@nakedev/go-scaffold 0.3.3 → 0.4.3

package/templates/add/auth/internal/app/user/service_test.go.hbs

@@ -1,90 +1,320 @@
 package user
 
 import (
-	"fmt"
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
+	"sync"
 	"testing"
 	"time"
 
 	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/app/user/application"
 	"{{goModule}}/internal/shared/apperror"
-	"{{goModule}}/internal/shared/config"
 
 	"github.com/google/uuid"
 	"gorm.io/gorm"
 )
 
-// fakeTokenStore = in-memory mock of tokenStore, mirroring the real store's
+// testTokenStore is the deliberately broad test-only composition used to
+// populate the three independent token ports in Dependencies.
+type testTokenStore interface {
+	RefreshTokenStore
+	OAuthTransactionStore
+	RecoveryTokenStore
+}
+
+// fakeTokenStore = in-memory mock of the token ports, mirroring the real store's
 // three-map shape (active / used-tombstone / per-user session set) closely
 // enough to exercise rotation + reuse-detection without a real Redis.
 type fakeTokenStore struct {
-	active   map[string]uuid.UUID
-	used     map[string]uuid.UUID
-	sessions map[uuid.UUID]map[string]struct{}
+	mu          sync.Mutex
+	txMu        sync.Mutex
+	active      map[string]refreshTokenRecord
+	used        map[string]uuid.UUID
+	sessions    map[uuid.UUID]map[string]struct{}
+	transactions map[string]loginTransaction
+	reset       map[string]uuid.UUID
+	verify      map[string]uuid.UUID
+	revokeAllErr error
 }
 
 func newFakeTokenStore() *fakeTokenStore {
 	return &fakeTokenStore{
-		active:   map[string]uuid.UUID{},
-		used:     map[string]uuid.UUID{},
-		sessions: map[uuid.UUID]map[string]struct{}{},
+		active:       map[string]refreshTokenRecord{},
+		used:         map[string]uuid.UUID{},
+		sessions:     map[uuid.UUID]map[string]struct{}{},
+		transactions: map[string]loginTransaction{},
+		reset:        map[string]uuid.UUID{},
+		verify:       map[string]uuid.UUID{},
 	}
 }
 
-func (f *fakeTokenStore) SetRefreshToken(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
-	f.active[hash] = userID
-	if f.sessions[userID] == nil {
-		f.sessions[userID] = map[string]struct{}{}
+func (f *fakeTokenStore) SetRefreshToken(_ context.Context, hash string, token refreshTokenRecord) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.active[hash] = token
+	if f.sessions[token.UserID] == nil {
+		f.sessions[token.UserID] = map[string]struct{}{}
 	}
-	f.sessions[userID][hash] = struct{}{}
+	f.sessions[token.UserID][hash] = struct{}{}
 	return nil
 }
 func (f *fakeTokenStore) GetRefreshToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
-	id, ok := f.active[hash]
-	return id, ok, nil
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	token, ok := f.active[hash]
+	if !ok || !token.ExpiresAt.After(time.Now()) {
+		return uuid.Nil, false, nil
+	}
+	return token.UserID, true, nil
+}
+
+func (f *fakeTokenStore) ConsumeRefreshToken(_ context.Context, hash string) (refreshTokenRecord, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	token, ok := f.active[hash]
+	if !ok || !token.ExpiresAt.After(time.Now()) {
+		return refreshTokenRecord{}, false, nil
+	}
+	delete(f.active, hash)
+	delete(f.sessions[token.UserID], hash)
+	f.used[hash] = token.UserID
+	return token, true, nil
 }
+
 func (f *fakeTokenStore) DeleteRefreshToken(_ context.Context, hash string, userID uuid.UUID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	delete(f.active, hash)
 	delete(f.sessions[userID], hash)
 	return nil
 }
 func (f *fakeTokenStore) RevokeAllRefreshTokens(_ context.Context, userID uuid.UUID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.revokeAllErr != nil {
+		err := f.revokeAllErr
+		f.revokeAllErr = nil
+		return err
+	}
 	for h := range f.sessions[userID] {
 		delete(f.active, h)
 	}
 	delete(f.sessions, userID)
 	return nil
 }
-func (f *fakeTokenStore) MarkRefreshTokenUsed(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
-	f.used[hash] = userID
-	return nil
-}
 func (f *fakeTokenStore) IsRefreshTokenUsed(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	id, ok := f.used[hash]
 	return id, ok, nil
 }
-func (f *fakeTokenStore) SetPasswordResetToken(context.Context, string, uuid.UUID, time.Duration) error {
+
+func (f *fakeTokenStore) WithTransaction(ctx context.Context, fn func(context.Context) error) error {
+	// A real DB transaction serializes the single-token DELETE against another
+	// consumer. Keep the fake's rollback snapshot isolated the same way so a
+	// losing concurrent transaction cannot restore the winner's consume.
+	f.txMu.Lock()
+	defer f.txMu.Unlock()
+
+	f.mu.Lock()
+	active := cloneRefreshTokenMap(f.active)
+	used := cloneTokenMap(f.used)
+	transactions := cloneLoginTransactions(f.transactions)
+	reset := cloneTokenMap(f.reset)
+	verify := cloneTokenMap(f.verify)
+	sessions := cloneSessions(f.sessions)
+	f.mu.Unlock()
+
+	err := fn(ctx)
+	if err == nil {
+		return nil
+	}
+	f.mu.Lock()
+	f.active, f.used, f.transactions, f.reset, f.verify, f.sessions = active, used, transactions, reset, verify, sessions
+	f.mu.Unlock()
+	return err
+}
+
+func cloneRefreshTokenMap(in map[string]refreshTokenRecord) map[string]refreshTokenRecord {
+	out := make(map[string]refreshTokenRecord, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func cloneTokenMap(in map[string]uuid.UUID) map[string]uuid.UUID {
+	out := make(map[string]uuid.UUID, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func cloneLoginTransactions(in map[string]loginTransaction) map[string]loginTransaction {
+	out := make(map[string]loginTransaction, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func (f *fakeTokenStore) SetLoginTransaction(_ context.Context, hash string, transaction loginTransaction) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.transactions[hash] = transaction
 	return nil
 }
-func (f *fakeTokenStore) ConsumePasswordResetToken(context.Context, string) (uuid.UUID, bool, error) {
-	return uuid.Nil, false, nil
+
+func (f *fakeTokenStore) ConsumeLoginTransaction(_ context.Context, hash string) (loginTransaction, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	transaction, ok := f.transactions[hash]
+	if !ok || !transaction.ExpiresAt.After(time.Now()) {
+		return loginTransaction{}, false, nil
+	}
+	delete(f.transactions, hash)
+	return transaction, true, nil
+}
+
+func cloneSessions(in map[uuid.UUID]map[string]struct{}) map[uuid.UUID]map[string]struct{} {
+	out := make(map[uuid.UUID]map[string]struct{}, len(in))
+	for userID, hashes := range in {
+		out[userID] = map[string]struct{}{}
+		for hash := range hashes {
+			out[userID][hash] = struct{}{}
+		}
+	}
+	return out
+}
+
+func (f *fakeTokenStore) SetPasswordResetToken(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.reset[hash] = userID
+	return nil
+}
+func (f *fakeTokenStore) ConsumePasswordResetToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	id, ok := f.reset[hash]
+	if ok {
+		delete(f.reset, hash)
+	}
+	return id, ok, nil
 }
-func (f *fakeTokenStore) SetEmailVerifyToken(context.Context, string, uuid.UUID, time.Duration) error {
+func (f *fakeTokenStore) SetEmailVerifyToken(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.verify[hash] = userID
 	return nil
 }
-func (f *fakeTokenStore) ConsumeEmailVerifyToken(context.Context, string) (uuid.UUID, bool, error) {
-	return uuid.Nil, false, nil
+func (f *fakeTokenStore) ConsumeEmailVerifyToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	id, ok := f.verify[hash]
+	if ok {
+		delete(f.verify, hash)
+	}
+	return id, ok, nil
+}
+
+type fakeMFAStore struct {
+	mu          sync.Mutex
+	enrollments map[uuid.UUID]MFAEnrollment
+	challenges  map[string]MFAChallenge
+	recovery    map[uuid.UUID]map[string]struct{}
+}
+
+func newFakeMFAStore() *fakeMFAStore {
+	return &fakeMFAStore{
+		enrollments: map[uuid.UUID]MFAEnrollment{},
+		challenges:  map[string]MFAChallenge{},
+		recovery:    map[uuid.UUID]map[string]struct{}{},
+	}
+}
+
+func (f *fakeMFAStore) GetEnrollment(_ context.Context, userID uuid.UUID) (MFAEnrollment, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	enrollment, ok := f.enrollments[userID]
+	return enrollment, ok, nil
+}
+
+func (f *fakeMFAStore) PutPendingEnrollment(_ context.Context, userID uuid.UUID, secret string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if current, ok := f.enrollments[userID]; ok && current.Enabled {
+		return errors.New("MFA already enabled")
+	}
+	f.enrollments[userID] = MFAEnrollment{EncryptedSecret: secret}
+	return nil
+}
+
+func (f *fakeMFAStore) ConfirmEnrollment(_ context.Context, userID uuid.UUID, secret string, hashes []string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(hashes) == 0 {
+		return errors.New("MFA recovery codes are required")
+	}
+	f.enrollments[userID] = MFAEnrollment{EncryptedSecret: secret, Enabled: true}
+	f.recovery[userID] = map[string]struct{}{}
+	for _, hash := range hashes {
+		f.recovery[userID][hash] = struct{}{}
+	}
+	return nil
+}
+
+func (f *fakeMFAStore) Disable(_ context.Context, userID uuid.UUID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.enrollments, userID)
+	delete(f.recovery, userID)
+	return nil
+}
+
+func (f *fakeMFAStore) CreateChallenge(_ context.Context, hash string, challenge MFAChallenge) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.challenges[hash] = challenge
+	return nil
+}
+
+func (f *fakeMFAStore) ConsumeChallenge(_ context.Context, hash string) (MFAChallenge, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	challenge, ok := f.challenges[hash]
+	if !ok || !challenge.ExpiresAt.After(time.Now()) {
+		return MFAChallenge{}, false, nil
+	}
+	delete(f.challenges, hash)
+	return challenge, true, nil
+}
+
+func (f *fakeMFAStore) ConsumeRecoveryCode(_ context.Context, userID uuid.UUID, hash string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	codes := f.recovery[userID]
+	if _, ok := codes[hash]; !ok {
+		return false, nil
+	}
+	delete(codes, hash)
+	return true, nil
 }
 
 // fakeRepo = mock of the repository interface — only FindByID is exercised
 // by the tests below (Refresh looks the user up after validating the
 // token), the rest just satisfy the interface.
 type fakeRepo struct {
-	user *model.User
-	failures    map[string]int
-	lockedUntil map[string]time.Time
+	user              *model.User
+	identity          *model.Identity
+	updateIdentityErr error
+	updateUserErr     error
+	failures          map[string]int
+	lockedUntil       map[string]time.Time
 }
 
 // throttle: the fake keeps the counter in memory so the lockout path can be
@@ -125,9 +355,19 @@ func (f *fakeRepo) FindByID(_ context.Context, id uuid.UUID) (*model.User, error
 	}
 	return nil, gorm.ErrRecordNotFound
 }
-func (f *fakeRepo) UpdateUser(context.Context, *model.User) error { return nil }
+func (f *fakeRepo) UpdateUser(_ context.Context, u *model.User) error {
+	if f.updateUserErr != nil {
+		return f.updateUserErr
+	}
+	f.user = u
+	return nil
+}
 func (f *fakeRepo) FindAll(context.Context, int, int) ([]model.User, error) { return nil, nil }
-func (f *fakeRepo) FindIdentity(context.Context, uuid.UUID, model.Provider) (*model.Identity, error) {
+func (f *fakeRepo) FindIdentity(_ context.Context, userID uuid.UUID, _ model.Provider) (*model.Identity, error) {
+	if f.identity != nil && f.identity.UserID == userID {
+		copy := *f.identity
+		return &copy, nil
+	}
 	return nil, gorm.ErrRecordNotFound
 }
 func (f *fakeRepo) FindIdentityByProviderUID(context.Context, model.Provider, string) (*model.Identity, error) {
@@ -135,7 +375,15 @@ func (f *fakeRepo) FindIdentityByProviderUID(context.Context, model.Provider, st
 }
 func (f *fakeRepo) CreateUserWithIdentity(context.Context, *model.User, *model.Identity) error { return nil }
 func (f *fakeRepo) CreateIdentity(context.Context, *model.Identity) error                      { return nil }
-func (f *fakeRepo) UpdateIdentity(context.Context, *model.Identity) error                      { return nil }
+func (f *fakeRepo) UpdateIdentity(_ context.Context, i *model.Identity) error {
+	if f.updateIdentityErr != nil {
+		return f.updateIdentityErr
+	}
+	f.identity = i
+	return nil
+}
+
+// go-scaffold:user-fake-repo-methods
 
 type fakeMailer struct{}
 
@@ -147,14 +395,37 @@ func (fakeMailer) Send(context.Context, string, string, string) error { return n
 // keeping it singular means `add rbac`'s marker patch only has one place to
 // add the roleChecker arg it introduces (patching every call site
 // individually would need a marker-per-callsite, easy to miss one).
-func newTestService(repo repository, tokens tokenStore) *Service {
-	return NewService(
-		repo,
-		tokens,
-		fakeMailer{},
-		config.Config{JWTSecret: "test-secret", JWTAccessTTL: time.Minute, JWTRefreshTTL: time.Hour},
-		// go-scaffold:user-service-test-args
-	)
+func newTestService(repo repository, tokens testTokenStore) *Service {
+	return NewService(Dependencies{
+		Repository:        repo,
+		RefreshTokens:     tokens,
+		OAuthTransactions: tokens,
+		RecoveryTokens:    tokens,
+		MFA:               newFakeMFAStore(),
+		Mailer:            fakeMailer{},
+		Providers:         application.NewProviderRegistry(),
+		// go-scaffold:user-service-test-deps
+	}, AuthConfig{
+		JWTSecret:        "test-secret",
+		JWTAccessTTL:     time.Minute,
+		JWTRefreshTTL:    time.Hour,
+		JWTRefreshMaxTTL: 24 * time.Hour,
+		OAuthStateTTL:    10 * time.Minute,
+	})
+}
+
+func seedRefreshToken(ctx context.Context, tokens *fakeTokenStore, raw string, userID uuid.UUID, ttl time.Duration) error {
+	now := time.Now()
+	return tokens.SetRefreshToken(ctx, hashToken(raw), refreshTokenRecord{
+		UserID:            userID,
+		ExpiresAt:         now.Add(ttl),
+		AbsoluteExpiresAt: now.Add(24 * time.Hour),
+	})
+}
+
+func testRefreshTokenRecord(userID uuid.UUID) refreshTokenRecord {
+	now := time.Now()
+	return refreshTokenRecord{UserID: userID, ExpiresAt: now.Add(time.Hour), AbsoluteExpiresAt: now.Add(24 * time.Hour)}
 }
 
 func status(t *testing.T, err error) int {
@@ -171,7 +442,7 @@ func TestService_Refresh_RotatesTheToken(t *testing.T) {
 	userID := uuid.New()
 	tokens := newFakeTokenStore()
 	rawOld := "old-refresh-token"
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawOld), userID, time.Hour); err != nil {
+	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
 	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
@@ -191,16 +462,51 @@ func TestService_Refresh_RotatesTheToken(t *testing.T) {
 	}
 }
 
+func TestService_Refresh_ConcurrentPresentationHasOneWinner(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	raw := "one-refresh-token"
+	if err := seedRefreshToken(ctx, tokens, raw, userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
+
+	const callers = 32
+	start := make(chan struct{})
+	results := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			_, err := svc.Refresh(ctx, raw)
+			results <- err
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		if err := <-results; err == nil {
+			winners++
+		} else if code(err) != "AUTH_INVALID_TOKEN" {
+			t.Fatalf("unexpected loser error: %v", err)
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one refresh winner, got %d", winners)
+	}
+}
+
 func TestService_Refresh_ReplayingARotatedOutTokenRevokesEverySession(t *testing.T) {
 	ctx := context.Background()
 	userID := uuid.New()
 	tokens := newFakeTokenStore()
 	rawOld := "old-refresh-token"
 	rawOtherSession := "another-devices-refresh-token"
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawOld), userID, time.Hour); err != nil {
+	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawOtherSession), userID, time.Hour); err != nil {
+	if err := seedRefreshToken(ctx, tokens, rawOtherSession, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
 	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
@@ -220,12 +526,70 @@ func TestService_Refresh_ReplayingARotatedOutTokenRevokesEverySession(t *testing
 	}
 }
 
+func TestService_Refresh_DoesNotExtendTheAbsoluteLifetime(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	raw := "bounded-refresh-token"
+	issuedAt := time.Now()
+	absoluteExpiry := issuedAt.Add(2 * time.Hour)
+	if err := tokens.SetRefreshToken(ctx, hashToken(raw), refreshTokenRecord{
+		UserID:            userID,
+		ExpiresAt:         issuedAt.Add(time.Hour),
+		AbsoluteExpiresAt: absoluteExpiry,
+	}); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
+	rotationTime := issuedAt.Add(90 * time.Minute)
+	svc.now = func() time.Time { return rotationTime }
+
+	auth, err := svc.Refresh(ctx, raw)
+	if err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+	tokens.mu.Lock()
+	rotated := tokens.active[hashToken(auth.RefreshToken)]
+	tokens.mu.Unlock()
+	if !rotated.AbsoluteExpiresAt.Equal(absoluteExpiry) {
+		t.Fatalf("absolute expiry moved during rotation: got %s want %s", rotated.AbsoluteExpiresAt, absoluteExpiry)
+	}
+	if !rotated.ExpiresAt.Equal(absoluteExpiry) {
+		t.Fatalf("rotated inactivity expiry was not capped at the absolute expiry: got %s want %s", rotated.ExpiresAt, absoluteExpiry)
+	}
+}
+
+func TestService_Refresh_ReuseRevokeFailureFailsClosed(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	rawOld := "replayed-refresh-token"
+	rawOther := "still-active-refresh-token"
+	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
+		t.Fatalf("seed old token: %v", err)
+	}
+	if err := seedRefreshToken(ctx, tokens, rawOther, userID, time.Hour); err != nil {
+		t.Fatalf("seed other token: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
+	if _, err := svc.Refresh(ctx, rawOld); err != nil {
+		t.Fatalf("initial rotation: %v", err)
+	}
+	tokens.revokeAllErr = errors.New("session store unavailable")
+	if _, err := svc.Refresh(ctx, rawOld); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("reuse with failed revoke must fail closed with 500, got %v", err)
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOther)); !ok {
+		t.Fatal("failed revoke must not be reported as a completed session revocation")
+	}
+}
+
 func TestService_Refresh_UnknownTokenIsRejectedWithoutRevoking(t *testing.T) {
 	ctx := context.Background()
 	userID := uuid.New()
 	tokens := newFakeTokenStore()
 	rawLegit := "a-legit-session-token"
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawLegit), userID, time.Hour); err != nil {
+	if err := seedRefreshToken(ctx, tokens, rawLegit, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
 	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
@@ -248,7 +612,7 @@ func TestService_LogoutAll_RevokesEverySessionButLeavesOthersAlone(t *testing.T)
 	rawB := "user-session-b"
 	rawOther := "other-users-session"
 	for raw, id := range map[string]uuid.UUID{rawA: userID, rawB: userID, rawOther: otherUserID} {
-		if err := tokens.SetRefreshToken(ctx, hashToken(raw), id, time.Hour); err != nil {
+		if err := seedRefreshToken(ctx, tokens, raw, id, time.Hour); err != nil {
 			t.Fatalf("seed: %v", err)
 		}
 	}
@@ -268,6 +632,198 @@ func TestService_LogoutAll_RevokesEverySessionButLeavesOthersAlone(t *testing.T)
 	}
 }
 
+func TestService_ResetPassword_DBFailureAllowsRetry(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &model.User{ID: userID},
+		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+		updateIdentityErr: errors.New("database unavailable"),
+	}
+	tokens := newFakeTokenStore()
+	raw := "reset-token"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	if err := svc.ResetPassword(ctx, raw, "new-password"); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("expected a 500 on the simulated DB failure, got %v", err)
+	}
+	repo.updateIdentityErr = nil
+	if err := svc.ResetPassword(ctx, raw, "new-password"); err != nil {
+		t.Fatalf("retry should succeed after the transaction rollback: %v", err)
+	}
+}
+
+func TestService_ResetPassword_SessionRevokeFailureRestoresTokenForRetry(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &model.User{ID: userID},
+		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+	}
+	tokens := newFakeTokenStore()
+	raw := "reset-token-session-store-outage"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	tokens.revokeAllErr = errors.New("redis unavailable")
+	svc := newTestService(repo, tokens)
+
+	if err := svc.ResetPassword(ctx, raw, "new-password"); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("expected a 500 while the session store is unavailable, got %v", err)
+	}
+	if _, ok := tokens.reset[hashToken(raw)]; !ok {
+		t.Fatal("expected the reset token to be restored so the caller can retry")
+	}
+	if err := svc.ResetPassword(ctx, raw, "new-password"); err != nil {
+		t.Fatalf("retry should complete the password reset and session revoke: %v", err)
+	}
+	if _, ok := tokens.reset[hashToken(raw)]; ok {
+		t.Fatal("expected the reset token to be consumed after the retry succeeds")
+	}
+}
+
+func TestService_VerifyEmail_DBFailureAllowsRetry(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	repo := &fakeRepo{
+		user:          &model.User{ID: userID},
+		updateUserErr: errors.New("database unavailable"),
+	}
+	tokens := newFakeTokenStore()
+	raw := "verify-token"
+	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	if err := svc.VerifyEmail(ctx, raw); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("expected a 500 on the simulated DB failure, got %v", err)
+	}
+	repo.updateUserErr = nil
+	if err := svc.VerifyEmail(ctx, raw); err != nil {
+		t.Fatalf("retry should succeed after the transaction rollback: %v", err)
+	}
+}
+
+func TestService_ResetPassword_DuplicateTokenIsRejected(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &model.User{ID: userID},
+		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+	}
+	tokens := newFakeTokenStore()
+	raw := "one-time-reset-token"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+	if err := svc.ResetPassword(ctx, raw, "new-password"); err != nil {
+		t.Fatalf("first use: %v", err)
+	}
+	if err := svc.ResetPassword(ctx, raw, "another-password"); code(err) != "AUTH_INVALID_TOKEN" {
+		t.Fatalf("second use should be rejected as invalid, got %v", err)
+	}
+}
+
+func TestService_ResetPassword_ConcurrentPresentationHasOneWinner(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &model.User{ID: userID},
+		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+	}
+	tokens := newFakeTokenStore()
+	raw := "concurrent-reset-token"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	const callers = 8
+	start := make(chan struct{})
+	results := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			results <- svc.ResetPassword(ctx, raw, "new-password")
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		if err := <-results; err == nil {
+			winners++
+		} else if code(err) != "AUTH_INVALID_TOKEN" {
+			t.Fatalf("unexpected loser error: %v", err)
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one reset winner, got %d", winners)
+	}
+}
+
+func TestService_VerifyEmail_DuplicateTokenIsRejected(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	repo := &fakeRepo{user: &model.User{ID: userID}}
+	tokens := newFakeTokenStore()
+	raw := "one-time-verification-token"
+	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+	if err := svc.VerifyEmail(ctx, raw); err != nil {
+		t.Fatalf("first use: %v", err)
+	}
+	if err := svc.VerifyEmail(ctx, raw); code(err) != "AUTH_INVALID_TOKEN" {
+		t.Fatalf("second use should be rejected as invalid, got %v", err)
+	}
+}
+
+func TestService_VerifyEmail_ConcurrentPresentationHasOneWinner(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	repo := &fakeRepo{user: &model.User{ID: userID}}
+	tokens := newFakeTokenStore()
+	raw := "concurrent-verification-token"
+	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	const callers = 32
+	start := make(chan struct{})
+	results := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			results <- svc.VerifyEmail(ctx, raw)
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		if err := <-results; err == nil {
+			winners++
+		} else if code(err) != "AUTH_INVALID_TOKEN" {
+			t.Fatalf("unexpected loser error: %v", err)
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one verification winner, got %d", winners)
+	}
+}
+
 // The control that actually stops credential stuffing: the counter follows the
 // account, so spreading attempts across a proxy pool doesn't help.
 func TestService_Login_LocksTheAccountAfterRepeatedFailures(t *testing.T) {