PasswordReset final readonly class
Minn\Auth\PasswordReset · public/minn/src/Minn/Auth/PasswordReset.php · 78 lines
Password reset keys in the reference's storage shape: user_activation_key holds "time:hash", the key itself travels in the email link and is good for a day. The hash is the reference's own ($generic$, FastHash), so a link either stack sent works on the other. Older shapes still verify: a phpass hash (WordPress before 6.8) and the engine's former $minn$ HMAC. A matching key stored without its time (or, older still, stored as itself) is expired, as the reference treats it.
Constants and properties
| const | LIFETIME = 86400 | |
| private | readonly Minn\Content\Users $users | Promoted from the constructor. |
Public
| new | __construct(Minn\Content\Users $users)# | |
| method | issue(Minn\Content\UserRecord $user): string# | Mints a key, stores its hash, returns the key for the link. |
| static | mint(): array# | A new key and the value that stores it (the time it was issued and its hash), for a caller that saves it itself. @return array{0: string, 1: string} |
| method | verify(Minn\Content\UserRecord $user, string $key): bool# | True when the key matches the stored hash and has not expired: a day, or what password_reset_expiration makes it. |
| method | status(Minn\Content\UserRecord $user, string $key, int $lifetime = self::LIFETIME): string# | "valid", "expired" (a matching key past its lifetime, a day unless given), "unstamped" (a matching key stored without a time, which the reference counts expired after asking password_reset_key_expired), or "invalid". |
| method | clear(Minn\Content\UserRecord $user): void# | Forgets a user's reset key. |
Internals 2
Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.
Nothing matches.