Adds users (citext email, nullable password_hash so a user can be invited before claiming) and password_tokens (hashed one-shot tokens for initial-set and reset, with purpose + TTL + used_at). Token raw values live only in the email body; the DB stores SHA256 of the token so a DB leak doesn't grant account access. |
||
|---|---|---|
| .. | ||
| 001_invoices.rb | ||
| 002_users_and_password_tokens.rb | ||