feat(users): Email JWT blacklist

[racnan]

Type of Change

• Bugfix
• New feature
• Enhancement
• Refactoring
• Dependency updates
• Documentation
• CI/CD

Description

• Adding blacklisting for email tokens, this will prevent use of same email token to be used twice.
• Change Password & Reset Password logs out user from all open dashboard sessions.

Additional Changes

• This PR modifies the API contract
• This PR modifies the database schema
• This PR modifies application configuration/environment variables

Motivation and Context

Prevention of use of same email link to be used twice.
Forcing Users to re-enter password if password is changed.

How did you test it?

With Dashboard Frontend.
Following links should not work twice:

• Magic Link
  To generate magic link email use dashboard frontend or below curl.

curl --location --request POST '<URL>/user/connect_account' \
--header 'Content-Type: application/json' \
--data-raw '{
    "email": ""
}'

• Reset Password
  To generate reset password email use dashboard frontend or below curl.

curl --location --request POST '<URL>/user/forgot_password' \
--header 'Content-Type: application/json' \
--data-raw '{
    "email": ""
}'

All sessions should be logged out after change password or reset password.

Expected error response for the use of email token twice

{
    "error": {
        "type": "invalid_request",
        "message": "Invalid or expired link",
        "code": "UR_04"
    }
}

Checklist

• I formatted the code cargo +nightly fmt --all
• I addressed lints thrown by cargo clippy
• I reviewed the submitted code
• I added unit tests for my changes where possible
• I added a CHANGELOG entry if applicable

[ThisIsMani]

Minor suggestions

[NishantJoshi00]

remove this