fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

internal/domain/user/userDomain.go

@@ -24,6 +24,7 @@ type User struct {
 	VerificationCode        string    `json:"verification_code"`
 	VerificationExpiration  time.Time `json:"verification_expiration"`
 	PasswordResetExpiration time.Time `json:"password_reset_expiration"`
+	TokenVersion            uint32    `json:"token_version"`
 	CreatedAt               time.Time `json:"created_at"`
 	UpdatedAt               time.Time `json:"updated_at"`
 }

internal/infrastructure/persistence/mappers/userMapper.go

@@ -30,6 +30,7 @@ func UserToDomain(m models.User) user.User {
 		VerificationCode:        nullableStringToDomain(m.VerificationCode),
 		VerificationExpiration:  m.VerificationExpiration,
 		PasswordResetExpiration: m.PasswordResetExpiration,
+		TokenVersion:            m.TokenVersion,
 		CreatedAt:               m.CreatedAt,
 		UpdatedAt:               m.UpdatedAt,
 	}
@@ -45,6 +46,7 @@ func UserToModel(a user.User) models.User {
 		VerificationCode:        DomainToNullableString(a.VerificationCode),
 		VerificationExpiration:  a.VerificationExpiration,
 		PasswordResetExpiration: a.PasswordResetExpiration,
+		TokenVersion:            a.TokenVersion,
 		CreatedAt:               a.CreatedAt,
 		UpdatedAt:               a.UpdatedAt,
 	}

internal/infrastructure/persistence/models/userModel.go

@@ -14,6 +14,7 @@ type User struct {
 	VerificationCode        *string `gorm:"unique"`
 	VerificationExpiration  time.Time
 	PasswordResetExpiration time.Time
+	TokenVersion            uint32    `gorm:"default:0;not null"`
 	CreatedAt               time.Time `gorm:"autoCreateTime"`
 	UpdatedAt               time.Time `gorm:"autoUpdateTime"`
 }

internal/infrastructure/persistence/repositories/userRepository.go

@@ -160,6 +160,7 @@ func (u *UserRepository) ResetPassword(userId uint32, hashedPassword string) (do
 	localUser.Password = hashedPassword
 	localUser.PasswordResetCode = mappers.DomainToNullableString("")
 	localUser.PasswordResetExpiration = time.Time{}
+	localUser.TokenVersion++
 	err = u.db.Save(&localUser).Error
 	if err != nil {
 		return domainUser.User{}, err