struct

KemalIdentity::Accounts::ActionToken

Inherits Struct < Value < Object

A single-use, expiring grant: password reset, email confirmation, invitation.

The bearer holds a random secret; this is the server-side half, and it stores only the digest. Every rule in KemalIdentity::OpaqueToken applies, and two more that only a repository can enforce: it expires, and it is consumed atomically, so that two concurrent requests cannot both succeed with the same link.

A reset token authorises exactly one operation and dies. It never becomes a credential, is never presented twice, and grants nothing beyond its purpose — which is why purpose is part of the lookup and not just a label. A token issued to confirm an address must not be redeemable to change a password, or an attacker who can trigger a confirmation email gets an account takeover.

Constructors

new(id : String, account_id : String, purpose : ActionPurpose, token_digest : Bytes, created_at : Time, expires_at : Time, used_at : Time | Nil = nil)
Source

Instance methods

account_id
Source
created_at
Source
expired?(now : Time) : Bool
Source
expires_at
Source
inspect(io : IO) : Nil

Never prints the digest.

Source
purpose
Source
to_s(io : IO) : Nil

Same as #inspect(io).

Source
token_digest

SHA-256 of the raw token, as raw bytes.

Source
used?
Source
used_at

When this token was spent. nil while it is still redeemable.

Source