcomeEmail(account, verificationToken); err != nil {
 			a.logger.Warn("Failed to send verification email", zap.Error(err), mzap.StorableRef(account))
 			return response.Internal(a.logger, a.Name(), err)
 		}
@@ -49,8 +50,7 @@ func (a *AccountAPI) updateProfile(r *http.Request, account *model.Account, toke
 	} else {
 		// Save the user
 		u.Password = account.Password
-		u.ResetPasswordToken = account.ResetPasswordToken
-		u.VerifyToken = account.VerifyToken
+		u.Status = account.Status
 		if err = a.db.Update(ctx, u); err != nil {
 			a.logger.Warn("Failed to save account", zap.Error(err), mzap.StorableRef(u))
 			return response.Internal(a.logger, a.Name(), err)

api/server/internal/server/invitationimp/accept.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/tech/sendico/pkg/api/http/response"
 	"github.com/tech/sendico/pkg/merrors"
+	an "github.com/tech/sendico/pkg/messaging/notifications/account"
 	"github.com/tech/sendico/pkg/model"
 	"github.com/tech/sendico/pkg/mutil/mzap"
 	"github.com/tech/sendico/server/interface/api/srequest"
@@ -38,6 +39,14 @@ func (a *InvitationAPI) doAccept(ctx context.Context, invitationRef bson.ObjectI
 	return nil
 }
 
+func (a *InvitationAPI) sendWelcomeEmail(account *model.Account, token string) error {
+	if err := a.producer.SendMessage(an.AccountCreated(a.Name(), *account.GetID(), token)); err != nil {
+		a.Logger.Warn("Failed to send account creation notification", zap.Error(err))
+		return err
+	}
+	return nil
+}
+
 func (a *InvitationAPI) getPendingInvitation(ctx context.Context, invitationRef bson.ObjectID) (*model.Invitation, error) {
 	a.Logger.Debug("Fetching invitation", mzap.ObjRef("invitation_ref", invitationRef))
 	var inv model.Invitation
@@ -79,10 +88,17 @@ func (a *InvitationAPI) fetchOrCreateAccount(ctx context.Context, org *model.Org
 			return nil, err
 		}
 		// creates account and joins organization
-		if err := a.accService.CreateAccount(ctx, org, account, inv.RoleRef); err != nil {
+		token, err := a.accService.CreateAccount(ctx, org, account, inv.RoleRef)
+		if err != nil {
 			a.Logger.Warn("Failed to create account", zap.Error(err), zap.String("email", inv.Content.Email))
 			return nil, err
 		}
+		// Send welcome email
+		if err = a.sendWelcomeEmail(account, token); err != nil {
+			a.Logger.Warn("Failed to send welcome email for new account created via invitation",
+				zap.Error(err), zap.String("email", inv.Content.Email))
+			return nil, err
+		}
 		return account, nil
 	} else if err != nil {
 		a.Logger.Warn("Failed to fetch account by email", zap.Error(err), zap.String("email", inv.Content.Email))

api/server/internal/server/invitationimp/service.go

@@ -8,6 +8,7 @@ import (
 	"github.com/tech/sendico/pkg/db/invitation"
 	"github.com/tech/sendico/pkg/db/organization"
 	"github.com/tech/sendico/pkg/db/transaction"
+	"github.com/tech/sendico/pkg/messaging"
 	"github.com/tech/sendico/pkg/model"
 	"github.com/tech/sendico/pkg/mservice"
 	"github.com/tech/sendico/server/interface/accountservice"
@@ -25,6 +26,7 @@ type InvitationAPI struct {
 	adb        account.DB
 	odb        organization.DB
 	accService accountservice.AccountService
+	producer   messaging.Producer
 }
 
 func (a *InvitationAPI) Name() mservice.Type {
@@ -41,8 +43,9 @@ func CreateAPI(a eapi.API) (*InvitationAPI, error) {
 	}
 
 	res := &InvitationAPI{
-		irh: mutil.CreatePH("invitation"),
-		tf:  a.DBFactory().TransactionFactory(),
+		irh:      mutil.CreatePH("invitation"),
+		tf:       a.DBFactory().TransactionFactory(),
+		producer: a.Register().Messaging().Producer(),
 	}
 
 	p, err := papitemplate.CreateAPI(a, dbFactory, mservice.Organizations, mservice.Invitations)