fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

test/reset_password_test.go

@@ -40,6 +40,27 @@ func TestResetPasswordUseCase(t *testing.T) {
 		}
 	})
 
+	t.Run("The use case itself advances TokenVersion by one on every successful reset, independently of any handler", func(t *testing.T) {
+		repo := newRepo(time.Now().Add(time.Hour))
+		repo.users[3] = user.User{
+			ID:                      3,
+			Email:                   "alice@example.com",
+			TokenVersion:            5,
+			PasswordResetCode:       "hashed:reset-code-1",
+			PasswordResetExpiration: time.Now().Add(time.Hour),
+		}
+		uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{})
+
+		err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1")
+
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if repo.users[3].TokenVersion != 6 {
+			t.Errorf("expected TokenVersion 6, got %d", repo.users[3].TokenVersion)
+		}
+	})
+
 	t.Run("The use case rejects a wrong code without touching the repository's ResetPassword method", func(t *testing.T) {
 		repo := newRepo(time.Now().Add(time.Hour))
 		uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{})