From 1d7538379e291d1231b54b1bfb5f553597bed2b3 Mon Sep 17 00:00:00 2001
From: Reijjo <teemu.aitomeri@gmail.com>
Date: Wed, 1 Apr 2026 19:36:20 +0300
Subject: [PATCH 1/2] SOme frontend and couple of sql queries in the backend

---
 client/src/app/(auth)/layout.css              | 27 +++++-
 .../_components/RegisterCredentials.tsx       |  4 +-
 .../register/_components/RegisterEmail.tsx    |  2 +-
 client/src/app/(auth)/verify/page.tsx         | 22 +++++
 client/src/lib/api/auth.ts                    |  9 +-
 rust-server/.cargo/config.toml                |  7 ++
 rust-server/src/db/queries.rs                 | 22 ++++-
 rust-server/src/features/auth/handlers.rs     | 72 +++++++++++++--
 rust-server/src/features/auth/queries.rs      | 14 +++
 rust-server/src/features/auth/routes.rs       | 15 ++-
 rust-server/src/features/auth/types.rs        | 21 +++++
 rust-server/tests/api/common.rs               | 92 ++++++++++++++++++-
 12 files changed, 286 insertions(+), 21 deletions(-)
 create mode 100644 client/src/app/(auth)/verify/page.tsx
 create mode 100644 rust-server/.cargo/config.toml

diff --git a/client/src/app/(auth)/layout.css b/client/src/app/(auth)/layout.css
index f240a68..dd1246b 100644
--- a/client/src/app/(auth)/layout.css
+++ b/client/src/app/(auth)/layout.css
@@ -4,7 +4,8 @@
 
 .auth-register,
 .auth-login,
-.auth-forgot {
+.auth-forgot,
+.auth-verify {
   display: grid;
   grid-template-columns: repeat(2, 1fr);
   gap: 0;
@@ -16,6 +17,30 @@
   }
 }
 
+.auth-verify {
+  grid-template-columns: 1fr;
+  place-items: center;
+  background-image: radial-gradient(
+    at 50% 50%,
+    rgb(from var(--primary-500) r g b / 25%) 0,
+    transparent 80%
+  );
+}
+
+.container {
+  border: 1px solid rgb(from white r g b / 25%);
+  border-radius: 8px;
+  padding: 2rem;
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+  text-align: center;
+  text-wrap: balance;
+  width: min(95%, 600px);
+  background: var(--primary-900);
+  box-shadow: var(--box-shadow-xl);
+}
+
 .form-container {
   width: 100%;
   height: 100%;
diff --git a/client/src/app/(auth)/register/_components/RegisterCredentials.tsx b/client/src/app/(auth)/register/_components/RegisterCredentials.tsx
index 17b7237..bdc9417 100644
--- a/client/src/app/(auth)/register/_components/RegisterCredentials.tsx
+++ b/client/src/app/(auth)/register/_components/RegisterCredentials.tsx
@@ -36,7 +36,7 @@ export default function RegisterCredentials({
           label="username"
           name="username"
           id="username"
-          autoComplete="on"
+          autoComplete="username"
           type="text"
           placeholder="Username"
           className="auth-form-field"
@@ -49,7 +49,7 @@ export default function RegisterCredentials({
           name="password"
           id="password"
           type="password"
-          autoComplete="on"
+          autoComplete="new-password"
           placeholder="Password"
           className="auth-form-field"
           required
diff --git a/client/src/app/(auth)/register/_components/RegisterEmail.tsx b/client/src/app/(auth)/register/_components/RegisterEmail.tsx
index eef6e20..8a99ec1 100644
--- a/client/src/app/(auth)/register/_components/RegisterEmail.tsx
+++ b/client/src/app/(auth)/register/_components/RegisterEmail.tsx
@@ -39,7 +39,7 @@ export default function RegisterEmail({
           id="email"
           type="email"
           placeholder="Enter your email"
-          autoComplete="on"
+          autoComplete="email"
           className="auth-form-field"
           required
           errors={formState.errors?.email ?? []}
diff --git a/client/src/app/(auth)/verify/page.tsx b/client/src/app/(auth)/verify/page.tsx
new file mode 100644
index 0000000..f4e5f77
--- /dev/null
+++ b/client/src/app/(auth)/verify/page.tsx
@@ -0,0 +1,22 @@
+"use client";
+import { useSearchParams } from "next/navigation";
+
+export default function VerifyPage() {
+  const searchParams = useSearchParams();
+  const token = searchParams.get("token");
+
+  // TODO: Implement actual verification logic by sending the token to the server for validation
+
+  console.log("token:", token);
+  return (
+    <div className="auth-verify">
+      <div className="container">
+        <h1>Verify your email</h1>
+        <p>
+          A verification link has been sent to your email. Please check your
+          inbox and click the link to verify your account.
+        </p>
+      </div>
+    </div>
+  );
+}
diff --git a/client/src/lib/api/auth.ts b/client/src/lib/api/auth.ts
index fdfa793..2ff7399 100644
--- a/client/src/lib/api/auth.ts
+++ b/client/src/lib/api/auth.ts
@@ -7,7 +7,7 @@ import type {
   RegisterUserData,
 } from "../types/auth";
 
-const AUTH_URL = `${config.BACKEND_URL}/auth`;
+const AUTH_URL = `${config.BACKEND_URL}/api/auth`;
 
 // auth/available
 // GET
@@ -86,3 +86,10 @@ export const loggingIn = async (
     return { success: false, error: "Network error" };
   }
 };
+
+// auth/verify
+// GET
+// Verify email with token
+// export const verifyAccount = async
+
+// TOdO: Implement verifyAccount function when needed
diff --git a/rust-server/.cargo/config.toml b/rust-server/.cargo/config.toml
new file mode 100644
index 0000000..ab4a21a
--- /dev/null
+++ b/rust-server/.cargo/config.toml
@@ -0,0 +1,7 @@
+[env]
+# Test configuration
+
+[test]
+# Run tests serially to avoid database race conditions
+# Each test truncates the database, so concurrent execution causes conflicts
+test-threads = 1
\ No newline at end of file
diff --git a/rust-server/src/db/queries.rs b/rust-server/src/db/queries.rs
index a56474f..78103fa 100644
--- a/rust-server/src/db/queries.rs
+++ b/rust-server/src/db/queries.rs
@@ -1,4 +1,5 @@
-use sqlx::{PgPool, postgres::PgRow};
+use sqlx::{PgPool, Row, postgres::PgRow};
+use uuid::Uuid;
 
 use crate::errors::AppError;
 
@@ -17,3 +18,22 @@ pub async fn find_user_by_username(db: &PgPool, username: &str) -> Result<Option
         .await
         .map_err(AppError::Sql)
 }
+
+#[allow(dead_code)]
+pub async fn find_user_by_id(db: &PgPool, id: Uuid) -> Result<Option<PgRow>, AppError> {
+    sqlx::query("SELECT id FROM users WHERE id = $1")
+        .bind(id)
+        .fetch_optional(db)
+        .await
+        .map_err(AppError::Sql)
+}
+
+pub async fn find_token_by_value(db: &PgPool, token: &str) -> Result<Option<Uuid>, AppError> {
+    let row = sqlx::query("SELECT user_id FROM tokens WHERE token = $1")
+        .bind(token)
+        .fetch_optional(db)
+        .await
+        .map_err(AppError::Sql)?;
+
+    Ok(row.map(|r| r.get("user_id")))
+}
diff --git a/rust-server/src/features/auth/handlers.rs b/rust-server/src/features/auth/handlers.rs
index 5669f85..444c75e 100644
--- a/rust-server/src/features/auth/handlers.rs
+++ b/rust-server/src/features/auth/handlers.rs
@@ -1,12 +1,13 @@
-use crate::db::queries::{find_user_by_email, find_user_by_username};
-use crate::features::auth::queries::delete_user;
+use crate::db::queries::{find_token_by_value, find_user_by_email, find_user_by_username};
+use crate::features::auth::queries::{delete_user, verify_user};
 use crate::features::auth::service::new_user;
+use crate::features::auth::types::{AvailibilityQuery, VerifyQuery};
 use crate::state::AppState;
 use crate::utils::api_response::ApiResponse;
 use crate::utils::password::hash_password;
 use crate::{errors::AppError, features::auth::types::RegisterData};
 use axum::extract::rejection::JsonRejection;
-use axum::extract::{Json, State};
+use axum::extract::{Json, Query, State};
 use tokio::task::spawn_blocking;
 use validator::Validate;
 
@@ -25,11 +26,6 @@ pub async fn register_user(
     };
 
     let cleaned_data = validate_registerdata(payload)?;
-
-    let hashed_password = spawn_blocking(move || hash_password(&cleaned_data.password))
-        .await
-        .map_err(|_| AppError::internal("Threading error"))??;
-
     let db = state.db()?;
 
     if find_user_by_email(db, &cleaned_data.email).await?.is_some() {
@@ -43,6 +39,10 @@ pub async fn register_user(
         return Err(AppError::conflict("Username already in use"));
     }
 
+    let hashed_password = spawn_blocking(move || hash_password(&cleaned_data.password))
+        .await
+        .map_err(|_| AppError::internal("Threading error"))??;
+
     let (user_id, token) = new_user(
         db,
         &cleaned_data.email,
@@ -76,6 +76,62 @@ pub async fn register_user(
     ))
 }
 
+// ----------------------
+// /api/auth/available - params: email, username
+// GET
+// Check if email or username is available
+// ----------------------
+pub async fn check_availability(
+    State(state): State<AppState>,
+    Query(params): Query<AvailibilityQuery>,
+) -> Result<ApiResponse<()>, AppError> {
+    match (&params.email, &params.username) {
+        (None, None) => return Err(AppError::bad_request("Invalid query")),
+        (Some(_), Some(_)) => return Err(AppError::bad_request("Too many params")),
+        _ => {}
+    }
+
+    let db = state.db()?;
+
+    if let Some(email) = &params.email
+        && find_user_by_email(db, email).await?.is_some()
+    {
+        return Err(AppError::conflict("Email already in use"));
+    }
+
+    if let Some(username) = &params.username
+        && find_user_by_username(db, username).await?.is_some()
+    {
+        return Err(AppError::conflict("Username already in use"));
+    }
+
+    Ok(ApiResponse::ok("No duplicates found", None))
+}
+
+// ----------------------
+// /api/auth/verify - params: token
+// GET
+// Account verification
+// ----------------------
+pub async fn verify_account(
+    State(state): State<AppState>,
+    Query(params): Query<VerifyQuery>,
+) -> Result<ApiResponse<()>, AppError> {
+    let token = match &params.token {
+        Some(t) if !t.trim().is_empty() => t.trim().to_string(),
+        _ => return Err(AppError::bad_request("Invalid or missing token")),
+    };
+
+    let db = state.db()?;
+    let user_id = find_token_by_value(db, &token)
+        .await?
+        .ok_or_else(|| AppError::not_found("Invalid token"))?;
+
+    verify_user(db, user_id).await?;
+
+    Ok(ApiResponse::ok("Email verified successfully", None))
+}
+
 // -----------------
 // Validate data
 // -----------------
diff --git a/rust-server/src/features/auth/queries.rs b/rust-server/src/features/auth/queries.rs
index 12b6ff4..38bc103 100644
--- a/rust-server/src/features/auth/queries.rs
+++ b/rust-server/src/features/auth/queries.rs
@@ -61,3 +61,17 @@ where
 
     Ok(())
 }
+
+// Verify account - UPDATE
+pub async fn verify_user<'e, E>(db: E, user_id: Uuid) -> Result<(), AppError>
+where
+    E: Executor<'e, Database = Postgres>,
+{
+    sqlx::query("UPDATE users SET verified = true WHERE id = $1")
+        .bind(user_id)
+        .execute(db)
+        .await
+        .map_err(AppError::Sql)?;
+
+    Ok(())
+}
diff --git a/rust-server/src/features/auth/routes.rs b/rust-server/src/features/auth/routes.rs
index db23069..eb34caf 100644
--- a/rust-server/src/features/auth/routes.rs
+++ b/rust-server/src/features/auth/routes.rs
@@ -1,7 +1,16 @@
 use super::handlers::register_user;
-use crate::state::AppState;
-use axum::{Router, routing::post};
+use crate::{
+    features::auth::handlers::{check_availability, verify_account},
+    state::AppState,
+};
+use axum::{
+    Router,
+    routing::{get, post},
+};
 
 pub fn auth_router() -> Router<AppState> {
-    Router::new().route("/auth/register", post(register_user))
+    Router::new()
+        .route("/auth/register", post(register_user))
+        .route("/auth/available", get(check_availability))
+        .route("/auth/verify", get(verify_account))
 }
diff --git a/rust-server/src/features/auth/types.rs b/rust-server/src/features/auth/types.rs
index 1e4a5d3..14fb891 100644
--- a/rust-server/src/features/auth/types.rs
+++ b/rust-server/src/features/auth/types.rs
@@ -5,6 +5,9 @@ use validator::Validate;
 
 use crate::utils::validators::{validate_email, validate_password, validate_username};
 
+// -----------------------
+// Register data
+// -----------------------
 #[derive(Serialize, Deserialize, Debug, Validate)]
 pub struct RegisterData {
     #[validate(length(max = 255, message = "Email must be at most 255 characters"), custom(function = validate_email))]
@@ -25,6 +28,24 @@ pub struct RegisterData {
     pub password: String,
 }
 
+// -----------------------
+// Queries (params)
+// -----------------------
+#[derive(Deserialize)]
+pub struct AvailibilityQuery {
+    pub email: Option<String>,
+    pub username: Option<String>,
+}
+
+#[derive(Deserialize)]
+
+pub struct VerifyQuery {
+    pub token: Option<String>,
+}
+
+// -----------------------
+// Token
+// -----------------------
 #[allow(dead_code)]
 #[derive(Serialize, Debug)]
 pub struct Token {
diff --git a/rust-server/tests/api/common.rs b/rust-server/tests/api/common.rs
index c33597a..23a8a9d 100644
--- a/rust-server/tests/api/common.rs
+++ b/rust-server/tests/api/common.rs
@@ -1,3 +1,6 @@
+use std::ops::Deref;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::Instant;
 
 use axum_test::TestServer;
@@ -9,8 +12,83 @@ use rust_server::{
     state::AppState,
     utils::email::EmailService,
 };
+use tokio::sync::OnceCell;
 
-pub async fn build_test_server() -> TestServer {
+static TEST_DB_RESET_ONCE: OnceCell<()> = OnceCell::const_new();
+static ACTIVE_TEST_SERVERS: AtomicUsize = AtomicUsize::new(0);
+static TEST_DB_URL: OnceLock<String> = OnceLock::new();
+const TEST_DB_TRUNCATE_QUERY: &str = "TRUNCATE TABLE tokens, users RESTART IDENTITY CASCADE";
+
+pub struct TestServerHandle {
+    server: TestServer,
+    _db_guard: TestDbGuard,
+}
+
+struct TestDbGuard;
+
+impl Drop for TestDbGuard {
+    fn drop(&mut self) {
+        if ACTIVE_TEST_SERVERS.fetch_sub(1, Ordering::AcqRel) != 1 {
+            return;
+        }
+
+        let Some(db_url) = TEST_DB_URL.get().cloned() else {
+            return;
+        };
+
+        let cleanup = std::thread::spawn(move || {
+            let runtime = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build();
+            let Ok(runtime) = runtime else {
+                return;
+            };
+
+            runtime.block_on(async move {
+                if let Ok(db) = sqlx::PgPool::connect(&db_url).await {
+                    let _ = sqlx::query(TEST_DB_TRUNCATE_QUERY).execute(&db).await;
+                }
+            });
+        });
+
+        let _ = cleanup.join();
+    }
+}
+
+impl Deref for TestServerHandle {
+    type Target = TestServer;
+
+    fn deref(&self) -> &Self::Target {
+        &self.server
+    }
+}
+
+impl TestServerHandle {
+    fn new(server: TestServer) -> Self {
+        ACTIVE_TEST_SERVERS.fetch_add(1, Ordering::AcqRel);
+        Self {
+            server,
+            _db_guard: TestDbGuard,
+        }
+    }
+}
+
+async fn reset_test_db_once(config: &Config) {
+    TEST_DB_RESET_ONCE
+        .get_or_init(|| async {
+            let db = init_db(config)
+                .await
+                .expect("Failed to connect to test database for cleanup");
+
+            sqlx::query(TEST_DB_TRUNCATE_QUERY)
+                .execute(&db)
+                .await
+                .expect("Failed to reset test database tables");
+        })
+        .await;
+}
+
+pub async fn build_test_server() -> TestServerHandle {
     let mut config = Config::from_env().expect("failed to load .env config for test");
     let start_time = Instant::now();
 
@@ -18,10 +96,14 @@ pub async fn build_test_server() -> TestServer {
     // regardless of local APP_ENV in .env.
     config.app_env = AppEnv::Test;
     config.db_url = config.db_test_url.clone();
+    let test_db_url = config.db_test_url.clone();
+    let _ = TEST_DB_URL.set(test_db_url);
 
     assert!(matches!(config.app_env, AppEnv::Test));
     eprintln!("[test] APP_ENV={}", config.app_env);
 
+    reset_test_db_once(&config).await;
+
     let db = init_db(&config)
         .await
         .expect("Failed to connect to test database");
@@ -40,10 +122,10 @@ pub async fn build_test_server() -> TestServer {
     };
 
     let app = create_app(state).expect("app should build");
-    TestServer::new(app)
+    TestServerHandle::new(TestServer::new(app))
 }
 
-pub async fn build_test_server_without_db() -> TestServer {
+pub async fn build_test_server_without_db() -> TestServerHandle {
     let mut config = Config::from_env().expect("failed to load .env config for test");
     let start_time = Instant::now();
 
@@ -51,6 +133,8 @@ pub async fn build_test_server_without_db() -> TestServer {
     // regardless of local APP_ENV in .env.
     config.app_env = AppEnv::Test;
     config.db_url = config.db_test_url.clone();
+    let test_db_url = config.db_test_url.clone();
+    let _ = TEST_DB_URL.set(test_db_url);
 
     assert!(matches!(config.app_env, AppEnv::Test));
     eprintln!("[test] APP_ENV={}", config.app_env);
@@ -70,5 +154,5 @@ pub async fn build_test_server_without_db() -> TestServer {
     };
 
     let app = create_app(state).expect("app should build");
-    TestServer::new(app)
+    TestServerHandle::new(TestServer::new(app))
 }

From 50bb520fd2d594d7679113dd5f4df62a0f316eec Mon Sep 17 00:00:00 2001
From: Reijjo <teemu.aitomeri@gmail.com>
Date: Wed, 1 Apr 2026 21:43:21 +0300
Subject: [PATCH 2/2] TOken expiration check added

---
 client/src/app/(auth)/verify/page.tsx     |  1 -
 client/src/lib/api/auth.spec.ts           | 44 ++++++++++++-----------
 rust-server/.cargo/config.toml            | 10 ++----
 rust-server/src/db/queries.rs             |  8 ++---
 rust-server/src/features/auth/handlers.rs | 40 +++++++++++++++------
 rust-server/src/features/auth/routes.rs   |  6 ++--
 rust-server/src/features/auth/types.rs    |  2 +-
 rust-server/src/features/mod.rs           |  7 ++--
 8 files changed, 67 insertions(+), 51 deletions(-)

diff --git a/client/src/app/(auth)/verify/page.tsx b/client/src/app/(auth)/verify/page.tsx
index f4e5f77..9203eac 100644
--- a/client/src/app/(auth)/verify/page.tsx
+++ b/client/src/app/(auth)/verify/page.tsx
@@ -7,7 +7,6 @@ export default function VerifyPage() {
 
   // TODO: Implement actual verification logic by sending the token to the server for validation
 
-  console.log("token:", token);
   return (
     <div className="auth-verify">
       <div className="container">
diff --git a/client/src/lib/api/auth.spec.ts b/client/src/lib/api/auth.spec.ts
index 025ba20..046ae8e 100644
--- a/client/src/lib/api/auth.spec.ts
+++ b/client/src/lib/api/auth.spec.ts
@@ -1,7 +1,10 @@
+import {
+  checkDuplicateEmail,
+  checkDuplicateUsername,
+  createUser,
+} from "./auth";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import { checkDuplicateEmail, checkDuplicateUsername, createUser } from "./auth";
-
 import type { RegisterUserData } from "../types/auth";
 
 const jsonResponse = (body: unknown, status = 200) =>
@@ -17,7 +20,9 @@ describe("auth api", () => {
   beforeEach(() => {
     fetchMock.mockReset();
     vi.stubGlobal("fetch", fetchMock);
-    consoleErrorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    consoleErrorSpy = vi
+      .spyOn(console, "error")
+      .mockImplementation(() => undefined);
   });
 
   afterEach(() => {
@@ -37,24 +42,21 @@ describe("auth api", () => {
         "user@example.com&admin=true",
         "user%40example.com%26admin%3Dtrue",
       ],
-    ])(
-      "encodes input safely for %s",
-      async (_label, email, encodedEmail) => {
-        fetchMock.mockResolvedValue(
-          jsonResponse({
-            success: true,
-            message: "No duplicate email/username found.",
-          }),
-        );
+    ])("encodes input safely for %s", async (_label, email, encodedEmail) => {
+      fetchMock.mockResolvedValue(
+        jsonResponse({
+          success: true,
+          message: "No duplicate email/username found.",
+        }),
+      );
 
-        const result = await checkDuplicateEmail(email);
+      const result = await checkDuplicateEmail(email);
 
-        expect(fetchMock).toHaveBeenCalledWith(
-          `http://localhost:3001/auth/available?email=${encodedEmail}`,
-        );
-        expect(result.success).toBe(true);
-      },
-    );
+      expect(fetchMock).toHaveBeenCalledWith(
+        `http://localhost:3001/api/auth/available?email=${encodedEmail}`,
+      );
+      expect(result.success).toBe(true);
+    });
 
     it("returns API error payload when backend responds with non-OK", async () => {
       fetchMock.mockResolvedValue(
@@ -119,7 +121,7 @@ describe("auth api", () => {
         const result = await checkDuplicateUsername(username);
 
         expect(fetchMock).toHaveBeenCalledWith(
-          `http://localhost:3001/auth/available?username=${encodedUsername}`,
+          `http://localhost:3001/api/auth/available?username=${encodedUsername}`,
         );
         expect(result.success).toBe(true);
       },
@@ -144,7 +146,7 @@ describe("auth api", () => {
       const result = await createUser(credentials);
 
       expect(fetchMock).toHaveBeenCalledWith(
-        "http://localhost:3001/auth/register",
+        "http://localhost:3001/api/auth/register",
         expect.objectContaining({
           method: "POST",
           headers: { "Content-Type": "application/json" },
diff --git a/rust-server/.cargo/config.toml b/rust-server/.cargo/config.toml
index ab4a21a..4a3348b 100644
--- a/rust-server/.cargo/config.toml
+++ b/rust-server/.cargo/config.toml
@@ -1,7 +1,3 @@
-[env]
-# Test configuration
-
-[test]
-# Run tests serially to avoid database race conditions
-# Each test truncates the database, so concurrent execution causes conflicts
-test-threads = 1
\ No newline at end of file
+# Force single-threaded test execution to avoid database race conditions.
+# Each test truncates the database, so concurrent execution causes conflicts.
+RUST_TEST_THREADS = "1"
\ No newline at end of file
diff --git a/rust-server/src/db/queries.rs b/rust-server/src/db/queries.rs
index 78103fa..ee1ebc5 100644
--- a/rust-server/src/db/queries.rs
+++ b/rust-server/src/db/queries.rs
@@ -1,4 +1,4 @@
-use sqlx::{PgPool, Row, postgres::PgRow};
+use sqlx::{PgPool, postgres::PgRow};
 use uuid::Uuid;
 
 use crate::errors::AppError;
@@ -28,12 +28,12 @@ pub async fn find_user_by_id(db: &PgPool, id: Uuid) -> Result<Option<PgRow>, App
         .map_err(AppError::Sql)
 }
 
-pub async fn find_token_by_value(db: &PgPool, token: &str) -> Result<Option<Uuid>, AppError> {
-    let row = sqlx::query("SELECT user_id FROM tokens WHERE token = $1")
+pub async fn find_token_by_value(db: &PgPool, token: &str) -> Result<Option<PgRow>, AppError> {
+    let row = sqlx::query("SELECT * FROM tokens WHERE token = $1")
         .bind(token)
         .fetch_optional(db)
         .await
         .map_err(AppError::Sql)?;
 
-    Ok(row.map(|r| r.get("user_id")))
+    Ok(row)
 }
diff --git a/rust-server/src/features/auth/handlers.rs b/rust-server/src/features/auth/handlers.rs
index 444c75e..02a6968 100644
--- a/rust-server/src/features/auth/handlers.rs
+++ b/rust-server/src/features/auth/handlers.rs
@@ -1,14 +1,17 @@
 use crate::db::queries::{find_token_by_value, find_user_by_email, find_user_by_username};
 use crate::features::auth::queries::{delete_user, verify_user};
 use crate::features::auth::service::new_user;
-use crate::features::auth::types::{AvailibilityQuery, VerifyQuery};
+use crate::features::auth::types::{AvailabilityQuery, VerifyQuery};
 use crate::state::AppState;
 use crate::utils::api_response::ApiResponse;
 use crate::utils::password::hash_password;
 use crate::{errors::AppError, features::auth::types::RegisterData};
 use axum::extract::rejection::JsonRejection;
 use axum::extract::{Json, Query, State};
+use chrono::{DateTime, Utc};
+use sqlx::Row;
 use tokio::task::spawn_blocking;
+use uuid::Uuid;
 use validator::Validate;
 
 // ----------------------
@@ -83,7 +86,7 @@ pub async fn register_user(
 // ----------------------
 pub async fn check_availability(
     State(state): State<AppState>,
-    Query(params): Query<AvailibilityQuery>,
+    Query(params): Query<AvailabilityQuery>,
 ) -> Result<ApiResponse<()>, AppError> {
     match (&params.email, &params.username) {
         (None, None) => return Err(AppError::bad_request("Invalid query")),
@@ -93,16 +96,24 @@ pub async fn check_availability(
 
     let db = state.db()?;
 
-    if let Some(email) = &params.email
-        && find_user_by_email(db, email).await?.is_some()
-    {
-        return Err(AppError::conflict("Email already in use"));
+    if let Some(email) = &params.email {
+        let email = email.trim().to_lowercase();
+        if email.is_empty() {
+            return Err(AppError::bad_request("Invalid query"));
+        }
+        if find_user_by_email(db, &email).await?.is_some() {
+            return Err(AppError::conflict("Email already in use"));
+        }
     }
 
-    if let Some(username) = &params.username
-        && find_user_by_username(db, username).await?.is_some()
-    {
-        return Err(AppError::conflict("Username already in use"));
+    if let Some(username) = &params.username {
+        let username = username.trim().to_lowercase();
+        if username.is_empty() {
+            return Err(AppError::bad_request("Invalid query"));
+        }
+        if find_user_by_username(db, &username).await?.is_some() {
+            return Err(AppError::conflict("Username already in use"));
+        }
     }
 
     Ok(ApiResponse::ok("No duplicates found", None))
@@ -123,10 +134,17 @@ pub async fn verify_account(
     };
 
     let db = state.db()?;
-    let user_id = find_token_by_value(db, &token)
+    let row = find_token_by_value(db, &token)
         .await?
         .ok_or_else(|| AppError::not_found("Invalid token"))?;
 
+    let user_id: Uuid = row.get("user_id");
+    let expires_at: DateTime<Utc> = row.get("expires_at");
+
+    if Utc::now() > expires_at {
+        return Err(AppError::bad_request("Token has expired"));
+    }
+
     verify_user(db, user_id).await?;
 
     Ok(ApiResponse::ok("Email verified successfully", None))
diff --git a/rust-server/src/features/auth/routes.rs b/rust-server/src/features/auth/routes.rs
index eb34caf..0786300 100644
--- a/rust-server/src/features/auth/routes.rs
+++ b/rust-server/src/features/auth/routes.rs
@@ -10,7 +10,7 @@ use axum::{
 
 pub fn auth_router() -> Router<AppState> {
     Router::new()
-        .route("/auth/register", post(register_user))
-        .route("/auth/available", get(check_availability))
-        .route("/auth/verify", get(verify_account))
+        .route("/register", post(register_user))
+        .route("/available", get(check_availability))
+        .route("/verify", get(verify_account))
 }
diff --git a/rust-server/src/features/auth/types.rs b/rust-server/src/features/auth/types.rs
index 14fb891..5124ed7 100644
--- a/rust-server/src/features/auth/types.rs
+++ b/rust-server/src/features/auth/types.rs
@@ -32,7 +32,7 @@ pub struct RegisterData {
 // Queries (params)
 // -----------------------
 #[derive(Deserialize)]
-pub struct AvailibilityQuery {
+pub struct AvailabilityQuery {
     pub email: Option<String>,
     pub username: Option<String>,
 }
diff --git a/rust-server/src/features/mod.rs b/rust-server/src/features/mod.rs
index 29c0691..4b4afa0 100644
--- a/rust-server/src/features/mod.rs
+++ b/rust-server/src/features/mod.rs
@@ -5,7 +5,8 @@ use crate::state::AppState;
 use axum::Router;
 
 pub fn routes() -> Router<AppState> {
-    Router::new()
-        .merge(health::routes::health_router())
-        .nest("/api", Router::new().merge(auth::routes::auth_router()))
+    Router::new().merge(health::routes::health_router()).nest(
+        "/api/auth",
+        Router::new().merge(auth::routes::auth_router()),
+    )
 }