How to implement an email verification system with Go&MongoDB?

I currently give JWT tokens from my /signup:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2ODMwMjcwOTUsInR5cGUiOiJhd2FpdGluZy12ZXJpZmljYXRpb24iLCJ1dWlkIjoiNjQ0ZmEzMTc1MmQwODdhYjg1NmE2NTA3In0.nHZg6RGkYxWM2vy4YyFHxyq_Snb3o9NpoRiMgEKnY2o

which is just:

{
  "exp": 1683027095,
  "type": "awaiting-verification",
  "uuid": "644fa31752d087ab856a6507"
}

and can't wrap my head around how can I even send an email for verification. I planned to create a separate collection called "emailcodes", generate a random 6-digit number, let's say 123123, and insert into the collection like:

{
  "uuid": "644fa31752d087ab856a6507"
  "code": 123123
  "exp": 5-minutes-in-unix
}

and take the code from whitelisted (tokens that is type is awaiting-verification) endpoint /code-verification

The problem is, I do not know how can I send emails without screwing everything up like sending the same email a dozen times, etc. Is there a GoLang library for this? If there isn't how can I implement a system for this that even I cant screw it up?

I already verify if the email is valid and reachable with https://pkg.go.dev/github.com/AfterShip/email-verifier?utm_source=godoc

..Help?

Instead of explaining I think you should prefer good references with great use cases:

Mailing packages in Go

• Go's STD can handle this for sure: https://pkg.go.dev/net/mail (But, please have a look at the second option, too)
• I prefer to use this third-party package, coz I found it more flexible and user-friendly - jordan-wright/email. Additionally, I use this package for a while and got no issues with it. So, confidently recommended by my humble experience as a Gopher. BTW, there are too many other open-source options if you want to play with them. Thanks to the Go's great community!

Implementing email verification

• Firstly, you need to implement mailing service, and then verification. Here is the example using jordan-wright/email. Reference.

package mail

import (
	"fmt"
	"net/smtp"

	"github.com/jordan-wright/email"
)

const (
	smtpAuthAddress   = "smtp.gmail.com"
	smtpServerAddress = "smtp.gmail.com:587"
)

type EmailSender interface {
	SendEmail(
		subject string,
		content string,
		to []string,
		cc []string,
		bcc []string,
		attachFiles []string,
	) error
}

type GmailSender struct {
	name              string
	fromEmailAddress  string
	fromEmailPassword string
}

func NewGmailSender(name string, fromEmailAddress string, fromEmailPassword string) EmailSender {
	return &GmailSender{
		name:              name,
		fromEmailAddress:  fromEmailAddress,
		fromEmailPassword: fromEmailPassword,
	}
}

func (sender *GmailSender) SendEmail(
	subject string,
	content string,
	to []string,
	cc []string,
	bcc []string,
	attachFiles []string,
) error {
	e := email.NewEmail()
	e.From = fmt.Sprintf("%s <%s>", sender.name, sender.fromEmailAddress)
	e.Subject = subject
	e.HTML = []byte(content)
	e.To = to
	e.Cc = cc
	e.Bcc = bcc

	for _, f := range attachFiles {
		_, err := e.AttachFile(f)
		if err != nil {
			return fmt.Errorf("failed to attach file %s: %w", f, err)
		}
	}

	smtpAuth := smtp.PlainAuth("", sender.fromEmailAddress, sender.fromEmailPassword, smtpAuthAddress)
	return e.Send(smtpServerAddress, smtpAuth)
}

• Email verification: Here is a brilliant blog post about this flow with the snippets which I believe can explain more clearly then I can do so at this time, so I'd refernce that: Email Verification and Password Reset Flow using golang.

• If u just need to check of an email exists or not instead of checking ownership on that for the provider user, you can simply use this powerful Go package - AfterShip/email-verifier.

There several libraries available to send emails.

• Mailgun : https://github.com/mailgun/mailgun-go
• GoMail : https://github.com/go-gomail/gomail
• net/smtp : https://pkg.go.dev/net/smtp

Here is an example how we can use gomail.v2

package main
import (
"errors"
"fmt"
"gopkg.in/gomail.v2"
)
// EmailSender
type EmailSender struct {
Message *gomail.Message
dailer  *gomail.Dialer
}
// NewEmailSender
func NewEmailSender() *EmailSender {
m := gomail.NewMessage()
dailer := gomail.NewDialer("smtp.gmail.com", 587, "smtpEmail@example.com", "smtp-password")
m.SetHeader("From", "from-email@gmail.com")
return &EmailSender{
Message: m,
dailer:  dailer,
}
}
// Send
func (es *EmailSender) Send(subject, to, message string) error {
es.Message.SetHeader("To", to)
es.Message.SetHeader("Subject", subject)
es.Message.SetBody("text/plain", message)
if err := es.dailer.DialAndSend(es.Message); err != nil {
return err
}
return nil
}
// checks before sending the email
//   - code is valid
//   - email already sent
//   - code is expired or not
//
// TODO : Implement your checks
func ChecksBeforeEmailSend(code string) error {
return errors.New("email already sent")
}
func main() {
code := "123456"
emailer := NewEmailSender()
if err := ChecksBeforeEmailSend(code); err != nil {
panic(fmt.Sprintf("Check %v failed", err.Error()))
}
err := emailer.Send(
"Verify your email", // subject
"to@gmail.com", // to email
fmt.Sprintf("Your verfication code is %d", code), // message
)
if err != nil {
panic(err)
}
}

To prevent sending duplicate emails for a verification-code, you can use a field within the mongo db collection which will indicate that the email has already send for a particular user and code, check this field value before sending the email.

for example

{
"uuid": "644fa31752d087ab856a6507"
"code": 123123
"exp": 5-minutes-in-unix
"sent" : true
}

"sent" : true, indicates an email has already send for this user and code

We can add additional checks before sending the emails within ChecksBeforeEmailSend.