@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/application/service_test.go.hbs

@@ -0,0 +1,891 @@
+package application
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+
+	"{{goModule}}/internal/app/user/domain"
+
+	"github.com/google/uuid"
+)
+
+// testTokenStore is the deliberately broad test-only composition used to
+// populate the three independent token ports in Dependencies.
+type testTokenStore interface {
+	RefreshTokenStore
+	OAuthTransactionStore
+	RecoveryTokenStore
+}
+
+// fakeTokenStore = in-memory mock of the token ports, mirroring the real store's
+// three-map shape (active / used-tombstone / per-user session set) closely
+// enough to exercise rotation + reuse-detection without a real Redis.
+type fakeTokenStore struct {
+	mu           sync.Mutex
+	txMu         sync.Mutex
+	active       map[string]RefreshTokenRecord
+	used         map[string]uuid.UUID
+	sessions     map[uuid.UUID]map[string]struct{}
+	transactions map[string]LoginTransaction
+	reset        map[string]uuid.UUID
+	verify       map[string]uuid.UUID
+	revokeAllErr error
+}
+
+func newFakeTokenStore() *fakeTokenStore {
+	return &fakeTokenStore{
+		active:       map[string]RefreshTokenRecord{},
+		used:         map[string]uuid.UUID{},
+		sessions:     map[uuid.UUID]map[string]struct{}{},
+		transactions: map[string]LoginTransaction{},
+		reset:        map[string]uuid.UUID{},
+		verify:       map[string]uuid.UUID{},
+	}
+}
+
+func (f *fakeTokenStore) SetRefreshToken(_ context.Context, hash string, token RefreshTokenRecord) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.active[hash] = token
+	if f.sessions[token.UserID] == nil {
+		f.sessions[token.UserID] = map[string]struct{}{}
+	}
+	f.sessions[token.UserID][hash] = struct{}{}
+	return nil
+}
+func (f *fakeTokenStore) GetRefreshToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	token, ok := f.active[hash]
+	if !ok || !token.ExpiresAt.After(time.Now()) {
+		return uuid.Nil, false, nil
+	}
+	return token.UserID, true, nil
+}
+
+func (f *fakeTokenStore) ConsumeRefreshToken(_ context.Context, hash string) (RefreshTokenRecord, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	token, ok := f.active[hash]
+	if !ok || !token.ExpiresAt.After(time.Now()) {
+		return RefreshTokenRecord{}, false, nil
+	}
+	delete(f.active, hash)
+	delete(f.sessions[token.UserID], hash)
+	f.used[hash] = token.UserID
+	return token, true, nil
+}
+
+func (f *fakeTokenStore) DeleteRefreshToken(_ context.Context, hash string, userID uuid.UUID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.active, hash)
+	delete(f.sessions[userID], hash)
+	return nil
+}
+func (f *fakeTokenStore) RevokeAllRefreshTokens(_ context.Context, userID uuid.UUID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.revokeAllErr != nil {
+		err := f.revokeAllErr
+		f.revokeAllErr = nil
+		return err
+	}
+	for h := range f.sessions[userID] {
+		delete(f.active, h)
+	}
+	delete(f.sessions, userID)
+	return nil
+}
+func (f *fakeTokenStore) IsRefreshTokenUsed(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	id, ok := f.used[hash]
+	return id, ok, nil
+}
+
+func (f *fakeTokenStore) WithTransaction(ctx context.Context, fn func(context.Context) error) error {
+	// A real DB transaction serializes the single-token DELETE against another
+	// consumer. Keep the fake's rollback snapshot isolated the same way so a
+	// losing concurrent transaction cannot restore the winner's consume.
+	f.txMu.Lock()
+	defer f.txMu.Unlock()
+
+	f.mu.Lock()
+	active := cloneRefreshTokenMap(f.active)
+	used := cloneTokenMap(f.used)
+	transactions := cloneLoginTransactions(f.transactions)
+	reset := cloneTokenMap(f.reset)
+	verify := cloneTokenMap(f.verify)
+	sessions := cloneSessions(f.sessions)
+	f.mu.Unlock()
+
+	err := fn(ctx)
+	if err == nil {
+		return nil
+	}
+	f.mu.Lock()
+	f.active, f.used, f.transactions, f.reset, f.verify, f.sessions = active, used, transactions, reset, verify, sessions
+	f.mu.Unlock()
+	return err
+}
+
+func cloneRefreshTokenMap(in map[string]RefreshTokenRecord) map[string]RefreshTokenRecord {
+	out := make(map[string]RefreshTokenRecord, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func cloneTokenMap(in map[string]uuid.UUID) map[string]uuid.UUID {
+	out := make(map[string]uuid.UUID, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func cloneLoginTransactions(in map[string]LoginTransaction) map[string]LoginTransaction {
+	out := make(map[string]LoginTransaction, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func (f *fakeTokenStore) SetLoginTransaction(_ context.Context, hash string, transaction LoginTransaction) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.transactions[hash] = transaction
+	return nil
+}
+
+func (f *fakeTokenStore) ConsumeLoginTransaction(_ context.Context, hash string) (LoginTransaction, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	transaction, ok := f.transactions[hash]
+	if !ok || !transaction.ExpiresAt.After(time.Now()) {
+		return LoginTransaction{}, false, nil
+	}
+	delete(f.transactions, hash)
+	return transaction, true, nil
+}
+
+func cloneSessions(in map[uuid.UUID]map[string]struct{}) map[uuid.UUID]map[string]struct{} {
+	out := make(map[uuid.UUID]map[string]struct{}, len(in))
+	for userID, hashes := range in {
+		out[userID] = map[string]struct{}{}
+		for hash := range hashes {
+			out[userID][hash] = struct{}{}
+		}
+	}
+	return out
+}
+
+func (f *fakeTokenStore) SetPasswordResetToken(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.reset[hash] = userID
+	return nil
+}
+func (f *fakeTokenStore) ConsumePasswordResetToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	id, ok := f.reset[hash]
+	if ok {
+		delete(f.reset, hash)
+	}
+	return id, ok, nil
+}
+func (f *fakeTokenStore) SetEmailVerifyToken(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.verify[hash] = userID
+	return nil
+}
+func (f *fakeTokenStore) ConsumeEmailVerifyToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	id, ok := f.verify[hash]
+	if ok {
+		delete(f.verify, hash)
+	}
+	return id, ok, nil
+}
+
+type fakeMFAStore struct {
+	mu          sync.Mutex
+	enrollments map[uuid.UUID]MFAEnrollment
+	challenges  map[string]MFAChallenge
+	recovery    map[uuid.UUID]map[string]struct{}
+}
+
+func newFakeMFAStore() *fakeMFAStore {
+	return &fakeMFAStore{
+		enrollments: map[uuid.UUID]MFAEnrollment{},
+		challenges:  map[string]MFAChallenge{},
+		recovery:    map[uuid.UUID]map[string]struct{}{},
+	}
+}
+
+func (f *fakeMFAStore) GetEnrollment(_ context.Context, userID uuid.UUID) (MFAEnrollment, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	enrollment, ok := f.enrollments[userID]
+	return enrollment, ok, nil
+}
+
+func (f *fakeMFAStore) PutPendingEnrollment(_ context.Context, userID uuid.UUID, secret string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if current, ok := f.enrollments[userID]; ok && current.Enabled {
+		return errors.New("MFA already enabled")
+	}
+	f.enrollments[userID] = MFAEnrollment{EncryptedSecret: secret}
+	return nil
+}
+
+func (f *fakeMFAStore) ConfirmEnrollment(_ context.Context, userID uuid.UUID, secret string, hashes []string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(hashes) == 0 {
+		return errors.New("MFA recovery codes are required")
+	}
+	f.enrollments[userID] = MFAEnrollment{EncryptedSecret: secret, Enabled: true}
+	f.recovery[userID] = map[string]struct{}{}
+	for _, hash := range hashes {
+		f.recovery[userID][hash] = struct{}{}
+	}
+	return nil
+}
+
+func (f *fakeMFAStore) Disable(_ context.Context, userID uuid.UUID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.enrollments, userID)
+	delete(f.recovery, userID)
+	return nil
+}
+
+func (f *fakeMFAStore) CreateChallenge(_ context.Context, hash string, challenge MFAChallenge) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.challenges[hash] = challenge
+	return nil
+}
+
+func (f *fakeMFAStore) ConsumeChallenge(_ context.Context, hash string) (MFAChallenge, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	challenge, ok := f.challenges[hash]
+	if !ok || !challenge.ExpiresAt.After(time.Now()) {
+		return MFAChallenge{}, false, nil
+	}
+	delete(f.challenges, hash)
+	return challenge, true, nil
+}
+
+func (f *fakeMFAStore) ConsumeRecoveryCode(_ context.Context, userID uuid.UUID, hash string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	codes := f.recovery[userID]
+	if _, ok := codes[hash]; !ok {
+		return false, nil
+	}
+	delete(codes, hash)
+	return true, nil
+}
+
+// fakeRepo = mock of the repository interface — only FindByID is exercised
+// by the tests below (Refresh looks the user up after validating the
+// token), the rest just satisfy the interface.
+type fakeRepo struct {
+	user              *domain.User
+	identity          *domain.Identity
+	updateIdentityErr error
+	updateUserErr     error
+	failures          map[string]int
+	lockedUntil       map[string]time.Time
+	// go-scaffold:repository-stub-fields
+}
+
+// throttle: the fake keeps the counter in memory so the lockout path can be
+// exercised without a database. Same shape as the real one — a key, a count,
+// and a time — because what the tests care about is when Service decides to
+// stop asking bcrypt anything.
+func (f *fakeRepo) LoginLockedUntil(_ context.Context, key string) (time.Time, error) {
+	return f.lockedUntil[key], nil
+}
+
+func (f *fakeRepo) RecordLoginFailure(_ context.Context, key string, freeAttempts int, maxLock time.Duration) error {
+	if f.lockedUntil == nil {
+		f.lockedUntil = map[string]time.Time{}
+	}
+	f.failures[key]++
+	if f.failures[key] > freeAttempts {
+		lock := time.Duration(1<<uint(f.failures[key]-freeAttempts-1)) * time.Second
+		if lock > maxLock {
+			lock = maxLock
+		}
+		f.lockedUntil[key] = time.Now().Add(lock)
+	}
+	return nil
+}
+
+func (f *fakeRepo) ClearLoginFailures(_ context.Context, key string) error {
+	delete(f.failures, key)
+	delete(f.lockedUntil, key)
+	return nil
+}
+
+func (f *fakeRepo) FindByEmail(context.Context, string) (*domain.User, error) {
+	return nil, domain.ErrNotFound
+}
+func (f *fakeRepo) FindByID(_ context.Context, id uuid.UUID) (*domain.User, error) {
+	if f.user != nil && f.user.ID == id {
+		return f.user, nil
+	}
+	return nil, domain.ErrNotFound
+}
+func (f *fakeRepo) UpdateUser(_ context.Context, u *domain.User) error {
+	if f.updateUserErr != nil {
+		return f.updateUserErr
+	}
+	f.user = u
+	return nil
+}
+func (f *fakeRepo) FindAll(context.Context, int, int) ([]domain.User, error) { return nil, nil }
+func (f *fakeRepo) FindIdentity(_ context.Context, userID uuid.UUID, _ domain.Provider) (*domain.Identity, error) {
+	if f.identity != nil && f.identity.UserID == userID {
+		copy := *f.identity
+		return &copy, nil
+	}
+	return nil, domain.ErrNotFound
+}
+func (f *fakeRepo) FindIdentityByProviderUID(context.Context, domain.Provider, string) (*domain.Identity, error) {
+	return nil, domain.ErrNotFound
+}
+func (f *fakeRepo) CreateUserWithIdentity(context.Context, *domain.User, *domain.Identity) error {
+	return nil
+}
+func (f *fakeRepo) CreateIdentity(context.Context, *domain.Identity) error { return nil }
+func (f *fakeRepo) UpdateIdentity(_ context.Context, i *domain.Identity) error {
+	if f.updateIdentityErr != nil {
+		return f.updateIdentityErr
+	}
+	f.identity = i
+	return nil
+}
+
+// go-scaffold:user-fake-repo-methods
+// go-scaffold:repository-stub-methods
+
+type fakeMailer struct{}
+
+func (fakeMailer) Send(context.Context, string, string, string) error { return nil }
+
+type fakePasswordHasher struct{}
+
+func (fakePasswordHasher) Hash(password string) (string, error) { return "hashed:" + password, nil }
+
+func (fakePasswordHasher) Compare(hash, password string) error {
+	if hash != "hashed:"+password {
+		return errors.New("password does not match")
+	}
+	return nil
+}
+
+// fakeRoles satisfies role's roleChecker interface structurally.
+type fakeRoles struct{}
+
+func (fakeRoles) CodeExists(context.Context, string) (bool, error) { return true, nil }
+
+// go-scaffold:user-service-test-types
+
+// newTestService is the one NewService call site every test below shares —
+// keeping it singular means `add rbac`'s marker patch only has one place to
+// add the roleChecker arg it introduces (patching every call site
+// individually would need a marker-per-callsite, easy to miss one).
+func newTestService(repo repository, tokens testTokenStore) *Service {
+	return NewService(Dependencies{
+		Repository:        repo,
+		Passwords:         fakePasswordHasher{},
+		RefreshTokens:     tokens,
+		OAuthTransactions: tokens,
+		RecoveryTokens:    tokens,
+		MFA:               newFakeMFAStore(),
+		Mailer:            fakeMailer{},
+		Providers:         NewProviderRegistry(),
+		Roles:             fakeRoles{},
+		// go-scaffold:user-service-test-deps
+	}, AuthConfig{
+		JWTSecret:        "test-secret",
+		JWTAccessTTL:     time.Minute,
+		JWTRefreshTTL:    time.Hour,
+		JWTRefreshMaxTTL: 24 * time.Hour,
+		OAuthStateTTL:    10 * time.Minute,
+	})
+}
+
+func seedRefreshToken(ctx context.Context, tokens *fakeTokenStore, raw string, userID uuid.UUID, ttl time.Duration) error {
+	now := time.Now()
+	return tokens.SetRefreshToken(ctx, hashToken(raw), RefreshTokenRecord{
+		UserID:            userID,
+		ExpiresAt:         now.Add(ttl),
+		AbsoluteExpiresAt: now.Add(24 * time.Hour),
+	})
+}
+
+func status(t *testing.T, err error) int {
+	t.Helper()
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		switch ruleErr.Code {
+		case "AUTH_INVALID_TOKEN", "AUTH_INVALID_CREDENTIALS":
+			return http.StatusUnauthorized
+		case "AUTH_TOO_MANY_ATTEMPTS":
+			return http.StatusTooManyRequests
+		}
+	}
+	return http.StatusInternalServerError
+}
+
+func TestService_Refresh_RotatesTheToken(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	rawOld := "old-refresh-token"
+	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "a@example.com"}}, tokens)
+
+	auth, err := svc.Refresh(ctx, rawOld)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if auth.RefreshToken == "" || auth.RefreshToken == rawOld {
+		t.Fatalf("expected a new, different refresh token, got %q", auth.RefreshToken)
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOld)); ok {
+		t.Fatal("expected the old refresh token to be consumed (no longer active) after rotation")
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(auth.RefreshToken)); !ok {
+		t.Fatal("expected the newly rotated refresh token to be active")
+	}
+}
+
+func TestService_Refresh_ConcurrentPresentationHasOneWinner(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	raw := "one-refresh-token"
+	if err := seedRefreshToken(ctx, tokens, raw, userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "a@example.com"}}, tokens)
+
+	const callers = 32
+	start := make(chan struct{})
+	results := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			_, err := svc.Refresh(ctx, raw)
+			results <- err
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		if err := <-results; err == nil {
+			winners++
+		} else if code(err) != "AUTH_INVALID_TOKEN" {
+			t.Fatalf("unexpected loser error: %v", err)
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one refresh winner, got %d", winners)
+	}
+}
+
+func TestService_Refresh_ReplayingARotatedOutTokenRevokesEverySession(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	rawOld := "old-refresh-token"
+	rawOtherSession := "another-devices-refresh-token"
+	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	if err := seedRefreshToken(ctx, tokens, rawOtherSession, userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "a@example.com"}}, tokens)
+
+	// rotate rawOld once — legitimate use, consumes + tombstones it
+	if _, err := svc.Refresh(ctx, rawOld); err != nil {
+		t.Fatalf("first refresh: unexpected error: %v", err)
+	}
+
+	// replay the now-rotated-out raw value — this is what happens if it leaked
+	_, err := svc.Refresh(ctx, rawOld)
+	if got := status(t, err); got != http.StatusUnauthorized {
+		t.Fatalf("want 401 replaying a rotated-out token, got %d", got)
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOtherSession)); ok {
+		t.Fatal("expected reuse of a rotated-out token to revoke every session for that user, but another session's token is still active")
+	}
+}
+
+func TestService_Refresh_DoesNotExtendTheAbsoluteLifetime(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	raw := "bounded-refresh-token"
+	issuedAt := time.Now()
+	absoluteExpiry := issuedAt.Add(2 * time.Hour)
+	if err := tokens.SetRefreshToken(ctx, hashToken(raw), RefreshTokenRecord{
+		UserID:            userID,
+		ExpiresAt:         issuedAt.Add(time.Hour),
+		AbsoluteExpiresAt: absoluteExpiry,
+	}); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
+	rotationTime := issuedAt.Add(90 * time.Minute)
+	svc.now = func() time.Time { return rotationTime }
+
+	auth, err := svc.Refresh(ctx, raw)
+	if err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+	tokens.mu.Lock()
+	rotated := tokens.active[hashToken(auth.RefreshToken)]
+	tokens.mu.Unlock()
+	if !rotated.AbsoluteExpiresAt.Equal(absoluteExpiry) {
+		t.Fatalf("absolute expiry moved during rotation: got %s want %s", rotated.AbsoluteExpiresAt, absoluteExpiry)
+	}
+	if !rotated.ExpiresAt.Equal(absoluteExpiry) {
+		t.Fatalf("rotated inactivity expiry was not capped at the absolute expiry: got %s want %s", rotated.ExpiresAt, absoluteExpiry)
+	}
+}
+
+func TestService_Refresh_ReuseRevokeFailureFailsClosed(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	rawOld := "replayed-refresh-token"
+	rawOther := "still-active-refresh-token"
+	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
+		t.Fatalf("seed old token: %v", err)
+	}
+	if err := seedRefreshToken(ctx, tokens, rawOther, userID, time.Hour); err != nil {
+		t.Fatalf("seed other token: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
+	if _, err := svc.Refresh(ctx, rawOld); err != nil {
+		t.Fatalf("initial rotation: %v", err)
+	}
+	tokens.revokeAllErr = errors.New("session store unavailable")
+	if _, err := svc.Refresh(ctx, rawOld); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("reuse with failed revoke must fail closed with 500, got %v", err)
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOther)); !ok {
+		t.Fatal("failed revoke must not be reported as a completed session revocation")
+	}
+}
+
+func TestService_Refresh_UnknownTokenIsRejectedWithoutRevoking(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	tokens := newFakeTokenStore()
+	rawLegit := "a-legit-session-token"
+	if err := seedRefreshToken(ctx, tokens, rawLegit, userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
+
+	_, err := svc.Refresh(ctx, "never-issued-token")
+	if got := status(t, err); got != http.StatusUnauthorized {
+		t.Fatalf("want 401 for an unrecognized token, got %d", got)
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawLegit)); !ok {
+		t.Fatal("a never-issued token shouldn't revoke unrelated sessions")
+	}
+}
+
+func TestService_LogoutAll_RevokesEverySessionButLeavesOthersAlone(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	otherUserID := uuid.New()
+	tokens := newFakeTokenStore()
+	rawA := "user-session-a"
+	rawB := "user-session-b"
+	rawOther := "other-users-session"
+	for raw, id := range map[string]uuid.UUID{rawA: userID, rawB: userID, rawOther: otherUserID} {
+		if err := seedRefreshToken(ctx, tokens, raw, id, time.Hour); err != nil {
+			t.Fatalf("seed: %v", err)
+		}
+	}
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
+
+	if err := svc.LogoutAll(ctx, userID); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawA)); ok {
+		t.Fatal("expected session A to be revoked")
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawB)); ok {
+		t.Fatal("expected session B to be revoked")
+	}
+	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOther)); !ok {
+		t.Fatal("expected a different user's session to be untouched by LogoutAll")
+	}
+}
+
+func TestService_ResetPassword_DBFailureAllowsRetry(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:              &domain.User{ID: userID},
+		identity:          &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
+		updateIdentityErr: errors.New("database unavailable"),
+	}
+	tokens := newFakeTokenStore()
+	raw := "reset-token"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	if err := svc.ResetPassword(ctx, raw, "new-password"); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("expected a 500 on the simulated DB failure, got %v", err)
+	}
+	repo.updateIdentityErr = nil
+	if err := svc.ResetPassword(ctx, raw, "new-password"); err != nil {
+		t.Fatalf("retry should succeed after the transaction rollback: %v", err)
+	}
+}
+
+func TestService_ResetPassword_SessionRevokeFailureRestoresTokenForRetry(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &domain.User{ID: userID},
+		identity: &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
+	}
+	tokens := newFakeTokenStore()
+	raw := "reset-token-session-store-outage"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	tokens.revokeAllErr = errors.New("redis unavailable")
+	svc := newTestService(repo, tokens)
+
+	if err := svc.ResetPassword(ctx, raw, "new-password"); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("expected a 500 while the session store is unavailable, got %v", err)
+	}
+	if _, ok := tokens.reset[hashToken(raw)]; !ok {
+		t.Fatal("expected the reset token to be restored so the caller can retry")
+	}
+	if err := svc.ResetPassword(ctx, raw, "new-password"); err != nil {
+		t.Fatalf("retry should complete the password reset and session revoke: %v", err)
+	}
+	if _, ok := tokens.reset[hashToken(raw)]; ok {
+		t.Fatal("expected the reset token to be consumed after the retry succeeds")
+	}
+}
+
+func TestService_VerifyEmail_DBFailureAllowsRetry(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	repo := &fakeRepo{
+		user:          &domain.User{ID: userID},
+		updateUserErr: errors.New("database unavailable"),
+	}
+	tokens := newFakeTokenStore()
+	raw := "verify-token"
+	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	if err := svc.VerifyEmail(ctx, raw); status(t, err) != http.StatusInternalServerError {
+		t.Fatalf("expected a 500 on the simulated DB failure, got %v", err)
+	}
+	repo.updateUserErr = nil
+	if err := svc.VerifyEmail(ctx, raw); err != nil {
+		t.Fatalf("retry should succeed after the transaction rollback: %v", err)
+	}
+}
+
+func TestService_ResetPassword_DuplicateTokenIsRejected(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &domain.User{ID: userID},
+		identity: &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
+	}
+	tokens := newFakeTokenStore()
+	raw := "one-time-reset-token"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+	if err := svc.ResetPassword(ctx, raw, "new-password"); err != nil {
+		t.Fatalf("first use: %v", err)
+	}
+	if err := svc.ResetPassword(ctx, raw, "another-password"); code(err) != "AUTH_INVALID_TOKEN" {
+		t.Fatalf("second use should be rejected as invalid, got %v", err)
+	}
+}
+
+func TestService_ResetPassword_ConcurrentPresentationHasOneWinner(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	passwordHash := "old-hash"
+	repo := &fakeRepo{
+		user:     &domain.User{ID: userID},
+		identity: &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
+	}
+	tokens := newFakeTokenStore()
+	raw := "concurrent-reset-token"
+	if err := tokens.SetPasswordResetToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	const callers = 8
+	start := make(chan struct{})
+	results := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			results <- svc.ResetPassword(ctx, raw, "new-password")
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		if err := <-results; err == nil {
+			winners++
+		} else if code(err) != "AUTH_INVALID_TOKEN" {
+			t.Fatalf("unexpected loser error: %v", err)
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one reset winner, got %d", winners)
+	}
+}
+
+func TestService_VerifyEmail_DuplicateTokenIsRejected(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	repo := &fakeRepo{user: &domain.User{ID: userID}}
+	tokens := newFakeTokenStore()
+	raw := "one-time-verification-token"
+	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+	if err := svc.VerifyEmail(ctx, raw); err != nil {
+		t.Fatalf("first use: %v", err)
+	}
+	if err := svc.VerifyEmail(ctx, raw); code(err) != "AUTH_INVALID_TOKEN" {
+		t.Fatalf("second use should be rejected as invalid, got %v", err)
+	}
+}
+
+func TestService_VerifyEmail_ConcurrentPresentationHasOneWinner(t *testing.T) {
+	ctx := context.Background()
+	userID := uuid.New()
+	repo := &fakeRepo{user: &domain.User{ID: userID}}
+	tokens := newFakeTokenStore()
+	raw := "concurrent-verification-token"
+	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	svc := newTestService(repo, tokens)
+
+	const callers = 32
+	start := make(chan struct{})
+	results := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			results <- svc.VerifyEmail(ctx, raw)
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		if err := <-results; err == nil {
+			winners++
+		} else if code(err) != "AUTH_INVALID_TOKEN" {
+			t.Fatalf("unexpected loser error: %v", err)
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one verification winner, got %d", winners)
+	}
+}
+
+// The control that actually stops credential stuffing: the counter follows the
+// account, so spreading attempts across a proxy pool doesn't help.
+func TestService_Login_LocksTheAccountAfterRepeatedFailures(t *testing.T) {
+	repo := &fakeRepo{
+		user:     &domain.User{ID: uuid.New(), Email: "a@example.com"},
+		failures: map[string]int{},
+	}
+	svc := newTestService(repo, newFakeTokenStore())
+	in := LoginInput{Email: "a@example.com", Password: "wrong"}
+
+	// the free attempts answer "wrong password", not "locked"
+	for i := 0; i < loginFreeAttempts; i++ {
+		if _, err := svc.Login(context.Background(), in); err == nil {
+			t.Fatalf("attempt %d: expected a failure", i+1)
+		} else if code(err) != "AUTH_INVALID_CREDENTIALS" {
+			t.Fatalf("attempt %d: expected AUTH_INVALID_CREDENTIALS, got %s", i+1, code(err))
+		}
+	}
+
+	// the next one trips the lock...
+	if _, err := svc.Login(context.Background(), in); code(err) != "AUTH_INVALID_CREDENTIALS" {
+		t.Fatalf("the attempt that trips the lock still answers as a bad password, got %s", code(err))
+	}
+	// ...and everything after it is refused before any password is checked
+	if _, err := svc.Login(context.Background(), in); code(err) != "AUTH_TOO_MANY_ATTEMPTS" {
+		t.Fatalf("expected AUTH_TOO_MANY_ATTEMPTS once locked, got %s", code(err))
+	}
+}
+
+// A locked login must not lock the reset that fixes it — the person who forgot
+// their password is exactly the person who trips the login counter.
+func TestService_ForgotPassword_HasItsOwnCounter(t *testing.T) {
+	if throttleKey("login", "a@example.com") == throttleKey("pwreset", "a@example.com") {
+		t.Fatal("login and password-reset share a throttle key; a locked login would block recovery")
+	}
+}
+
+// code pulls the AppError code out, so a test asserting on behaviour doesn't
+// have to care how the error is wrapped.
+func code(err error) string {
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		return ruleErr.Code
+	}
+	return fmt.Sprintf("%v", err)
+}