when(userRepository.save(user)).thenReturn(user);
when(userRepository.findByEmailAddress(user.getEmailAddress())).thenReturn(user);
VerificationToken token = verificationTokenService.sendLostPasswordToken(new LostPasswordRequest(user.getEmailAddress()));
when(tokenRepository.findByToken(token.getToken())).thenReturn(token);
String encodedToken = new String(Base64.encodeBase64(token.getToken().getBytes()));
VerificationToken verifiedToken = verificationTokenService.resetPassword(encodedToken, new PasswordRequest("newpassword"));
assertThat(verifiedToken.isVerified(), is(true));
assertThat(user.getHashedPassword(), is(user.hashPassword("newpassword")));
assertThat(user.getVerificationTokens().get(0).isVerified(), is(true));
//user should also be verified
assertThat(user.isVerified(), is(true));