Sergei Poljanski
331917522c
Adds users (citext email, nullable password_hash so a user can be invited before claiming) and password_tokens (hashed one-shot tokens for initial-set and reset, with purpose + TTL + used_at). Token raw values live only in the email body; the DB stores SHA256 of the token so a DB leak doesn't grant account access. |
||
|---|---|---|
| .. | ||
| migrations | ||