20 lines
788 B
SQL
20 lines
788 B
SQL
|
-- +goose Up
|
||
|
|
-- Self-serve forgot-password: durable hashed one-time reset tokens (not must_set_password / invites).
|
||
|
|
|
||
|
|
CREATE TABLE password_reset_tokens (
|
||
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||
|
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||
|
|
token_hash TEXT NOT NULL,
|
||
|
|
expires_at TIMESTAMPTZ NOT NULL,
|
||
|
|
consumed_at TIMESTAMPTZ,
|
||
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||
|
|
CONSTRAINT password_reset_tokens_token_hash_len CHECK (char_length(token_hash) = 64)
|
||
|
|
);
|
||
|
|
|
||
|
|
CREATE UNIQUE INDEX password_reset_tokens_token_hash_uidx ON password_reset_tokens (token_hash);
|
||
|
|
CREATE INDEX password_reset_tokens_user_pending_idx
|
||
|
|
ON password_reset_tokens (user_id, expires_at DESC)
|
||
|
|
WHERE consumed_at IS NULL;
|
||
|
|
|
||
|
|
-- +goose Down
|
||
|
|
DROP TABLE IF EXISTS password_reset_tokens;
|