Private
Public Access
ksmith
fc96e85014
Users can change their own password from the profile modal, and a "forgot password" link sends a 15-minute expiring reset link (same hashed-token pattern as site invites). The forgot-password response is always generic so it never reveals which emails are registered. Also fixes two admin-page display bugs found while testing: table row divider lines that didn't line up across a row (the actions column had `display: flex` on the <td> itself, breaking it out of normal table-cell layout -- moved to a child <div>), and the pending-invites list floating with no visual grouping (now boxed with a label and per-status badges).
34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
import uuid
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from sqlalchemy import Boolean, DateTime, ForeignKey, String, func
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
|
|
from app.models.base import Base
|
|
|
|
DEFAULT_RESET_LIFETIME = timedelta(minutes=15)
|
|
|
|
|
|
def _default_expires_at() -> datetime:
|
|
return datetime.now(timezone.utc) + DEFAULT_RESET_LIFETIME
|
|
|
|
|
|
class PasswordReset(Base):
|
|
__tablename__ = "password_resets"
|
|
|
|
id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
|
|
user_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("users.id"), index=True, nullable=False)
|
|
# Same convention as SiteInvite.token_hash / API tokens: a bearer secret
|
|
# looked up by itself, so it's hashed with security.hash_token (fast,
|
|
# deterministic sha256), not argon2.
|
|
token_hash: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
|
|
used: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
|
|
expires_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), default=_default_expires_at, nullable=False
|
|
)
|
|
created_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), server_default=func.now(), nullable=False
|
|
)
|
|
|
|
user = relationship("User")
|