Separate reset password and account activation

[jasonvarga]

Problem

When creating an account for someone else, we send an activation email which is basically just a password reset with different words.

The reset link in there expires after an hour (by default) which is fine, but when creating a new user, it might be too short of a time before they even see the email sitting in their inbox.

Solution

This PR separates regular password resets from account activations.

Previously when you try to reset a password, it would change the notification based on whether you had a password. Now, we'll send an activation notification when you create a user, and a regular password reset everywhere else.

Password Brokers

Laravel uses a password broker to manage password reset tokens. The broker can have an expiration length set.

This PR introduces a config that lets you define which broker to use when it's doing an account activation vs. a regular password reset.

By default it'll be configured to use the same for both, just by looking at the defaults. This should prevent any issues when people install Statamic into an existing Laravel app.

// config/statamic/users.php

'passwords' => [
    'resets' => config('auth.defaults.passwords'),
    'activations' => config('auth.defaults.passwords'),
],

But in our statamic/statamic repo, we'll tweak the defaults:

// config/statamic/users.php

'passwords' => [
    'resets' => 'resets',
    'activations' => 'activations',
],

// config/auth.php

'defaults' => [
    'guard' => 'web',
    'passwords' => 'resets',
],

'passwords' => [
    'resets' => [
        'provider' => 'users',
        'table' => 'password_resets',
        'expire' => 60, // 1 hour
    ],
    'activations' => [
        'provider' => 'users',
        'table' => 'password_activations',
        'expire' => 4320, // 3 days
    ],
],

Password Reset YAML Files

When Statamic notices that it's configured to store users in files, it overrides how password reset tokens are stored. It puts them into a YAML file instead of a database.

This PR will store them in separate files for each broker, named after the table in the config.

[jesseleite]

Slick work as always 🔥

// config/statamic/auth.php

I assume you mean config/statamic/users.php.

Also, I guess we should probably copy the statamic/statamic defaults over to the starter kits as well eh?

[jasonvarga]

I assume you mean config/statamic/users.php

Yup, oops, updated.

I guess we should probably copy the statamic/statamic defaults over

Yeah, but it even if we don't they should continue to work fine. The activation tokens will just continue to last for an hour instead of 3 days.

[jesseleite]

Yeah, but it even if we don't they should continue to work fine. The activation tokens will just continue to last for an hour instead of 3 days.

Totally yeah. But if the purpose of starter kits are setting up sane defaults, I'd say go for it!

[jackmcdade]

Love the solution.