fixes for action token

sql/03_action_token.sql

@@ -0,0 +1,9 @@
+create table if not exists action_tokens (
+    id int generated always as identity,
+    user_id int,
+    value text
+    target int,
+    expiration timestamp,
+
+    primary key(id)
+);

src/core/models/action_token.go

@@ -1,5 +1,7 @@
 package models
 
+import "time"
+
 type ActionTokenTarget int
 
 const (
@@ -12,4 +14,5 @@ type ActionTokenDTO struct {
 	UserId     string
 	Value      string
 	Target     ActionTokenTarget
+	Expiration time.Time
 }

src/core/repos/action_token.go

@@ -4,6 +4,7 @@ import (
 	"backend/src/core/models"
 	"backend/src/integrations"
 	"context"
+	"database/sql"
 )
 
 type ActionTokenRepo interface {
@@ -24,10 +25,10 @@ type actionTokenRepo struct {
 func (a *actionTokenRepo) CreateActionToken(ctx context.Context, dto models.ActionTokenDTO) (*models.ActionTokenDTO, error) {
 	query := `
 	insert into 
-		action_tokens (user_id, value, target) 
+		action_tokens (user_id, value, target, expiration) 
-		values ($1, $2, $3) 
+		values ($1, $2, $3, $4) 
 		returning id;`
-	row := a.db.QueryRowContext(ctx, query, dto.UserId, dto.Value, dto.Target)
+	row := a.db.QueryRowContext(ctx, query, dto.UserId, dto.Value, dto.Target, dto.Expiration)
 
 	id := ""
 	if err := row.Scan(&id); err != nil {
@@ -46,12 +47,18 @@ func (a *actionTokenRepo) PopActionToken(ctx context.Context, userId, value stri
 	query := `
 	delete 
 		from action_tokens 
-		where user_id=$1 and value=$2 and target=$3 
+		where 
+			user_id=$1 and value=$2 and target=$3 
+			and CURRENT_TIMESTAMP < expiration
 		returning id;`
 	row := a.db.QueryRowContext(ctx, query, userId, value, target)
 
 	id := ""
-	if err := row.Scan(&id); err != nil {
+	err := row.Scan(&id)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
 		return nil, err
 	}
 

src/core/services/user_service.go

@@ -125,6 +125,7 @@ func (u *userService) HelpPasswordForgot(ctx context.Context, userId string) err
 			UserId:     user.Id,
 			Value:      uuid.New().String(),
 			Target:     models.ActionTokenTargetForgotPassword,
+			Expiration: time.Now().Add(1 * time.Hour),
 		},
 	)
 	if err != nil {