Decides a redemption attempt and returns the state to persist. Pure: the caller supplies the time.
Properties this function guarantees (and the tests pin):
Single use. A success removes the pending verification, so neither the link nor the code works again.
Expiry. Past ExpiresAt nothing redeems, and the stale pending verification is cleared.
Bounded guessing. A wrong code increments CodeAttempts; reaching maxCodeAttempts voids the
pending verification (a new request — itself capped by maxSendsPerSession — is needed). A wrong
token changes nothing: 256 random bits are not guessable, and counting them would let a stranger
burn a legitimate person's pending link just by hitting the URL.
Constant-time compares. Secrets are compared via HashesEqual.
Decides a redemption attempt and returns the state to persist. Pure: the caller supplies the time.
Properties this function guarantees (and the tests pin):
ExpiresAtnothing redeems, and the stale pending verification is cleared.CodeAttempts; reachingmaxCodeAttemptsvoids the pending verification (a new request — itself capped bymaxSendsPerSession— is needed). A wrong token changes nothing: 256 random bits are not guessable, and counting them would let a stranger burn a legitimate person's pending link just by hitting the URL.