| | | 1 | | using System.ComponentModel.DataAnnotations; |
| | | 2 | | using ArturRios.Data.Relational.Core.Entities; |
| | | 3 | | |
| | | 4 | | namespace ArturRios.Heimdall.Domain.Entities; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// A time-limited, single-use token issued for a password reset. Never addressed by its |
| | | 8 | | /// internal <see cref="Entity{TKey}.Id" />; the caller-facing reference is the random token string |
| | | 9 | | /// delivered by email, so it has no <c>PublicId</c>. |
| | | 10 | | /// </summary> |
| | | 11 | | public class PasswordResetToken : Entity<long>, IPersonToken |
| | | 12 | | { |
| | | 13 | | /// <summary>Foreign key to the associated <see cref="Person" /> (internal Id). Required.</summary> |
| | 189 | 14 | | public long PersonId { get; set; } |
| | | 15 | | |
| | | 16 | | /// <summary> |
| | | 17 | | /// SHA-256 of the token that was emailed, as lowercase hex. The token itself is never stored: it replaces a |
| | | 18 | | /// password, so a reader of this table would otherwise be able to complete a reset for any |
| | | 19 | | /// account holding a live one (Threat Model TH-14). Written and compared through |
| | | 20 | | /// <c>SingleUseTokenHash</c>. |
| | | 21 | | /// </summary> |
| | | 22 | | [MaxLength(64)] |
| | 335 | 23 | | public string TokenHash { get; set; } = string.Empty; |
| | | 24 | | |
| | | 25 | | /// <summary>Expiration timestamp, after which the token is rejected.</summary> |
| | 214 | 26 | | public DateTime ExpiresAt { get; set; } |
| | | 27 | | |
| | | 28 | | /// <summary>Whether the token has already been consumed.</summary> |
| | 216 | 29 | | public bool Used { get; set; } |
| | | 30 | | |
| | | 31 | | // Navigation properties |
| | | 32 | | |
| | | 33 | | /// <summary>The person this token was issued for.</summary> |
| | 115 | 34 | | public Person Person { get; set; } = null!; |
| | | 35 | | } |