mirror of
https://tangled.org/tranquil.farm/tranquil-pds
synced 2026-07-20 15:02:37 +00:00
ave
63d84d38fb
Collapse the three ad-hoc short-code generators into one canonical generator plus a shared normalizer: - util::generate_token_code now emits the uppercase base32 XXXXX-XXXXX display form; new util::normalize_token_code canonicalizes user input (uppercase, strip hyphen/whitespace). - email_token and legacy_2fa now generate via util, store the normalized form, and compare normalized input. Their private generate_short_token/generate_code (and BASE32_CHARS/CODE_LENGTH) are removed. - PLC (request/sign) and password reset inline util::generate_token_code, persist the normalized form, email the display form, and normalize input before lookup. The generate_plc_token/generate_reset_code wrappers are removed. Behavior changes: legacy login-2FA codes go from 8-digit numeric to XXXXX-XXXXX; PLC and password-reset codes go from lowercase to uppercase. All four code types are now accepted case-/hyphen-insensitively. OAuth web-login 2FA, account deletion, and the long verification_token blobs are intentionally untouched. Tests: add util normalize tests + email_token/legacy_2fa case/hyphen tests; update integration tests to expect the canonical stored form and the new emailed format.