Integrate email notifications into signup and login (#38)

backend/product/verification/store/idempotency.go

@@ -2,15 +2,16 @@ package verification
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"errors"
-	verificationmodel "git.sendico.io/tech/sxchnge/product/verification/model"
 	"strings"
 
+	verificationmodel "git.sendico.io/tech/sxchnge/product/verification/model"
 	mutil "git.sendico.io/tech/sxchnge/shared/database/query"
 	"git.sendico.io/tech/sxchnge/shared/database/repository"
 	"git.sendico.io/tech/sxchnge/shared/database/repository/builder"
 	"git.sendico.io/tech/sxchnge/shared/errors"
-	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func normalizedIdempotencyKey(value *string) (string, bool) {
@@ -24,8 +25,12 @@ func normalizedIdempotencyKey(value *string) (string, bool) {
 	return key, true
 }
 
-func syntheticIdempotencyKey() string {
-	return "auto:" + bson.NewObjectID().Hex()
+func syntheticIdempotencyKey() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", merrors.InternalWrap(err, "generate verification key")
+	}
+	return "auto:" + base64.RawURLEncoding.EncodeToString(b), nil
 }
 
 func idempotencyContextFilter(
@@ -35,7 +40,7 @@ func idempotencyContextFilter(
 	return repository.Query().And(
 		repository.Filter("accountRef", request.AccountRef),
 		repository.Filter("purpose", request.Purpose),
-		repository.Filter("target", request.Target),
+		targetFilter(request.Target),
 		repository.Filter("idempotencyKey", idempotencyKey),
 	)
 }
@@ -75,6 +80,12 @@ func (db *verificationDB) lookupIdempotencyReplay(ctx context.Context, request *
 		if existingContextRef != request.ContextRef {
 			return nil, false, ErrorIdempotencyConflict()
 		}
+		if tokens[i].UsedAt != nil {
+			return nil, false, ErorrTokenAlreadyUsed()
+		}
+		if tokens[i].MaxRetries != nil && tokens[i].Attempts >= *tokens[i].MaxRetries {
+			return nil, false, ErrorTokenAttemptsExceeded()
+		}
 		if replayed == nil {
 			token := tokens[i]
 			replayed = &token