EDIT

import java.time.Duration;

import org.apache.commons.collections4.map.HashedMap;

import org.apache.commons.text.StringSubstitutor;

import org.apache.log4j.Logger;

import org.springframework.core.env.Environment;

import org.springframework.mail.SimpleMailMessage;

import org.springframework.mail.javamail.JavaMailSender;

import com.google.common.util.concurrent.RateLimiter;

import eu.etaxonomy.cdm.api.config.CdmConfigurationKeys;

import eu.etaxonomy.cdm.api.config.SendEmailConfigurer;

import eu.etaxonomy.cdm.api.security.IPasswordResetTokenStore;

import eu.etaxonomy.cdm.api.service.IUserService;

import eu.etaxonomy.cdm.persistence.dao.permission.IUserDao;

public class PasswordResetService implements IPasswordResetService {

    private static Logger logger = Logger.getLogger(PasswordResetRequest.class);

    @Autowired

    private IUserDao userDao;

    @Autowired

    private IUserService userService;

    private IPasswordResetTokenStore passwordResetTokenStore;

    @Autowired

    private JavaMailSender emailSender;

    @Autowired

    private Environment env;

    private Duration rateLimiterTimeout = null;

    private RateLimiter emailResetToken_rateLimiter = RateLimiter.create(PERMITS_PER_SECOND);

    private RateLimiter resetPassword_rateLimiter = RateLimiter.create(PERMITS_PER_SECOND);

                        PasswordResetTemplates.RESET_REQUEST_EMAIL_SUBJECT_TEMPLATE,

                        PasswordResetTemplates.RESET_REQUEST_EMAIL_BODY_TEMPLATE, additionalValues);

     * Uses the {@link StringSubstitutor} as simple template engine.

     * Below named values are automatically resolved, more can be added via the

     * <code>valuesMap</code> parameter.

     *

     * @param userEmail

     *  The TO-address

     * @param userName

     *  Used to set the value for <code>${userName}</code>

     * @param subjectTemplate

     *  A {@link StringSubstitutor} template for the email subject

     * @param bodyTemplate

     *  A {@link StringSubstitutor} template for the email body

     * @param additionalValuesMap

     *  Additional named values for to be replaced in the template strings.

     */

    public void sendEmail(String userEmail, String userName, String subjectTemplate, String bodyTemplate, Map<String, String> additionalValuesMap) throws MailException {

        String from = env.getProperty(SendEmailConfigurer.FROM_ADDRESS);

        String dataSourceBeanId = env.getProperty(CdmConfigurationKeys.CDM_DATA_SOURCE_ID);

        String supportEmailAddress = env.getProperty(CdmConfigurationKeys.MAIL_ADDRESS_SUPPORT);

        if(additionalValuesMap == null) {

            additionalValuesMap = new HashedMap<>();

        }

        if(supportEmailAddress != null) {

            additionalValuesMap.put("supportEmailAddress", supportEmailAddress);

        }

        additionalValuesMap.put("userName", userName);

        additionalValuesMap.put("dataBase", dataSourceBeanId);

        StringSubstitutor substitutor = new StringSubstitutor(additionalValuesMap);

        // TODO use MimeMessages for better email layout?

        // TODO user Thymeleaf instead for HTML support?

        SimpleMailMessage message = new SimpleMailMessage();

        message.setFrom(from);

        message.setTo(userEmail);

        message.setSubject(substitutor.replace(subjectTemplate));

        message.setText(substitutor.replace(bodyTemplate));

        emailSender.send(message);

    }

    /**

     *

     * @param token

     *            the token string

     * @param newPassword

     *            The new password to set

     * @return A <code>Future</code> for a <code>Boolean</code> flag. The

     *         boolean value will be <code>false</code> in case the max access

     *         rate for this method has been exceeded and a time out has

     *         occurred.

     * @throws PasswordResetException

     *             in case an invalid token has been used

     * @throws MailException

     *             in case sending the email has failed

     */

    @Override

    @Async

    public ListenableFuture<Boolean> resetPassword(String token, String newPassword) throws PasswordResetException, MailException {

        if (resetPassword_rateLimiter.tryAcquire(getRateLimiterTimeout())) {

            Optional<PasswordResetRequest> resetRequest = passwordResetTokenStore.findResetRequest(token);

            if (resetRequest.isPresent()) {

                try {

                    UserDetails user = userService.loadUserByUsername(resetRequest.get().getUserName());

                    Assert.isAssignable(user.getClass(), User.class);

                    userService.encodeUserPassword((User)user, newPassword);

                    userDao.saveOrUpdate((User)user);

                    passwordResetTokenStore.remove(token);

                    sendEmail(resetRequest.get().getUserEmail(), resetRequest.get().getUserName(),

                            PasswordResetTemplates.RESET_SUCCESS_EMAIL_SUBJECT_TEMPLATE,

                            PasswordResetTemplates.RESET_SUCCESS_EMAIL_BODY_TEMPLATE, null);

                    return new AsyncResult<Boolean>(true);

                } catch (DataAccessException | IllegalArgumentException | UsernameNotFoundException e) {

                    logger.error("Failed to change password of User " + resetRequest.get().getUserName(), e);

                    sendEmail(resetRequest.get().getUserEmail(), resetRequest.get().getUserName(),

                            PasswordResetTemplates.RESET_FAILED_EMAIL_SUBJECT_TEMPLATE,

                            PasswordResetTemplates.RESET_FAILED_EMAIL_BODY_TEMPLATE, null);

                }

            } else {

                throw new PasswordResetException("Invalid password reset token");

            }

        }

        return new AsyncResult<Boolean>(false);

    }

    @Override

    public Duration getRateLimiterTimeout() {

        if(rateLimiterTimeout == null) {

            rateLimiterTimeout = Duration.ofSeconds(RATE_LIMTER_TIMEOUT_SECONDS);

        }

        return rateLimiterTimeout;

    }

    @Override

    public void setRateLimiterTimeout(Duration timeout) {

        this.rateLimiterTimeout = timeout;

    }

    @Override

    public void setRate(double rate) {

        resetPassword_rateLimiter.setRate(rate);

        emailResetToken_rateLimiter.setRate(rate);

    }