feat: account connect

2026-06-02 22:54:41 +05:30
parent cf3a49458a
commit 3f6b7b6636
8 changed files with 429 additions and 22 deletions
@@ -62,6 +62,11 @@ type AuthToken struct {
 const (
 	PurposePasswordReset     = "password_reset"
 	PurposeEmailVerification = "email_verification"
+	// PurposeLoginOTP is a 6-digit one-time code emailed to a user whose
+	// account has been unverified for >30 days. Verification happens
+	// per-user (FindValidForUser), so the 1M-keyspace can't be brute-forced
+	// offline by hash collision — only online against rate limits.
+	PurposeLoginOTP = "login_otp"
 )

 // OAuthAccount represents a row in the `oauth_accounts` table — one entry