PasswordReset
in package
Password Reset Model
Handles password reset functionality including token generation, validation, and password updates. Manages the PASSWORD_RESET_TOKEN table for secure password reset operations with time-limited tokens.
Tags
Table of Contents
Properties
- $pdo : PDO
- PDO database connection instance
Methods
- __construct() : mixed
- Constructor - Initialize the PasswordReset model
- cleanExpiredTokens() : bool
- Clean expired and used tokens
- createToken() : string|false
- Create a password reset token
- getUserByEmail() : array{user_id: int, last_name: string, first_name: string, email: string}|false
- Get user information by email address
- markTokenAsUsed() : bool
- Mark a token as used
- updatePassword() : bool
- Update a user's password
- verifyToken() : array{valid: true, user_id: int, token_id: int}|array{valid: false, message: string}
- Verify a password reset token
Properties
$pdo
PDO database connection instance
private
PDO
$pdo
Methods
__construct()
Constructor - Initialize the PasswordReset model
public
__construct() : mixed
Retrieves the database connection from the Database singleton.
cleanExpiredTokens()
Clean expired and used tokens
public
cleanExpiredTokens() : bool
Removes all expired tokens and used tokens from the database. This method should be called periodically (e.g., via cron job) to maintain database hygiene.
Return values
bool —True if successful, false otherwise
createToken()
Create a password reset token
public
createToken(int $user_id) : string|false
Generates a secure random token valid for 3 hours and stores it in the database. The token is a 64-character hexadecimal string.
Parameters
- $user_id : int
-
The ID of the user requesting password reset
Return values
string|false —The generated token if successful, false otherwise
getUserByEmail()
Get user information by email address
public
getUserByEmail(string $email) : array{user_id: int, last_name: string, first_name: string, email: string}|false
Retrieves basic user information (without password) for password reset purposes.
Parameters
- $email : string
-
The user's email address
Return values
array{user_id: int, last_name: string, first_name: string, email: string}|false —Array containing user data if found, false otherwise
markTokenAsUsed()
Mark a token as used
public
markTokenAsUsed(string $token) : bool
Prevents a token from being reused for multiple password resets. Should be called after a successful password reset.
Parameters
- $token : string
-
The token to mark as used
Return values
bool —True if successful, false otherwise
updatePassword()
Update a user's password
public
updatePassword(int $user_id, string $new_password) : bool
Changes the user's password to a new value. The password is hashed using SHA-1 before being stored in the database.
Parameters
- $user_id : int
-
The ID of the user whose password to update
- $new_password : string
-
The new password (plain text, will be hashed)
Return values
bool —True if successful, false otherwise
verifyToken()
Verify a password reset token
public
verifyToken(string $token) : array{valid: true, user_id: int, token_id: int}|array{valid: false, message: string}
Checks if a token is valid, not expired, and not already used. Automatically deletes expired tokens.
Parameters
- $token : string
-
The token to verify
Return values
array{valid: true, user_id: int, token_id: int}|array{valid: false, message: string} —Associative array indicating whether the token is valid:
- If valid: contains 'user_id' and 'token_id'.
- If invalid: contains 'message' explaining the reason.