Creating additional activation tokens
You may also want to add a standalone endpoint to your API for generating activation tokens. This can be useful in scenarios where a user doesn’t activate their account in time, or they never receive their welcome email.
In this appendix, we’ll quickly run through the code for doing that, and add the following endpoint:
| Method | URL Pattern | Handler | Action |
|---|---|---|---|
| POST | /v1/tokens/activation | createActivationTokenHandler | Generate a new activation token |
The code for the createActivationTokenHandler handler should look like this:
... func (app *application) createActivationTokenHandler(w http.ResponseWriter, r *http.Request) { // Parse and validate the user's email address. var input struct { Email string `json:"email"` } err := app.readJSON(w, r, &input) if err != nil { app.badRequestResponse(w, r, err) return } v := validator.New() if data.ValidateEmail(v, input.Email); !v.Valid() { app.failedValidationResponse(w, r, v.Errors) return } // Try to retrieve the corresponding user record for the email address. If it can't // be found, return an error message to the client. user, err := app.models.Users.GetByEmail(input.Email) if err != nil { switch { case errors.Is(err, data.ErrRecordNotFound): v.AddError("email", "no matching email address found") app.failedValidationResponse(w, r, v.Errors) default: app.serverErrorResponse(w, r, err) } return } // Return an error if the user has already been activated. if user.Activated { v.AddError("email", "user has already been activated") app.failedValidationResponse(w, r, v.Errors) return } // Otherwise, create a new activation token. token, err := app.models.Tokens.New(user.ID, 3*24*time.Hour, data.ScopeActivation) if err != nil { app.serverErrorResponse(w, r, err) return } // Email the user with their additional activation token. app.background(func() { data := map[string]any{ "activationToken": token.Plaintext, } // Since email addresses MAY be case sensitive, notice that we are sending this // email using the address stored in our database for the user --- not to the // input.Email address provided by the client in this request. err := app.mailer.Send(user.Email, "token_activation.tmpl", data) if err != nil { app.logger.Error(err.Error()) } }) // Send a 202 Accepted response and confirmation message to the client. env := envelope{"message": "an email will be sent to you containing activation instructions"} err = app.writeJSON(w, http.StatusAccepted, env, nil) if err != nil { app.serverErrorResponse(w, r, err) } }
You’ll also need to create an internal/mailer/templates/token_activation.tmpl file containing the necessary email templates, similar to this:
{{define "subject"}}Activate your Greenlight account{{end}}
{{define "plainBody"}}
Hi,
Please send a `PUT /v1/users/activated` request with the following JSON body to activate your account:
{"token": "{{.activationToken}}"}
Please note that this is a one-time use token and it will expire in 3 days.
Thanks,
The Greenlight Team
{{end}}
{{define "htmlBody"}}
<!doctype html>
<html>
<head>
<meta name="viewport" content="width=device-width" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
</head>
<body>
<p>Hi,</p>
<p>Please send a <code>PUT /v1/users/activated</code> request with the following JSON body to activate your account:</p>
<pre><code>
{"token": "{{.activationToken}}"}
</code></pre>
<p>Please note that this is a one-time use token and it will expire in 3 days.</p>
<p>Thanks,</p>
<p>The Greenlight Team</p>
</body>
</html>
{{end}}
And update the cmd/api/routes.go file to include the new endpoint:
package main ... func (app *application) routes() http.Handler { router := httprouter.New() router.NotFound = http.HandlerFunc(app.notFoundResponse) router.MethodNotAllowed = http.HandlerFunc(app.methodNotAllowedResponse) router.HandlerFunc(http.MethodGet, "/v1/healthcheck", app.healthcheckHandler) router.HandlerFunc(http.MethodGet, "/v1/movies", app.requirePermission("movies:read", app.listMoviesHandler)) router.HandlerFunc(http.MethodPost, "/v1/movies", app.requirePermission("movies:write", app.createMovieHandler)) router.HandlerFunc(http.MethodGet, "/v1/movies/:id", app.requirePermission("movies:read", app.showMovieHandler)) router.HandlerFunc(http.MethodPatch, "/v1/movies/:id", app.requirePermission("movies:write", app.updateMovieHandler)) router.HandlerFunc(http.MethodDelete, "/v1/movies/:id", app.requirePermission("movies:write", app.deleteMovieHandler)) router.HandlerFunc(http.MethodPost, "/v1/users", app.registerUserHandler) router.HandlerFunc(http.MethodPut, "/v1/users/activated", app.activateUserHandler) router.HandlerFunc(http.MethodPut, "/v1/users/password", app.updateUserPasswordHandler) router.HandlerFunc(http.MethodPost, "/v1/tokens/authentication", app.createAuthenticationTokenHandler) // Add the POST /v1/tokens/activation endpoint. router.HandlerFunc(http.MethodPost, "/v1/tokens/activation", app.createActivationTokenHandler) router.HandlerFunc(http.MethodPost, "/v1/tokens/password-reset", app.createPasswordResetTokenHandler) router.Handler(http.MethodGet, "/debug/vars", expvar.Handler()) return app.metrics(app.recoverPanic(app.enableCORS(app.rateLimit(app.authenticate(router))))) }
Now that those things are all in place, a user can request a new activation token by submitting their email address like this:
$ curl -X POST -d '{"email": "bob@example.com"}' localhost:4000/v1/tokens/activation
{
"message": "an email will be sent to you containing activation instructions"
}
The token will be sent to them in an email, and they can then submit the token to the PUT /v1/users/activated endpoint to activate their account, in exactly the same way as if they received the token in their welcome email.
If you implement an endpoint like this, it’s important to note that this would allow users to potentially have multiple valid activation tokens ‘on the go’ at any one time. That’s fine — but you just need to make sure that you delete all the activation tokens for a user once they’ve successfully activated (not just the token that they used).
And again, if your API is the backend for a website, then you can tweak the emails and workflow to make it more intuitive by using the same kind of patterns that we’ve talked about previously.