OtpApplicationService.java

package org.nkcoder.user.application.service;

import java.time.LocalDateTime;
import java.util.Arrays;
import java.util.Optional;
import java.util.stream.Collectors;
import org.nkcoder.shared.kernel.domain.event.DomainEventPublisher;
import org.nkcoder.shared.kernel.domain.event.OtpRequestedEvent;
import org.nkcoder.shared.kernel.domain.event.UserRegisteredEvent;
import org.nkcoder.shared.kernel.exception.AuthenticationException;
import org.nkcoder.shared.kernel.exception.ValidationException;
import org.nkcoder.user.application.dto.command.RequestOtpCommand;
import org.nkcoder.user.application.dto.command.VerifyOtpCommand;
import org.nkcoder.user.application.dto.response.AuthResult;
import org.nkcoder.user.domain.model.Email;
import org.nkcoder.user.domain.model.OtpCode;
import org.nkcoder.user.domain.model.OtpToken;
import org.nkcoder.user.domain.model.RefreshToken;
import org.nkcoder.user.domain.model.TokenFamily;
import org.nkcoder.user.domain.model.TokenPair;
import org.nkcoder.user.domain.model.User;
import org.nkcoder.user.domain.model.UserName;
import org.nkcoder.user.domain.repository.OtpTokenRepository;
import org.nkcoder.user.domain.repository.RefreshTokenRepository;
import org.nkcoder.user.domain.repository.UserRepository;
import org.nkcoder.user.domain.service.OtpHasher;
import org.nkcoder.user.domain.service.TokenGenerator;
import org.nkcoder.user.domain.service.TokenRotationService;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
public class OtpApplicationService {

    private static final Logger logger = LoggerFactory.getLogger(OtpApplicationService.class);

    private static final String USER_NOT_FOUND = "User not found";
    private static final String INVALID_OTP = "Invalid or expired OTP";
    private static final String TOO_MANY_REQUESTS = "Too many OTP requests. Please try again later.";
    private static final String MAX_ATTEMPTS_EXCEEDED = "Maximum verification attempts exceeded";

    private static final int RATE_LIMIT_WINDOW_MINUTES = 15;
    private static final int MAX_REQUESTS_PER_WINDOW = 3;

    private final UserRepository userRepository;
    private final OtpTokenRepository otpTokenRepository;
    private final RefreshTokenRepository refreshTokenRepository;
    private final OtpHasher otpHasher;
    private final TokenGenerator tokenGenerator;
    private final TokenRotationService tokenRotationService;
    private final DomainEventPublisher eventPublisher;

    public OtpApplicationService(
            UserRepository userRepository,
            OtpTokenRepository otpTokenRepository,
            RefreshTokenRepository refreshTokenRepository,
            OtpHasher otpHasher,
            TokenGenerator tokenGenerator,
            TokenRotationService tokenRotationService,
            DomainEventPublisher eventPublisher) {
        this.userRepository = userRepository;
        this.otpTokenRepository = otpTokenRepository;
        this.refreshTokenRepository = refreshTokenRepository;
        this.otpHasher = otpHasher;
        this.tokenGenerator = tokenGenerator;
        this.tokenRotationService = tokenRotationService;
        this.eventPublisher = eventPublisher;
    }

    @Transactional
    public void requestOtp(RequestOtpCommand command) {
        logger.debug("OTP request for email: {}", command.email());

        Email email = Email.of(command.email());

        validateRateLimit(email);

        User user = userRepository.findByEmail(email).orElseGet(() -> registerNewUser(email));

        otpTokenRepository.deleteByEmail(email);

        OtpCode rawOtp = OtpCode.generate();
        String hashedOtp = otpHasher.hash(rawOtp.value());

        OtpToken otpToken = OtpToken.create(email, hashedOtp);
        otpTokenRepository.save(otpToken);

        eventPublisher.publish(new OtpRequestedEvent(
                email.value(), user.getName().value(), rawOtp.value(), OtpToken.EXPIRATION_MINUTES));

        logger.debug("OTP requested successfully for email: {}", email.value());
    }

    private void validateRateLimit(Email email) {
        LocalDateTime windowStart = LocalDateTime.now().minusMinutes(RATE_LIMIT_WINDOW_MINUTES);
        int recentRequests = otpTokenRepository.countRecentRequests(email, windowStart);
        if (recentRequests >= MAX_REQUESTS_PER_WINDOW) {
            throw new ValidationException(TOO_MANY_REQUESTS);
        }
    }

    private User registerNewUser(Email email) {
        UserName name = generateNameFromEmail(email);
        User newUser = User.registerWithOtp(email, name);
        User savedUser = userRepository.save(newUser);

        eventPublisher.publish(new UserRegisteredEvent(
                savedUser.getId().value(),
                savedUser.getEmail().value(),
                savedUser.getName().value()));

        logger.debug("Auto-registered new user with email: {}", email.value());
        return savedUser;
    }

    private UserName generateNameFromEmail(Email email) {
        return Optional.of(email.value())
                .map(e -> e.split("@")[0])
                .map(localPart -> localPart.replace(".", " ").replace("_", " ").replace("-", " "))
                .map(this::capitalizeWords)
                .map(UserName::of)
                .orElseGet(() -> UserName.of("User"));
    }

    private String capitalizeWords(String input) {
        return Arrays.stream(input.split("\\s+"))
                .filter(part -> !part.isEmpty())
                .map(part ->
                        part.substring(0, 1).toUpperCase() + part.substring(1).toLowerCase())
                .collect(Collectors.joining(" "));
    }

    @Transactional
    public AuthResult verifyOtp(VerifyOtpCommand command) {
        logger.debug("OTP verification for email: {}", command.email());

        Email email = Email.of(command.email());

        OtpToken otpToken =
                otpTokenRepository.findByEmail(email).orElseThrow(() -> new AuthenticationException(INVALID_OTP));

        if (!otpToken.isValid()) {
            otpTokenRepository.deleteByEmail(email);
            String message = otpToken.isMaxAttemptsExceeded() ? MAX_ATTEMPTS_EXCEEDED : INVALID_OTP;
            throw new AuthenticationException(message);
        }

        if (!otpHasher.verify(command.otp(), otpToken.getHashedOtp())) {
            otpToken.incrementAttempts();
            otpTokenRepository.updateAttempts(email, otpToken.getAttempts());

            if (otpToken.isMaxAttemptsExceeded()) {
                otpTokenRepository.deleteByEmail(email);
                throw new AuthenticationException(MAX_ATTEMPTS_EXCEEDED);
            }
            throw new AuthenticationException(INVALID_OTP);
        }

        otpTokenRepository.deleteByEmail(email);

        User user = userRepository.findByEmail(email).orElseThrow(() -> new AuthenticationException(USER_NOT_FOUND));

        // Mark email as verified since OTP verification proves email ownership
        if (!user.isEmailVerified()) {
            user.verifyEmail();
            userRepository.save(user);
        }

        userRepository.updateLastLoginAt(user.getId(), LocalDateTime.now());

        TokenFamily tokenFamily = TokenFamily.generate();
        TokenPair tokens = tokenRotationService.generateTokens(user, tokenFamily);

        RefreshToken refreshToken = RefreshToken.create(
                tokens.refreshToken(), tokenFamily, user.getId(), tokenGenerator.getRefreshTokenExpiry());
        refreshTokenRepository.save(refreshToken);

        logger.debug("OTP verified successfully for email: {}", email.value());
        return AuthResult.of(user.getId().value(), user.getEmail().value(), user.getRole(), tokens);
    }

    @Transactional
    public void cleanupExpiredTokens() {
        logger.debug("Cleaning up expired OTP tokens");
        otpTokenRepository.deleteExpiredTokens(LocalDateTime.now());
    }
}