fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

test/write_not_found_errors_test.go

@@ -131,6 +131,12 @@ func TestTheUserRepositoryReportsAMissingUserAsADomainErrorOnAWrite(t *testing.T
 		assertWriteResultIsUserNotFound(t, err)
 	})
 
+	t.Run("ResetPassword and hashedPassword newHashedPassword", func(t *testing.T) {
+		repo := newSeededUserRepository(t)
+		_, err := repo.ResetPassword(9, "newHashedPassword")
+		assertWriteResultIsUserNotFound(t, err)
+	})
+
 	t.Run("Delete", func(t *testing.T) {
 		repo := newSeededUserRepository(t)
 		err := repo.Delete(9)
@@ -138,6 +144,40 @@ func TestTheUserRepositoryReportsAMissingUserAsADomainErrorOnAWrite(t *testing.T
 	})
 }
 
+func TestTheUserRepositoryResetPasswordAdvancesTokenVersionOnASuccessfulWrite(t *testing.T) {
+	repo := newSeededUserRepository(t)
+	seeded, err := repo.GetByUsername("alice")
+	if err != nil {
+		t.Fatalf("failed to load seeded user: %v", err)
+	}
+
+	updated, err := repo.ResetPassword(seeded.ID, "newHashedPassword")
+
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+	if updated.TokenVersion != seeded.TokenVersion+1 {
+		t.Errorf("expected TokenVersion %d, got %d", seeded.TokenVersion+1, updated.TokenVersion)
+	}
+	if updated.Password != "newHashedPassword" {
+		t.Errorf("expected password to be updated, got %q", updated.Password)
+	}
+	if updated.PasswordResetCode != "" {
+		t.Errorf("expected PasswordResetCode to be cleared, got %q", updated.PasswordResetCode)
+	}
+	if !updated.PasswordResetExpiration.IsZero() {
+		t.Errorf("expected PasswordResetExpiration to be zeroed, got %v", updated.PasswordResetExpiration)
+	}
+
+	reloaded, err := repo.Get(seeded.ID)
+	if err != nil {
+		t.Fatalf("failed to reload user: %v", err)
+	}
+	if reloaded.TokenVersion != seeded.TokenVersion+1 {
+		t.Errorf("expected persisted TokenVersion %d, got %d", seeded.TokenVersion+1, reloaded.TokenVersion)
+	}
+}
+
 func TestTheImageRepositoryReportsAMissingImageAsADomainErrorOnDelete(t *testing.T) {
 	db := openInMemoryDb(t)
 	if err := db.AutoMigrate(&models.Image{}); err != nil {