module Bezel::Token
Signed, expiring tokens for links sent by mail (confirm an address,
reset a password): data (an id), the purpose and the expiry, signed
with HMAC-SHA256 under a key derived from SECRET_KEY_BASE. A token is
good for its purpose only, until it expires; its data can be read by
anyone holding it (it is signed, not encrypted).
A token is not used up: it stays good until it expires. Give
fingerprint something that its use changes (for a password reset,
the current password hash), the same when signing and verifying, and
the token stops verifying once that changes.
config = Bezel::Config.load("shop", environ: {"BEZEL_ENV" => "test"})
t = Bezel::Token.sign(config, "reset", "42", expires_in: 1.hour)
Bezel::Token.verify(config, "reset", t) # => "42"
Bezel::Token.verify(config, "confirm", t) # => nil
Class methods
def self.sign(config: Bezel::Config, purpose: String, data: String, *, expires_in: Duration, fingerprint: String = …) -> String
A token of data for purpose, good for expires_in.
def self.verify(config: Bezel::Config, purpose: String, token: String, *, fingerprint: String = …) -> String?
The data of token when it is a token for purpose that has not
expired, else nil.