feat: add secure invitation and reset links

2026-08-05 11:31:38 +08:00
parent 540b8e0932
commit 8ef0c312ef
14 changed files with 418 additions and 75 deletions
@@ -82,7 +82,8 @@ class Config:
    ADMIN_PASSWORD = os.environ.get("ADMIN_PASSWORD")
    ADMIN_EMAIL = os.environ.get("ADMIN_EMAIL", "").strip().lower()
    APP_TIMEZONE = os.environ.get("APP_TIMEZONE", "Asia/Shanghai").strip() or "Asia/Shanghai"
-    PASSWORD_RESET_TOKEN_MINUTES = env_int("PASSWORD_RESET_TOKEN_MINUTES", 30)
+    # 密码重置和管理员邀请链接均为一次性链接，默认 10 分钟后失效。
+    PASSWORD_RESET_TOKEN_MINUTES = env_int("PASSWORD_RESET_TOKEN_MINUTES", 10)
    RESEND_API_KEY = os.environ.get("RESEND_API_KEY", "").strip()
    RESEND_FROM_EMAIL = os.environ.get("RESEND_FROM_EMAIL", "").strip()
    EMAIL_CODE_MINUTES = env_int("EMAIL_CODE_MINUTES", 10)