fixed verificatoin

api/pkg/db/internal/mongo/verificationimp/create.go

@@ -11,6 +11,7 @@ import (
 	"github.com/tech/sendico/pkg/db/verification"
 	"github.com/tech/sendico/pkg/merrors"
 	"github.com/tech/sendico/pkg/model"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func normalizedIdempotencyKey(value *string) (string, bool) {
@@ -24,6 +25,10 @@ func normalizedIdempotencyKey(value *string) (string, bool) {
 	return key, true
 }
 
+func syntheticIdempotencyKey() string {
+	return "auto:" + bson.NewObjectID().Hex()
+}
+
 func idempotencyFilter(
 	request *verification.Request,
 	idempotencyKey string,
@@ -119,6 +124,13 @@ func (db *verificationDB) Create(
 	}
 
 	idempotencyKey, hasIdempotency := normalizedIdempotencyKey(request.IdempotencyKey)
+	if !hasIdempotency {
+		// Legacy deployments may still enforce uniqueness on (accountRef, purpose, target, idempotencyKey),
+		// where missing idempotency key behaves like a shared null key. Assign an internal per-request key
+		// so token reissue works even when callers do not provide idempotency explicitly.
+		idempotencyKey = syntheticIdempotencyKey()
+		hasIdempotency = true
+	}
 
 	token, raw, err := newVerificationToken(request, idempotencyKey, hasIdempotency)
 	if err != nil {