Spring Security Registration: Email Verification & Account Activation

public record UserRegistrationRequest(
    @NotBlank @Email String email,
    @NotBlank @Size(min = 8, max = 100) String password,
    @NotBlank String firstName,
    @NotBlank String lastName
) {}

@Entity
public class VerificationToken {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, unique = true)
    private String token;

    @OneToOne(targetEntity = User.class, fetch = FetchType.EAGER)
    @JoinColumn(nullable = false, name = "user_id")
    private User user;

    @Column(nullable = false)
    private LocalDateTime expiryDate;

    private LocalDateTime usedAt; // null if not used

    public VerificationToken(String token, User user, LocalDateTime expiryDate) {
        this.token = token;
        this.user = user;
        this.expiryDate = expiryDate;
        this.usedAt = null;
    }

    public boolean isExpired() {
        return LocalDateTime.now().isAfter(expiryDate);
    }

    public boolean isUsed() {
        return usedAt != null;
    }

    public void markUsed() {
        this.usedAt = LocalDateTime.now();
    }
}

@Service
public class EmailService {
    @Autowired
    private JavaMailSender mailSender;

    @Value("${app.base-url}")
    private String baseUrl;

    public void sendVerificationEmail(User user, String token) {
        String link = baseUrl + "/api/auth/verify?token=" + token + "&userId=" + user.getId();
        MimeMessage message = mailSender.createMimeMessage();
        MimeMessageHelper helper = new MimeMessageHelper(message, true, "UTF-8");
        try {
            helper.setTo(user.getEmail());
            helper.setSubject("Verify your email");
            helper.setText("<p>Click <a href='" + link + "'>here</a> to verify your email.</p>", true);
            mailSender.send(message);
        } catch (MessagingException e) {
            throw new RuntimeException("Failed to send email", e);
        }
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {
    @Autowired
    private VerificationTokenService tokenService;

    @GetMapping("/verify")
    public ResponseEntity<String> verifyEmail(@RequestParam String token, @RequestParam Long userId) {
        String result = tokenService.verifyToken(token, userId);
        return switch (result) {
            case "valid" -> ResponseEntity.ok("Email verified successfully");
            case "expired" -> ResponseEntity.status(HttpStatus.GONE).body("Token expired");
            case "used" -> ResponseEntity.status(HttpStatus.CONFLICT).body("Token already used");
            default -> ResponseEntity.badRequest().body("Invalid token");
        };
    }
}

@Service
public class VerificationTokenService {
    @Autowired
    private VerificationTokenRepository tokenRepository;

    public String verifyToken(String rawToken, Long userId) {
        // Hash the incoming token to compare with stored hash
        String hashedToken = hashToken(rawToken);
        VerificationToken token = tokenRepository.findByTokenAndUserId(hashedToken, userId);
        if (token == null) return "invalid";
        if (token.isExpired()) return "expired";
        if (token.isUsed()) return "used";
        token.markUsed();
        tokenRepository.save(token);
        // Enable user account
        userService.enableUser(userId);
        return "valid";
    }

    private String hashToken(String token) {
        try {
            MessageDigest digest = MessageDigest.getInstance("SHA-256");
            byte[] hash = digest.digest(token.getBytes(StandardCharsets.UTF_8));
            return bytesToHex(hash);
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("SHA-256 not available", e);
        }
    }
}

@WebMvcTest(AuthController.class)
class AuthControllerTest {
    @Autowired
    private MockMvc mockMvc;

    @MockBean
    private VerificationTokenService tokenService;

    @Test
    void verifyEmail_ValidToken_ReturnsOk() throws Exception {
        when(tokenService.verifyToken("validToken", 1L)).thenReturn("valid");

        mockMvc.perform(get("/api/auth/verify")
                .param("token", "validToken")
                .param("userId", "1"))
                .andExpect(status().isOk())
                .andExpect(content().string("Email verified successfully"));
    }

    @Test
    void verifyEmail_ExpiredToken_ReturnsGone() throws Exception {
        when(tokenService.verifyToken("expiredToken", 1L)).thenReturn("expired");

        mockMvc.perform(get("/api/auth/verify")
                .param("token", "expiredToken")
                .param("userId", "1"))
                .andExpect(status().isGone());
    }
}