Ilker ManapandClaude Opus 5.5
66f702d5c1
/forgot mails a link to set a new password when the cluster's mail settings say how - SMTP relay, sender, and the public base_url the link points at, never the request's Host - and says the same whether or not the address has an account. /reset sets it once, closing every session. Links are kept by their hash in password_resets, good for an hour, a newer one replacing an older. Without mail, /forgot says to ask an operator, and llmgw users reset-link makes the link to hand over. Single sign-on accounts get none. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
11 lines
377 B
SQL
11 lines
377 B
SQL
-- One-time links to set a forgotten password: kept by the token's hash, as
|
|
-- sessions are, so a copy of the store opens nobody's account. A link is
|
|
-- good once, until it expires.
|
|
CREATE TABLE password_resets (
|
|
token_hash TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL,
|
|
created_at INTEGER NOT NULL,
|
|
expires_at INTEGER NOT NULL,
|
|
used_at INTEGER NOT NULL DEFAULT 0
|
|
);
|