add a callback url to password reset flow

mgolvers · Dec 30, 2021 · 324138d · 324138d
1 parent 4d937a4
commit 324138d
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/api/schemas.py b/api/schemas.py
@@ -135,6 +135,7 @@ class Meta:
 
     email = ma.String(required=True, validate=[validate.Length(max=120),
                                                validate.Email()])
+    callback_url = ma.String(required=True, validate=validate.Length(min=1))
 
 
 class PasswordResetSchema(ma.Schema):

diff --git a/api/tokens.py b/api/tokens.py
@@ -45,7 +45,8 @@ def reset(args):
     user = db.session.scalar(User.select().filter_by(email=args['email']))
     if user is not None:
         reset_token = user.generate_reset_token()
-        reset_url = (request.referrer or '') + '?token=' + reset_token
+        reset_url = request.referrer.strip('/') + args['callback_url'] + \
+            '?token=' + reset_token
         send_email(args['email'], 'Reset Your Password', 'reset',
                    token=reset_token, url=reset_url)
     return {}

diff --git a/config.py b/config.py
@@ -14,7 +14,7 @@ class Config:
     ACCESS_TOKEN_EXPIRATION = int(os.environ.get(
         'ACCESS_TOKEN_EXPIRATION', '60')) * 60  # 1 hour
     REFRESH_TOKEN_EXPIRATION =  int(os.environ.get(
-        'REFRESH_TOKEN_EXPIRATION', '1440')) * 60  # 24 hours
+        'REFRESH_TOKEN_EXPIRATION', '4320')) * 60  # 3 days
     RESET_TOKEN_EXPIRATION = int(os.environ.get(
         'RESET_TOKEN_EXPIRATION', '15')) * 60  # 15 minutes