Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/edge/product/interface/accountservice/internal/join_organization_test.go

@@ -0,0 +1,119 @@
+package accountserviceimp
+
+import (
+	"context"
+	"testing"
+
+	"git.sendico.io/tech/sxchnge/bff/edge/shared/storage/organization"
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.uber.org/zap"
+)
+
+// fakeMembershipOrgDB answers membership from its own state, standing in for
+// the transaction-scoped reads a real repository would serve.
+type fakeMembershipOrgDB struct {
+	organization.DB
+	member         bool
+	isMemberCalls  int
+	addMemberCalls int
+	addedMember    bson.ObjectID
+}
+
+func (db *fakeMembershipOrgDB) IsMember(_ context.Context, _, _ bson.ObjectID) (bool, error) {
+	db.isMemberCalls++
+	return db.member, nil
+}
+
+func (db *fakeMembershipOrgDB) AddMember(_ context.Context, _, accountRef bson.ObjectID) (bool, error) {
+	db.addMemberCalls++
+	db.addedMember = accountRef
+	db.member = true
+	return true, nil
+}
+
+type recordingRoleManager struct {
+	assigned []*model.Role
+}
+
+func (m *recordingRoleManager) Create(_ context.Context, orgRef bson.ObjectID, _ *model.Describable) (*model.RoleDescription, error) {
+	description := &model.RoleDescription{}
+	description.SetID(bson.NewObjectID())
+	description.OrganizationRef = orgRef
+	return description, nil
+}
+
+func (m *recordingRoleManager) Delete(_ context.Context, _ bson.ObjectID) error { return nil }
+
+func (m *recordingRoleManager) Assign(_ context.Context, role *model.Role) error {
+	m.assigned = append(m.assigned, role)
+	return nil
+}
+
+func (m *recordingRoleManager) Revoke(_ context.Context, _, _, _ bson.ObjectID) error { return nil }
+
+func (m *recordingRoleManager) List(_ context.Context, _ bson.ObjectID) ([]model.RoleDescription, error) {
+	return nil, nil
+}
+
+func joinTestService(orgDB *fakeMembershipOrgDB, roles *recordingRoleManager) *service {
+	return &service{
+		logger:      zap.NewNop(),
+		orgDB:       orgDB,
+		roleManager: roles,
+	}
+}
+
+func joinTestOrganization(members ...bson.ObjectID) *model.Organization {
+	org := &model.Organization{Members: members}
+	org.SetID(bson.NewObjectID())
+	return org
+}
+
+func joinTestAccount() *model.Account {
+	account := &model.Account{}
+	account.SetID(bson.NewObjectID())
+	return account
+}
+
+// A transaction replay rolls back the database but leaves marks on the shared
+// in-memory organization. Membership decisions must come from the database,
+// otherwise the replay skips the role assignment and the membership write and
+// commits an organization without its owner.
+func TestJoinOrganizationDecidesMembershipByDatabase(t *testing.T) {
+	account := joinTestAccount()
+	// The in-memory list already carries the account: exactly the state a
+	// first, aborted transaction attempt leaves behind.
+	org := joinTestOrganization(account.ID)
+	orgDB := &fakeMembershipOrgDB{member: false}
+	roles := &recordingRoleManager{}
+	svc := joinTestService(orgDB, roles)
+
+	if err := svc.JoinOrganization(context.Background(), org, account, bson.NewObjectID()); err != nil {
+		t.Fatalf("join failed: %v", err)
+	}
+	if len(roles.assigned) != 1 {
+		t.Fatalf("role assignment mismatch: got=%d want=1", len(roles.assigned))
+	}
+	if orgDB.addMemberCalls != 1 || orgDB.addedMember != account.ID {
+		t.Fatalf("membership write mismatch: calls=%d member=%s", orgDB.addMemberCalls, orgDB.addedMember.Hex())
+	}
+	if len(org.Members) != 1 {
+		t.Fatalf("in-memory members must stay deduplicated: got=%v", org.Members)
+	}
+}
+
+func TestJoinOrganizationSkipsExistingMember(t *testing.T) {
+	account := joinTestAccount()
+	org := joinTestOrganization()
+	orgDB := &fakeMembershipOrgDB{member: true}
+	roles := &recordingRoleManager{}
+	svc := joinTestService(orgDB, roles)
+
+	if err := svc.JoinOrganization(context.Background(), org, account, bson.NewObjectID()); err != nil {
+		t.Fatalf("join failed: %v", err)
+	}
+	if len(roles.assigned) != 0 || orgDB.addMemberCalls != 0 {
+		t.Fatalf("an existing member must not be re-joined: roles=%d adds=%d", len(roles.assigned), orgDB.addMemberCalls)
+	}
+}

backend/edge/product/interface/accountservice/internal/service.go

@@ -0,0 +1,450 @@
+package accountserviceimp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"time"
+	"unicode"
+
+	"git.sendico.io/tech/sxchnge/bff/edge/shared/interface/middleware"
+	edgestorage "git.sendico.io/tech/sxchnge/bff/edge/shared/storage/mongo"
+	"git.sendico.io/tech/sxchnge/bff/edge/shared/storage/organization"
+	"git.sendico.io/tech/sxchnge/bff/edge/shared/storage/verification"
+	"git.sendico.io/tech/sxchnge/bff/pkg/auth"
+	"git.sendico.io/tech/sxchnge/bff/pkg/auth/management"
+	"git.sendico.io/tech/sxchnge/bff/pkg/db"
+	"git.sendico.io/tech/sxchnge/bff/pkg/db/account"
+	"git.sendico.io/tech/sxchnge/bff/pkg/db/policy"
+	"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
+	"git.sendico.io/tech/sxchnge/bff/pkg/mlogger"
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"git.sendico.io/tech/sxchnge/bff/pkg/mutil/mzap"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.uber.org/zap"
+)
+
+type service struct {
+	logger      mlogger.Logger
+	accountDB   account.DB
+	orgDB       organization.DB
+	enforcer    auth.Enforcer
+	roleManager management.Role
+	config      *middleware.PasswordConfig
+
+	policyDB policy.DB
+	vdb      verification.DB
+}
+
+func validateUserRequest(u *model.Account) error {
+	if u.Name == "" {
+		return merrors.InvalidArgument("Name must not be empty")
+	}
+	if u.Login == "" {
+		return merrors.InvalidArgument("Login must not be empty")
+	}
+	if u.Password == "" {
+		return merrors.InvalidArgument("Password must not be empty")
+	}
+	return nil
+}
+
+func (s *service) ValidatePassword(
+	password string,
+	oldPassword *string,
+) error {
+	var hasDigit, hasUpper, hasLower, hasSpecial bool
+
+	if oldPassword != nil {
+		if *oldPassword == password {
+			return merrors.InvalidArgument("New password cannot be the same as the old password")
+		}
+	}
+
+	if len(password) < s.config.Check.MinLength {
+		return merrors.InvalidArgument(fmt.Sprintf("Password must be at least %d characters long", s.config.Check.MinLength))
+	}
+
+	// Check for digit, uppercase, lowercase, and special character
+	for _, char := range password {
+		switch {
+		case unicode.IsDigit(char):
+			hasDigit = true
+		case unicode.IsUpper(char):
+			hasUpper = true
+		case unicode.IsLower(char):
+			hasLower = true
+		case unicode.IsPunct(char) || unicode.IsSymbol(char):
+			hasSpecial = true
+		}
+	}
+
+	if s.config.Check.Digit && !hasDigit {
+		return merrors.InvalidArgument("Password must contain at least one digit")
+	}
+	if s.config.Check.Upper && !hasUpper {
+		return merrors.InvalidArgument("Password must contain at least one uppercase letter")
+	}
+	if s.config.Check.Lower && !hasLower {
+		return merrors.InvalidArgument("Password must contain at least one lowercase letter")
+	}
+	if s.config.Check.Special && !hasSpecial {
+		return merrors.InvalidArgument("Password must contain at least one special character")
+	}
+
+	// If all checks pass, return nil (no error)
+	return nil
+}
+
+func (s *service) ValidateAccount(acct *model.Account) error {
+	if err := validateUserRequest(acct); err != nil {
+		s.logger.Warn("Invalid signup acccount received", zap.Error(err), zap.String("account", acct.Login))
+		return err
+	}
+
+	if err := s.ValidatePassword(acct.Password, nil); err != nil {
+		s.logger.Warn("Password validation failed", zap.Error(err), zap.String("account", acct.Login))
+		return err
+	}
+
+	if err := acct.HashPassword(); err != nil {
+		s.logger.Warn("Failed to hash password", zap.Error(err), zap.String("account", acct.Login))
+		return err
+	}
+
+	return nil
+}
+
+func (s *service) CreateAccount(
+	ctx context.Context,
+	org *model.Organization,
+	acct *model.Account,
+	roleDescID bson.ObjectID,
+) (string, error) {
+	if org == nil {
+		return "", merrors.InvalidArgument("Organization must not be nil")
+	}
+	if acct == nil || len(acct.Login) == 0 {
+		return "", merrors.InvalidArgument("Account must have a non-empty login")
+	}
+	if roleDescID == bson.NilObjectID {
+		return "", merrors.InvalidArgument("Role description must be provided")
+	}
+
+	// 1) Create the account
+	acct.Status = model.AccountPendingVerification
+	if err := s.accountDB.Create(ctx, acct); err != nil {
+		if errors.Is(err, merrors.ErrDataConflict) {
+			s.logger.Info("Username is already taken", zap.String("login", acct.Login))
+		} else {
+			s.logger.Warn("Failed to signup a user", zap.Error(err), zap.String("login", acct.Login))
+		}
+		return "", err
+	}
+
+	// 2) Add to organization
+	if err := s.JoinOrganization(ctx, org, acct, roleDescID); err != nil {
+		s.logger.Warn("Failed to register new organization member", zap.Error(err), mzap.StorableRef(acct))
+		return "", err
+	}
+
+	// 3) Issue verification token
+	return s.VerifyAccount(ctx, acct)
+}
+
+func (s *service) VerifyAccount(
+	ctx context.Context,
+	acct *model.Account,
+) (string, error) {
+	token, err := s.vdb.Create(
+		ctx,
+		verification.NewLinkRequest(*acct.GetID(), model.PurposeAccountActivation, "").
+			WithTTL(time.Hour*24),
+	)
+	if err != nil {
+		s.logger.Warn("Failed to create verification token for new account", zap.Error(err), mzap.StorableRef(acct))
+		return "", err
+	}
+
+	return token, nil
+
+}
+
+func (s *service) DeleteAccount(
+	ctx context.Context,
+	org *model.Organization,
+	accountRef bson.ObjectID,
+) error {
+	// Check if this is the only member in the organization
+	if len(org.Members) <= 1 {
+		s.logger.Warn("Cannot delete account - it's the only member in the organization",
+			mzap.AccRef(accountRef), mzap.StorableRef(org))
+		return merrors.InvalidArgument("Cannot delete the only member of an organization")
+	}
+
+	// 1) Remove from organization
+	if err := s.RemoveAccountFromOrganization(ctx, org, accountRef); err != nil {
+		s.logger.Warn("Failed to revoke account role", zap.Error(err), mzap.AccRef(accountRef))
+		return err
+	}
+
+	// 2) Delete the account document
+	if err := s.accountDB.Delete(ctx, accountRef); err != nil {
+		s.logger.Warn("Failed to delete account", zap.Error(err), mzap.AccRef(accountRef))
+		return err
+	}
+	return nil
+}
+
+func (s *service) RemoveAccountFromOrganization(
+	ctx context.Context,
+	org *model.Organization,
+	accountRef bson.ObjectID,
+) error {
+	if org == nil {
+		return merrors.InvalidArgument("Organization must not be nil")
+	}
+	roles, err := s.enforcer.GetRoles(ctx, accountRef, org.ID)
+	if err != nil {
+		s.logger.Warn("Failed to fetch account permissions", zap.Error(err), mzap.StorableRef(org),
+			mzap.AccRef(accountRef))
+		return err
+	}
+	for _, role := range roles {
+		if err := s.roleManager.Revoke(ctx, role.DescriptionRef, accountRef, org.ID); err != nil {
+			s.logger.Warn("Failed to revoke account role", zap.Error(err),
+				mzap.AccRef(accountRef), mzap.ObjRef("role_ref", role.DescriptionRef))
+			return err
+		}
+	}
+	for i, member := range org.Members {
+		if member == accountRef {
+			// Remove the member by slicing it out
+			org.Members = append(org.Members[:i], org.Members[i+1:]...)
+			if err := s.orgDB.Update(ctx, accountRef, org); err != nil {
+				s.logger.Warn("Failed to remove member from organization", zap.Error(err), mzap.AccRef(accountRef))
+				return err
+			}
+			break
+		}
+	}
+	return nil
+}
+
+func (s *service) ResetPassword(
+	ctx context.Context,
+	acct *model.Account,
+) (string, error) {
+	return s.vdb.Create(
+		ctx,
+		verification.NewOTPRequest(*acct.GetID(), model.PurposePasswordReset, "").
+			WithTTL(time.Hour),
+	)
+}
+
+func (s *service) UpdateLogin(
+	ctx context.Context,
+	acct *model.Account,
+	newLogin string,
+) (string, error) {
+	return s.vdb.Create(
+		ctx,
+		verification.NewOTPRequest(*acct.GetID(), model.PurposeEmailChange, newLogin).
+			WithTTL(time.Hour),
+	)
+}
+
+func (s *service) JoinOrganization(
+	ctx context.Context,
+	org *model.Organization,
+	account *model.Account,
+	roleDescID bson.ObjectID,
+) error {
+	// Membership is decided by the database, not the in-memory copy: this method
+	// runs inside provisioning transactions whose retries replay the callback,
+	// and a stale in-memory list would silently skip the role assignment.
+	member, err := s.orgDB.IsMember(ctx, org.ID, account.ID)
+	if err != nil {
+		return err
+	}
+	if member {
+		s.logger.Debug("Account is already a member", mzap.StorableRef(org), mzap.StorableRef(account))
+		return nil
+	}
+
+	role := &model.Role{
+		DescriptionRef:  roleDescID,
+		OrganizationRef: org.ID,
+		AccountRef:      account.ID,
+	}
+	if err := s.roleManager.Assign(ctx, role); err != nil {
+		s.logger.Warn("Failed to assign role to account", zap.Error(err), mzap.StorableRef(account),
+			mzap.StorableRef(org), mzap.ObjRef("role_description_ref", roleDescID))
+		return err
+	}
+
+	// A point patch on purpose: replacing the whole document would clobber
+	// concurrent writes, most notably the provisioning lease that guards
+	// finalization against attempts whose lease was taken over.
+	if _, err := s.orgDB.AddMember(ctx, org.ID, account.ID); err != nil {
+		s.logger.Warn("Failed to update organization members list",
+			zap.Error(err), mzap.StorableRef(account), mzap.StorableRef(org))
+		return err
+	}
+	if !slices.Contains(org.Members, account.ID) {
+		org.Members = append(org.Members, account.ID)
+	}
+	return nil
+}
+
+func (s *service) deleteOrganizationRoles(ctx context.Context, orgRef bson.ObjectID) error {
+	return s.deleteOrganizationEntities(ctx, orgRef, "roles", "role", "role_ref", func(ctx context.Context, orgRef bson.ObjectID) ([]bson.ObjectID, error) {
+		roles, err := s.roleManager.List(ctx, orgRef)
+		if err != nil {
+			return nil, err
+		}
+		roleIDs := make([]bson.ObjectID, 0, len(roles))
+		for _, role := range roles {
+			roleIDs = append(roleIDs, role.ID)
+		}
+		return roleIDs, nil
+	}, s.roleManager.Delete)
+}
+
+func (s *service) deleteOrganizationPolicies(ctx context.Context, orgRef bson.ObjectID) error {
+	return s.deleteOrganizationEntities(ctx, orgRef, "policies", "policy", "policy_ref", func(ctx context.Context, orgRef bson.ObjectID) ([]bson.ObjectID, error) {
+		policies, err := s.policyDB.All(ctx, orgRef)
+		if err != nil {
+			return nil, err
+		}
+		policyIDs := make([]bson.ObjectID, 0, len(policies))
+		for _, policy := range policies {
+			policyIDs = append(policyIDs, policy.ID)
+		}
+		return policyIDs, nil
+	}, s.policyDB.Delete)
+}
+
+func (s *service) deleteOrganizationEntities(
+	ctx context.Context,
+	orgRef bson.ObjectID,
+	entityName string,
+	entityLabel string,
+	entityRefField string,
+	load func(context.Context, bson.ObjectID) ([]bson.ObjectID, error),
+	deleteFn func(context.Context, bson.ObjectID) error,
+) error {
+	s.logger.Info(fmt.Sprintf("Deleting %s for organization", entityName), mzap.OrgRef(orgRef))
+
+	entityIDs, err := load(ctx, orgRef)
+	if err != nil && !errors.Is(err, merrors.ErrNoData) {
+		s.logger.Warn(fmt.Sprintf("Failed to fetch %s for deletion", entityName), zap.Error(err), mzap.OrgRef(orgRef))
+		return err
+	}
+
+	for _, entityID := range entityIDs {
+		if err := deleteFn(ctx, entityID); err != nil {
+			s.logger.Warn(fmt.Sprintf("Failed to delete %s", entityLabel), zap.Error(err), mzap.ObjRef(entityRefField, entityID))
+			return err
+		}
+	}
+
+	s.logger.Info(fmt.Sprintf("Successfully deleted %s", entityName), zap.Int("count", len(entityIDs)), mzap.OrgRef(orgRef))
+	return nil
+}
+
+func (s *service) DeleteOrganization(
+	ctx context.Context,
+	org *model.Organization,
+) error {
+	s.logger.Info("Starting organization deletion", mzap.StorableRef(org))
+
+	// Use transaction to ensure atomicity
+	// 8. Delete all roles and role descriptions in the organization
+	if err := s.deleteOrganizationRoles(ctx, org.ID); err != nil {
+		return err
+	}
+
+	// 9. Delete all policies in the organization
+	if err := s.deleteOrganizationPolicies(ctx, org.ID); err != nil {
+		return err
+	}
+
+	// 10. Finally, delete the organization itself
+	if err := s.orgDB.Delete(ctx, bson.NilObjectID, org.ID); err != nil {
+		s.logger.Warn("Failed to delete organization", zap.Error(err), mzap.StorableRef(org))
+		return err
+	}
+
+	s.logger.Info("Organization deleted successfully", mzap.StorableRef(org))
+	return nil
+}
+
+func (s *service) DeleteAll(
+	ctx context.Context,
+	org *model.Organization,
+	accountRef bson.ObjectID,
+) error {
+	s.logger.Info("Starting complete deletion (organization + account)",
+		mzap.StorableRef(org), mzap.AccRef(accountRef))
+
+	// 1. First delete the organization and all its data
+	if err := s.DeleteOrganization(ctx, org); err != nil {
+		return err
+	}
+
+	// 2. Then delete the account
+	if err := s.accountDB.Delete(ctx, accountRef); err != nil {
+		s.logger.Warn("Failed to delete account", zap.Error(err), mzap.AccRef(accountRef))
+		return err
+	}
+
+	s.logger.Info("Complete deletion successful", mzap.StorableRef(org), mzap.AccRef(accountRef))
+	return nil
+}
+
+// NewAccountService wires in your logger plus the three dependencies.
+func NewAccountService(
+	l mlogger.Logger,
+	dbf db.Factory,
+	enforcer auth.Enforcer,
+	ra management.Role,
+	config *middleware.PasswordConfig,
+) (*service, error) {
+	logger := l.Named("account_service")
+
+	if config == nil {
+		return nil, merrors.Internal("Invalid account service configuration provides")
+	}
+
+	res := &service{
+		logger:      logger,
+		enforcer:    enforcer,
+		roleManager: ra,
+		config:      config,
+	}
+	deps, err := edgestorage.ResolveDependencies(dbf)
+	if err != nil {
+		return nil, err
+	}
+	if res.accountDB, err = dbf.NewAccountDB(); err != nil {
+		logger.Error("Failed to create accounts database", zap.Error(err))
+		return nil, err
+	}
+	if res.orgDB, err = organization.Create(context.Background(), logger, deps.Enforcer, deps.Policies, deps.Database); err != nil {
+		logger.Error("Failed to create organizations database", zap.Error(err))
+		return nil, err
+	}
+
+	// Initialize database dependencies for cascade deletion
+	if res.policyDB, err = dbf.NewPoliciesDB(); err != nil {
+		logger.Error("Failed to create policies database", zap.Error(err))
+		return nil, err
+	}
+	if res.vdb, err = verification.Create(logger, deps.Database, deps.Transactions); err != nil {
+		logger.Error("Failed to create verification database", zap.Error(err))
+		return nil, err
+	}
+	return res, nil
+}

backend/edge/product/interface/accountservice/internal/service_deletion_test.go

@@ -0,0 +1,156 @@
+package accountserviceimp
+
+import (
+	"testing"
+
+	"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func TestDeleteAccount_Validation(t *testing.T) {
+	t.Run("DeleteAccount_LastMemberFails", func(t *testing.T) {
+		orgID := bson.NewObjectID()
+		accountID := bson.NewObjectID()
+
+		org := &model.Organization{
+			OrganizationBase: model.OrganizationBase{
+				Describable: model.Describable{Name: "Single Member Org"},
+			},
+			Members: []bson.ObjectID{accountID}, // Only one member
+		}
+		org.ID = orgID
+
+		// This should fail because it's the only member
+		err := validateDeleteAccount(org)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "Cannot delete the only member")
+	})
+
+	t.Run("DeleteAccount_MultipleMembersSuccess", func(t *testing.T) {
+		orgID := bson.NewObjectID()
+		accountID := bson.NewObjectID()
+		otherAccountID := bson.NewObjectID()
+
+		org := &model.Organization{
+			OrganizationBase: model.OrganizationBase{
+				Describable: model.Describable{Name: "Multi Member Org"},
+			},
+			Members: []bson.ObjectID{accountID, otherAccountID}, // Multiple members
+		}
+		org.ID = orgID
+
+		// This should succeed because there are multiple members
+		err := validateDeleteAccount(org)
+		require.NoError(t, err)
+	})
+
+	t.Run("DeleteAccount_EmptyMembersList", func(t *testing.T) {
+		orgID := bson.NewObjectID()
+
+		org := &model.Organization{
+			OrganizationBase: model.OrganizationBase{
+				Describable: model.Describable{Name: "Empty Org"},
+			},
+			Members: []bson.ObjectID{}, // No members
+		}
+		org.ID = orgID
+
+		// This should fail because there are no members
+		err := validateDeleteAccount(org)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "Cannot delete the only member")
+	})
+}
+
+func TestDeleteOrganization_Validation(t *testing.T) {
+	t.Run("DeleteOrganization_NilOrganization", func(t *testing.T) {
+		err := validateDeleteOrganization(nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "organization cannot be nil")
+	})
+
+	t.Run("DeleteOrganization_EmptyOrganization", func(t *testing.T) {
+		org := &model.Organization{}
+		err := validateDeleteOrganization(org)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "organization ID cannot be empty")
+	})
+
+	t.Run("DeleteOrganization_ValidOrganization", func(t *testing.T) {
+		org := &model.Organization{
+			OrganizationBase: model.OrganizationBase{
+				Describable: model.Describable{Name: "Valid Organization"},
+			},
+		}
+		org.ID = bson.NewObjectID()
+
+		err := validateDeleteOrganization(org)
+		require.NoError(t, err)
+	})
+}
+
+func TestDeleteAll_Validation(t *testing.T) {
+	t.Run("DeleteAll_NilOrganization", func(t *testing.T) {
+		accountID := bson.NewObjectID()
+		err := validateDeleteAll(nil, accountID)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "organization cannot be nil")
+	})
+
+	t.Run("DeleteAll_EmptyAccountID", func(t *testing.T) {
+		org := &model.Organization{
+			OrganizationBase: model.OrganizationBase{
+				Describable: model.Describable{Name: "Valid Organization"},
+			},
+		}
+		org.ID = bson.NewObjectID()
+
+		err := validateDeleteAll(org, bson.NilObjectID)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "account ID cannot be empty")
+	})
+
+	t.Run("DeleteAll_ValidInput", func(t *testing.T) {
+		org := &model.Organization{
+			OrganizationBase: model.OrganizationBase{
+				Describable: model.Describable{Name: "Valid Organization"},
+			},
+		}
+		org.ID = bson.NewObjectID()
+		accountID := bson.NewObjectID()
+
+		err := validateDeleteAll(org, accountID)
+		require.NoError(t, err)
+	})
+}
+
+// Helper functions that implement the validation logic from the service
+func validateDeleteAccount(org *model.Organization) error {
+	if len(org.Members) <= 1 {
+		return merrors.InvalidArgument("Cannot delete the only member of an organization")
+	}
+	return nil
+}
+
+func validateDeleteOrganization(org *model.Organization) error {
+	if org == nil {
+		return merrors.InvalidArgument("organization cannot be nil")
+	}
+	if org.ID == bson.NilObjectID {
+		return merrors.InvalidArgument("organization ID cannot be empty")
+	}
+	return nil
+}
+
+func validateDeleteAll(org *model.Organization, accountRef bson.ObjectID) error {
+	if org == nil {
+		return merrors.InvalidArgument("organization cannot be nil")
+	}
+	if accountRef == bson.NilObjectID {
+		return merrors.InvalidArgument("account ID cannot be empty")
+	}
+	return nil
+}

backend/edge/product/interface/accountservice/internal/service_test.go

@@ -0,0 +1,244 @@
+package accountserviceimp
+
+import (
+	"testing"
+
+	apiconfig "git.sendico.io/tech/sxchnge/bff/edge/shared/interface/middleware"
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+// TestValidatePassword tests the password validation logic directly
+func TestValidatePassword(t *testing.T) {
+	config := &apiconfig.PasswordConfig{
+		Check: apiconfig.PasswordChecks{
+			MinLength: 8,
+			Digit:     true,
+			Upper:     true,
+			Lower:     true,
+			Special:   true,
+		},
+		TokenLength: 32,
+	}
+
+	// Create a minimal service for testing password validation
+	logger := zap.NewNop() // Use no-op logger for tests
+	service := &service{
+		config: config,
+		logger: logger,
+	}
+
+	t.Run("ValidPassword", func(t *testing.T) {
+		err := service.ValidatePassword("TestPassword123!", nil)
+		assert.NoError(t, err)
+	})
+
+	t.Run("PasswordTooShort", func(t *testing.T) {
+		err := service.ValidatePassword("Test1!", nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "at least 8 characters")
+	})
+
+	t.Run("PasswordMissingDigit", func(t *testing.T) {
+		err := service.ValidatePassword("TestPassword!", nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "at least one digit")
+	})
+
+	t.Run("PasswordMissingUppercase", func(t *testing.T) {
+		err := service.ValidatePassword("testpassword123!", nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "at least one uppercase")
+	})
+
+	t.Run("PasswordMissingLowercase", func(t *testing.T) {
+		err := service.ValidatePassword("TESTPASSWORD123!", nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "at least one lowercase")
+	})
+
+	t.Run("PasswordMissingSpecialCharacter", func(t *testing.T) {
+		err := service.ValidatePassword("TestPassword123", nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "at least one special character")
+	})
+
+	t.Run("PasswordSameAsOld", func(t *testing.T) {
+		oldPassword := "TestPassword123!"
+		err := service.ValidatePassword("TestPassword123!", &oldPassword)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "cannot be the same as the old password")
+	})
+}
+
+// TestValidateAccount tests the account validation logic directly
+func TestValidateAccount(t *testing.T) {
+	config := &apiconfig.PasswordConfig{
+		Check: apiconfig.PasswordChecks{
+			MinLength: 8,
+			Digit:     true,
+			Upper:     true,
+			Lower:     true,
+			Special:   true,
+		},
+		TokenLength: 32,
+	}
+
+	logger := zap.NewNop() // Use no-op logger for tests
+	service := &service{
+		config: config,
+		logger: logger,
+	}
+
+	t.Run("ValidAccount", func(t *testing.T) {
+		account := &model.Account{
+			AccountPublic: model.AccountPublic{
+				AccountBase: model.AccountBase{
+					Describable: model.Describable{
+						Name: "Test User",
+					},
+				},
+				UserDataBase: model.UserDataBase{
+					Login: "test@example.com",
+				},
+			},
+			Password: "TestPassword123!",
+		}
+
+		originalPassword := account.Password
+		err := service.ValidateAccount(account)
+		require.NoError(t, err)
+
+		// Password should be hashed after validation
+		assert.NotEqual(t, originalPassword, account.Password)
+	})
+
+	t.Run("AccountMissingName", func(t *testing.T) {
+		account := &model.Account{
+			AccountPublic: model.AccountPublic{
+				UserDataBase: model.UserDataBase{
+					Login: "test@example.com",
+				},
+			},
+			Password: "TestPassword123!",
+		}
+
+		err := service.ValidateAccount(account)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "Name must not be empty")
+	})
+
+	t.Run("AccountMissingLogin", func(t *testing.T) {
+		account := &model.Account{
+			AccountPublic: model.AccountPublic{
+				AccountBase: model.AccountBase{
+					Describable: model.Describable{
+						Name: "Test User",
+					},
+				},
+			},
+			Password: "TestPassword123!",
+		}
+
+		err := service.ValidateAccount(account)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "Login must not be empty")
+	})
+
+	t.Run("AccountMissingPassword", func(t *testing.T) {
+		account := &model.Account{
+			AccountPublic: model.AccountPublic{
+				AccountBase: model.AccountBase{
+					Describable: model.Describable{
+						Name: "Test User",
+					},
+				},
+				UserDataBase: model.UserDataBase{
+					Login: "test@example.com",
+				},
+			},
+			Password: "",
+		}
+
+		err := service.ValidateAccount(account)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "Password must not be empty")
+	})
+
+	t.Run("AccountInvalidPassword", func(t *testing.T) {
+		account := &model.Account{
+			AccountPublic: model.AccountPublic{
+				AccountBase: model.AccountBase{
+					Describable: model.Describable{
+						Name: "Test User",
+					},
+				},
+				UserDataBase: model.UserDataBase{
+					Login: "test@example.com",
+				},
+			},
+			Password: "weak", // Should fail validation
+		}
+
+		err := service.ValidateAccount(account)
+		assert.Error(t, err)
+		// Should fail on password validation
+		assert.Contains(t, err.Error(), "at least 8 characters")
+	})
+}
+
+// TestPasswordConfiguration verifies different password rule configurations
+func TestPasswordConfiguration(t *testing.T) {
+	t.Run("MinimalRequirements", func(t *testing.T) {
+		config := &apiconfig.PasswordConfig{
+			Check: apiconfig.PasswordChecks{
+				MinLength: 4,
+				Digit:     false,
+				Upper:     false,
+				Lower:     false,
+				Special:   false,
+			},
+			TokenLength: 16,
+		}
+
+		logger := zap.NewNop() // Use no-op logger for tests
+		service := &service{
+			config: config,
+			logger: logger,
+		}
+
+		// Should pass with minimal requirements
+		err := service.ValidatePassword("test", nil)
+		assert.NoError(t, err)
+	})
+
+	t.Run("StrictRequirements", func(t *testing.T) {
+		config := &apiconfig.PasswordConfig{
+			Check: apiconfig.PasswordChecks{
+				MinLength: 12,
+				Digit:     true,
+				Upper:     true,
+				Lower:     true,
+				Special:   true,
+			},
+			TokenLength: 64,
+		}
+
+		logger := zap.NewNop() // Use no-op logger for tests
+		service := &service{
+			config: config,
+			logger: logger,
+		}
+
+		// Should fail with shorter password
+		err := service.ValidatePassword("Test123!", nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "at least 12 characters")
+
+		// Should pass with longer password
+		err = service.ValidatePassword("TestPassword123!", nil)
+		assert.NoError(t, err)
+	})
+}

backend/edge/product/interface/accountservice/types.go

@@ -0,0 +1,104 @@
+package accountservice
+
+import (
+	"context"
+
+	accountserviceimp "git.sendico.io/tech/sxchnge/bff/edge/product/interface/accountservice/internal"
+	"git.sendico.io/tech/sxchnge/bff/edge/shared/interface/middleware"
+	"git.sendico.io/tech/sxchnge/bff/pkg/auth"
+	"git.sendico.io/tech/sxchnge/bff/pkg/auth/management"
+	"git.sendico.io/tech/sxchnge/bff/pkg/db"
+	"git.sendico.io/tech/sxchnge/bff/pkg/mlogger"
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// AccountService defines all account-related workflows.
+type AccountService interface {
+	// ValidateAccount will:
+	//   1) check it's completeness
+	//   2) hash password
+	//   3) prepare verification token
+	ValidateAccount(
+		acct *model.Account,
+	) error
+
+	// ValidatePassword will:
+	//   1) check passsword conformance
+	ValidatePassword(
+		password string,
+		oldPassword *string,
+	) error
+
+	// ResetPassword will:
+	//   1) generate reset password token
+	ResetPassword(
+		ctx context.Context,
+		acct *model.Account,
+	) (verificationToken string, err error)
+
+	// CreateAccount will:
+	//   1) create the account
+	//   2) add it to the org’s member list
+	//   3) assign the given role description to it
+	CreateAccount(
+		ctx context.Context,
+		org *model.Organization,
+		acct *model.Account,
+		roleDescID bson.ObjectID,
+	) (verificationToken string, err error)
+
+	VerifyAccount(
+		ctx context.Context,
+		acct *model.Account,
+	) (verificationToken string, err error)
+
+	JoinOrganization(
+		ctx context.Context,
+		org *model.Organization,
+		acct *model.Account,
+		roleDescID bson.ObjectID,
+	) error
+
+	UpdateLogin(
+		ctx context.Context,
+		acct *model.Account,
+		newLogin string,
+	) (verificationToken string, err error)
+
+	// DeleteAccount deletes the account and removes it from the org.
+	DeleteAccount(
+		ctx context.Context,
+		org *model.Organization,
+		accountRef bson.ObjectID,
+	) error
+
+	// RemoveAccountFromOrganization just drops it from the member slice.
+	RemoveAccountFromOrganization(
+		ctx context.Context,
+		org *model.Organization,
+		accountRef bson.ObjectID,
+	) error
+
+	DeleteOrganization(
+		ctx context.Context,
+		org *model.Organization,
+	) error
+
+	// DeleteAll deletes both the organization and the account.
+	DeleteAll(
+		ctx context.Context,
+		org *model.Organization,
+		accountRef bson.ObjectID,
+	) error
+}
+
+func NewAccountService(
+	logger mlogger.Logger,
+	dbf db.Factory,
+	enforcer auth.Enforcer,
+	roleManeger management.Role,
+	config *middleware.PasswordConfig,
+) (AccountService, error) {
+	return accountserviceimp.NewAccountService(logger, dbf, enforcer, roleManeger, config)
+}