Token plaintext NEVER stored — sha256 hex only (cf. ADR-0021 fingerprint pattern)
5 unit tests + 5 integration tests (`-tags integration`)
Test plan
`go test ./pkg/user/...` — unit suite green
`go test -tags integration ./pkg/user/ -run TestMagicLinkRepo` — 5/5 green vs local Postgres
`go vet ./...` clean
## Summary
ADR-0028 Phase A.3 — persistence layer for passwordless auth.
- New \`MagicLinkToken\` GORM model + auto-migrate (both DSN-built and cfg-built init paths)
- \`PostgresRepository\` methods : Create / GetByHash / MarkConsumed / DeleteExpired
- Token plaintext NEVER stored — sha256 hex only (cf. ADR-0021 fingerprint pattern)
- 5 unit tests + 5 integration tests (\`-tags integration\`)
## Test plan
- \`go test ./pkg/user/...\` — unit suite green
- \`go test -tags integration ./pkg/user/ -run TestMagicLinkRepo\` — 5/5 green vs local Postgres
- \`go vet ./...\` clean
Adds the persistence layer for the passwordless-auth flow. The token VALUE is
never stored — only its sha256 hex digest, mirroring ADR-0021 secret retention
via fingerprint. Plaintext is generated server-side, emailed once, and rehashed
on consume.
Repository methods : Create / GetByHash / MarkConsumed / DeleteExpired.
AutoMigrate wired in both PostgresRepository init paths (DSN-built + cfg-built).
Tests :
- 5 unit tests : token generation shape, URL-safety, uniqueness, hash stability
- 5 integration tests (build tag `integration`) : end-to-end against real Postgres,
cover the happy path, missing-hash, consume idempotency, expired-cleanup,
and the unique-index defensive check
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
ADR-0028 Phase A.3 — persistence layer for passwordless auth.
Test plan