Method sendVerificationEmail

backend/src/auth/auth.service.ts:88–106

(user: User)

    } catch (error) {
      return {
        message: 'Invalid or expired token',
        success: false,
      };
    }
  }

  /**
   * Sign an account out everywhere, right now. Returns how many access
   * tokens were killed.
   *
   * Both halves matter and neither is enough alone: the refresh tokens are
   * what would mint a fresh session for up to 7 days, and the cached access
   * tokens are what still work for up to 30 minutes. Anything that decides an
   * account's sessions must end calls this rather than one of the two —
   * password reset used to drop refresh tokens only, and admin deactivation
   * dropped neither.
   */
  async endAllSessions(userId: string): Promise<number> {
    await this.refreshTokenRepository.delete({ userId });
    return this.jwtCacheService.removeTokensForUser(userId);
  }