Add optional email verification and registration control

Implemented email service infrastructure with SMTP support and optional email verification for self-hosted deployments. Registration flow now supports open/closed modes and hardcoded Apocapoc branding.

Key features:
- Email service with SMTP and template rendering
- Optional email verification (auto-verified without SMTP config)
- Registration modes: open/closed for access control
- Hardcoded Apocapoc branding (AppName, AppURL, DefaultFrom)
- Separate registration and login flows (registration no longer returns tokens)

internal/infrastructure/persistence/sqlite/migrations.go

@@ -2,6 +2,7 @@ package sqlite
 
 import (
 	"database/sql"
+	"fmt"
 )
 
 func RunMigrations(db *sql.DB) error {
@@ -18,9 +19,50 @@ func RunMigrations(db *sql.DB) error {
 			return err
 		}
 	}
+
+	if err := addEmailVerificationColumns(db); err != nil {
+		return err
+	}
+
 	return nil
 }
 
+func addEmailVerificationColumns(db *sql.DB) error {
+	columns := []struct {
+		name       string
+		definition string
+	}{
+		{"email_verified", "ALTER TABLE users ADD COLUMN email_verified BOOLEAN DEFAULT 0"},
+		{"email_verification_token", "ALTER TABLE users ADD COLUMN email_verification_token TEXT"},
+		{"email_verification_expiry", "ALTER TABLE users ADD COLUMN email_verification_expiry DATETIME"},
+	}
+
+	for _, col := range columns {
+		exists, err := columnExists(db, "users", col.name)
+		if err != nil {
+			return err
+		}
+
+		if !exists {
+			if _, err := db.Exec(col.definition); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func columnExists(db *sql.DB, table, column string) (bool, error) {
+	query := fmt.Sprintf("SELECT COUNT(*) FROM pragma_table_info('%s') WHERE name = ?", table)
+	var count int
+	err := db.QueryRow(query, column).Scan(&count)
+	if err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
 const createUsersTable = `
 CREATE TABLE IF NOT EXISTS users (
 	id TEXT PRIMARY KEY,

internal/infrastructure/persistence/sqlite/user_repository.go

@@ -24,8 +24,8 @@ func (r *UserRepository) Create(ctx context.Context, user *entities.User) error
 	user.ID = uuid.New().String()
 
 	query := `
-		INSERT INTO users (id, email, password_hash, timezone, created_at, updated_at)
-		VALUES (?, ?, ?, ?, ?, ?)
+		INSERT INTO users (id, email, password_hash, timezone, email_verified, email_verification_token, email_verification_expiry, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`
 
 	_, err := r.db.ExecContext(ctx, query,
@@ -33,6 +33,9 @@ func (r *UserRepository) Create(ctx context.Context, user *entities.User) error
 		user.Email,
 		user.PasswordHash,
 		user.Timezone,
+		user.EmailVerified,
+		user.EmailVerificationToken,
+		user.EmailVerificationExpiry,
 		user.CreatedAt,
 		user.UpdatedAt,
 	)
@@ -49,7 +52,7 @@ func (r *UserRepository) Create(ctx context.Context, user *entities.User) error
 
 func (r *UserRepository) FindByID(ctx context.Context, id string) (*entities.User, error) {
 	query := `
-		SELECT id, email, password_hash, timezone, created_at, updated_at
+		SELECT id, email, password_hash, timezone, email_verified, email_verification_token, email_verification_expiry, created_at, updated_at
 		FROM users
 		WHERE id = ?
 	`
@@ -60,6 +63,9 @@ func (r *UserRepository) FindByID(ctx context.Context, id string) (*entities.Use
 		&user.Email,
 		&user.PasswordHash,
 		&user.Timezone,
+		&user.EmailVerified,
+		&user.EmailVerificationToken,
+		&user.EmailVerificationExpiry,
 		&user.CreatedAt,
 		&user.UpdatedAt,
 	)
@@ -76,7 +82,7 @@ func (r *UserRepository) FindByID(ctx context.Context, id string) (*entities.Use
 
 func (r *UserRepository) FindByEmail(ctx context.Context, email string) (*entities.User, error) {
 	query := `
-		SELECT id, email, password_hash, timezone, created_at, updated_at
+		SELECT id, email, password_hash, timezone, email_verified, email_verification_token, email_verification_expiry, created_at, updated_at
 		FROM users
 		WHERE email = ?
 	`
@@ -87,6 +93,9 @@ func (r *UserRepository) FindByEmail(ctx context.Context, email string) (*entiti
 		&user.Email,
 		&user.PasswordHash,
 		&user.Timezone,
+		&user.EmailVerified,
+		&user.EmailVerificationToken,
+		&user.EmailVerificationExpiry,
 		&user.CreatedAt,
 		&user.UpdatedAt,
 	)
@@ -101,10 +110,40 @@ func (r *UserRepository) FindByEmail(ctx context.Context, email string) (*entiti
 	return &user, nil
 }
 
+func (r *UserRepository) FindByVerificationToken(ctx context.Context, token string) (*entities.User, error) {
+	query := `
+		SELECT id, email, password_hash, timezone, email_verified, email_verification_token, email_verification_expiry, created_at, updated_at
+		FROM users
+		WHERE email_verification_token = ?
+	`
+
+	var user entities.User
+	err := r.db.QueryRowContext(ctx, query, token).Scan(
+		&user.ID,
+		&user.Email,
+		&user.PasswordHash,
+		&user.Timezone,
+		&user.EmailVerified,
+		&user.EmailVerificationToken,
+		&user.EmailVerificationExpiry,
+		&user.CreatedAt,
+		&user.UpdatedAt,
+	)
+
+	if err == sql.ErrNoRows {
+		return nil, errors.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to find user by verification token: %w", err)
+	}
+
+	return &user, nil
+}
+
 func (r *UserRepository) Update(ctx context.Context, user *entities.User) error {
 	query := `
 		UPDATE users
-		SET email = ?, password_hash = ?, timezone = ?, updated_at = ?
+		SET email = ?, password_hash = ?, timezone = ?, email_verified = ?, email_verification_token = ?, email_verification_expiry = ?, updated_at = ?
 		WHERE id = ?
 	`
 
@@ -112,6 +151,9 @@ func (r *UserRepository) Update(ctx context.Context, user *entities.User) error
 		user.Email,
 		user.PasswordHash,
 		user.Timezone,
+		user.EmailVerified,
+		user.EmailVerificationToken,
+		user.EmailVerificationExpiry,
 		user.UpdatedAt,
 		user.ID,
 	)