DbPasswordResetTokenRepository
class DbPasswordResetTokenRepository (View source)
Methods
One-way hash applied to a reset token before persistence. SHA-256 is
sufficient because tokens are 256 bits of entropy from random_bytes(32);
brute force across the keyspace is infeasible without a salt. The
sha256$ prefix matches the API key repository so the same shape gate
defends both surfaces against pass-the-hash from a DB-read leak.
No description
Find all active (non-expired) tokens
Find a token by its value
Mark a token as used
Count recent attempts for an email address
Count recent attempts by IP address
Get the last attempt time for an email
Delete expired tokens
Delete all tokens for a specific email
Delete a specific token by ID
Details
__construct(PDO $db, ConfigurationManager $config)
No description
static string
hashToken(string $token)
One-way hash applied to a reset token before persistence. SHA-256 is
sufficient because tokens are 256 bits of entropy from random_bytes(32);
brute force across the keyspace is infeasible without a salt. The
sha256$ prefix matches the API key repository so the same shape gate
defends both surfaces against pass-the-hash from a DB-read leak.
bool
create(array $data)
No description
array
findActiveTokens()
Find all active (non-expired) tokens
array|null
findByToken(string $token)
Find a token by its value
bool
markAsUsed(int $tokenId)
Mark a token as used
int
countRecentAttempts(string $email, int $seconds)
Count recent attempts for an email address
int
countRecentAttemptsByIp(string $ip, int $seconds)
Count recent attempts by IP address
string|null
getLastAttemptTime(string $email)
Get the last attempt time for an email
int
deleteExpired()
Delete expired tokens
Current cleanup strategy:
- Delete tokens that have passed their expiration time
- Delete used tokens that are older than 7 days (kept temporarily for audit trail)
This method is called automatically:
- When creating new password reset requests
- When validating tokens
- After successful password resets
int
deleteByEmail(string $email)
Delete all tokens for a specific email
bool
deleteById(int $tokenId)
Delete a specific token by ID