Class EmailVerificationService

java.lang.Object

com.svenruppert.jsentinel.accountlifecycle.EmailVerificationService

@ExperimentalJSentinelApi
public final class EmailVerificationService
extends Object

Email-verification workflow over an EmailVerificationTokenStore.

Mirrors PasswordResetService but carries the verified email address on the record (a password-reset record has no such field). Three-step lifecycle:

1. request(subject, email, ttl) — generates a plain token, persists only its hash with the email it confirms, emits EmailVerificationRequested, hands the plain token to the JSentinelNotificationSender.
2. validate(plain) — looks the token up; returns the record only when live, in this tenant, not consumed, not expired.
3. consume(plain) — marks the token consumed exactly once and emits EmailVerified.

Bound to one TenantId at construction.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	EmailVerificationService.IssuedToken	Tuple returned from request: the plain token (caller forwards it via the notification sender) and the persisted record (handy for tests / audit hooks).

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_TOKEN_BYTES	Default token entropy in bytes (256 bits).

Constructor Summary

Constructors

Constructor	Description
EmailVerificationService(EmailVerificationTokenStore store, PasswordHasher hasher, JSentinelAuditService auditService, JSentinelNotificationSender notificationSender)	Convenience constructor: tenant TenantId.DEFAULT, system clock, 256-bit token source.
EmailVerificationService(EmailVerificationTokenStore store, PasswordHasher hasher, JSentinelAuditService auditService, JSentinelNotificationSender notificationSender, TenantId tenant, Clock clock, Supplier<String> tokenSource)	Full constructor.

Method Summary

Modifier and Type	Method	Description
Optional<EmailVerificationTokenRecord>	consume(String plainToken)	Marks the token consumed exactly once, emits EmailVerified and a JSentinelNotification.Kind.EMAIL_VERIFIED notification.
int	purgeExpired()	Purges every expired record in the backing store.
EmailVerificationService.IssuedToken	request(SubjectId subjectId, String email, Duration ttl)	Issues a verification token for subjectId / email.
int	revokeAll(SubjectId subjectId)	Drops every token issued to subjectId in this service's tenant.
Optional<EmailVerificationTokenRecord>	validate(String plainToken)	Validates a candidate plain token.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_TOKEN_BYTES

public static final int DEFAULT_TOKEN_BYTES

Default token entropy in bytes (256 bits).

See Also:

• Constant Field Values

Constructor Details

EmailVerificationService

public EmailVerificationService(EmailVerificationTokenStore store,
 PasswordHasher hasher,
 JSentinelAuditService auditService,
 JSentinelNotificationSender notificationSender)

Convenience constructor: tenant TenantId.DEFAULT, system clock, 256-bit token source.

Parameters:

store - backing token store; non-null

hasher - password hasher used to hash tokens; non-null

auditService - audit sink; non-null

notificationSender - notification dispatcher; non-null

EmailVerificationService

public EmailVerificationService(EmailVerificationTokenStore store,
 PasswordHasher hasher,
 JSentinelAuditService auditService,
 JSentinelNotificationSender notificationSender,
 TenantId tenant,
 Clock clock,
 Supplier<String> tokenSource)

Full constructor.

Parameters:

store - backing token store; non-null

hasher - password hasher used to hash tokens; non-null

auditService - audit sink; non-null

notificationSender - notification dispatcher; non-null

tenant - tenant scope; null becomes TenantId.DEFAULT

clock - time source; non-null

tokenSource - plain-token supplier; non-null, non-blank

Method Details

request

public EmailVerificationService.IssuedToken request(SubjectId subjectId,
 String email,
 Duration ttl)

Issues a verification token for subjectId / email.

Parameters:

subjectId - subject whose email is being verified; non-null

email - email address being verified; non-blank

ttl - token lifetime; strictly positive

Returns:

issued token (plain value + persisted record)

validate

public Optional<EmailVerificationTokenRecord> validate(String plainToken)

Validates a candidate plain token. Live records only.

Parameters:

plainToken - plain token; null/blank yields empty

Returns:

matching live record, if any

consume

public Optional<EmailVerificationTokenRecord> consume(String plainToken)

Marks the token consumed exactly once, emits EmailVerified and a JSentinelNotification.Kind.EMAIL_VERIFIED notification.

Parameters:

plainToken - plain token; null/blank yields empty

Returns:

consumed record on the successful transition, empty otherwise

revokeAll

public int revokeAll(SubjectId subjectId)

Drops every token issued to subjectId in this service's tenant.

Parameters:

subjectId - subject; non-null

Returns:

number of tokens removed

purgeExpired

public int purgeExpired()

Purges every expired record in the backing store. Spans all tenants.

Returns:

number of records purged