bvandeusenandClaude Opus 5.5
593b583d23
Step #5429 "Reset by email: request, link and new-password page" of milestone 497 "Passwords: change your own, and reset it by email". - Sign-in page: "Forgot your password?" while a mail server is set. - /forgot takes a username or email and answers the same either way; only an active local account with a real address gets mail. Requests count per address on their own throttle, so they never lock out sign-in. - password_resets (migration 0039): a one-time key, stored as its sha256, working for an hour; asking again replaces it. - /reset/<key>: the new password, then signed straight in; every other browser is signed out (sessions_since). Bad keys count as invite keys do. - Email "[Steward] Reset your password", in the account's own zone. - Audited: user.password_reset_requested, user.password_reset_by_email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
1.1 KiB
Python
22 lines
1.1 KiB
Python
from __future__ import annotations
|
|
from datetime import datetime, timezone
|
|
from sqlalchemy import DateTime, ForeignKey, Integer, String
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
from .base import Base
|
|
|
|
|
|
class PasswordReset(Base):
|
|
"""An emailed link to set a new password for a local account (milestone
|
|
497). The link carries a one-time key; only its sha256 is stored, as for
|
|
invites. It works for an hour, once; asking again replaces it."""
|
|
__tablename__ = "password_resets"
|
|
|
|
id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
|
|
user_id: Mapped[str] = mapped_column(
|
|
String(36), ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
|
|
key_hash: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
|
|
created_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc))
|
|
expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
|
|
used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
|