tranquil-pds/crates/tranquil-api/ at refactor/unify-short-codes · ave.zone/tranquil-pds · Tangled

ave.zone / tranquil-pds

0

Fork for PR & AGPL purposes pds.lavate.ch

0

tranquil-pds / crates / tranquil-api /

at refactor/unify-short-codes 1 folder 1 file

ave refactor(auth): unify short-code generation onto util::generate_token_code 7w ago

refactor(auth): unify short-code generation onto util::generate_token_code Collapse the three ad-hoc short-code generators into one canonical generator plus a shared normalizer: - util::generate_token_code now emits the uppercase base32 XXXXX-XXXXX display form; new util::normalize_token_code canonicalizes user input (uppercase, strip hyphen/whitespace). - email_token and legacy_2fa now generate via util, store the normalized form, and compare normalized input. Their private generate_short_token/generate_code (and BASE32_CHARS/CODE_LENGTH) are removed. - PLC (request/sign) and password reset inline util::generate_token_code, persist the normalized form, email the display form, and normalize input before lookup. The generate_plc_token/generate_reset_code wrappers are removed. Behavior changes: legacy login-2FA codes go from 8-digit numeric to XXXXX-XXXXX; PLC and password-reset codes go from lowercase to uppercase. All four code types are now accepted case-/hyphen-insensitively. OAuth web-login 2FA, account deletion, and the long verification_token blobs are intentionally untouched. Tests: add util normalize tests + email_token/legacy_2fa case/hyphen tests; update integration tests to expect the canonical stored form and the new emailed format.

1 month ago

refactor(auth): unify short-code generation onto util::generate_token_code Collapse the three ad-hoc short-code generators into one canonical generator plus a shared normalizer: - util::generate_token_code now emits the uppercase base32 XXXXX-XXXXX display form; new util::normalize_token_code canonicalizes user input (uppercase, strip hyphen/whitespace). - email_token and legacy_2fa now generate via util, store the normalized form, and compare normalized input. Their private generate_short_token/generate_code (and BASE32_CHARS/CODE_LENGTH) are removed. - PLC (request/sign) and password reset inline util::generate_token_code, persist the normalized form, email the display form, and normalize input before lookup. The generate_plc_token/generate_reset_code wrappers are removed. Behavior changes: legacy login-2FA codes go from 8-digit numeric to XXXXX-XXXXX; PLC and password-reset codes go from lowercase to uppercase. All four code types are now accepted case-/hyphen-insensitively. OAuth web-login 2FA, account deletion, and the long verification_token blobs are intentionally untouched. Tests: add util normalize tests + email_token/legacy_2fa case/hyphen tests; update integration tests to expect the canonical stored form and the new emailed format.

1 month ago