Ilker ManapandClaude Opus 5.5
66f702d5c1
/forgot mails a link to set a new password when the cluster's mail settings say how - SMTP relay, sender, and the public base_url the link points at, never the request's Host - and says the same whether or not the address has an account. /reset sets it once, closing every session. Links are kept by their hash in password_resets, good for an hour, a newer one replacing an older. Without mail, /forgot says to ask an operator, and llmgw users reset-link makes the link to hand over. Single sign-on accounts get none. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package store
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestAResetLinkWorksOnceAndUntilItExpires(t *testing.T) {
|
|
s := capacityStore(t)
|
|
ctx := t.Context()
|
|
tok, err := s.CreatePasswordReset(ctx, "usr-1", time.Hour)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if u, err := s.PasswordResetUser(ctx, tok); err != nil || u != "usr-1" {
|
|
t.Fatalf("%q %v", u, err)
|
|
}
|
|
if u, err := s.UsePasswordReset(ctx, tok); err != nil || u != "usr-1" {
|
|
t.Fatalf("first use: %q %v", u, err)
|
|
}
|
|
if _, err := s.UsePasswordReset(ctx, tok); !errors.Is(err, ErrNotFound) {
|
|
t.Errorf("used twice: %v", err)
|
|
}
|
|
expired, _ := s.CreatePasswordReset(ctx, "usr-2", -time.Minute)
|
|
if _, err := s.PasswordResetUser(ctx, expired); !errors.Is(err, ErrNotFound) {
|
|
t.Errorf("an expired link: %v", err)
|
|
}
|
|
first, _ := s.CreatePasswordReset(ctx, "usr-3", time.Hour)
|
|
if _, err := s.CreatePasswordReset(ctx, "usr-3", time.Hour); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := s.PasswordResetUser(ctx, first); !errors.Is(err, ErrNotFound) {
|
|
t.Errorf("an older link still works after a newer one: %v", err)
|
|
}
|
|
}
|