5 files changed, 48 insertions, 95 deletions
diff --git a/model/client4.go b/model/client4.go
index a33e62846..3a6507f82 100644
--- a/model/client4.go
+++ b/model/client4.go
@@ -751,8 +751,8 @@ func (c *Client4) SendPasswordResetEmail(email string) (bool, *Response) {
 }
 
 // ResetPassword uses a recovery code to update reset a user's password.
-func (c *Client4) ResetPassword(code, newPassword string) (bool, *Response) {
-	requestBody := map[string]string{"code": code, "new_password": newPassword}
+func (c *Client4) ResetPassword(token, newPassword string) (bool, *Response) {
+	requestBody := map[string]string{"token": token, "new_password": newPassword}
 	if r, err := c.DoApiPost(c.GetUsersRoute()+"/password/reset", MapToJson(requestBody)); err != nil {
 		return false, &Response{StatusCode: r.StatusCode, Error: err}
 	} else {
@@ -821,9 +821,9 @@ func (c *Client4) GetUserAudits(userId string, page int, perPage int, etag strin
 	}
 }
 
-// VerifyUserEmail will verify a user's email using user id and hash strings.
-func (c *Client4) VerifyUserEmail(userId, hashId string) (bool, *Response) {
-	requestBody := map[string]string{"user_id": userId, "hash_id": hashId}
+// VerifyUserEmail will verify a user's email using the supplied token.
+func (c *Client4) VerifyUserEmail(token string) (bool, *Response) {
+	requestBody := map[string]string{"token": token}
 	if r, err := c.DoApiPost(c.GetUsersRoute()+"/email/verify", MapToJson(requestBody)); err != nil {
 		return false, &Response{StatusCode: r.StatusCode, Error: err}
 	} else {
diff --git a/model/password_recovery.go b/model/password_recovery.go
deleted file mode 100644
index 8af046642..000000000
--- a/model/password_recovery.go
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright (c) 2016-present Mattermost, Inc. All Rights Reserved.
-// See License.txt for license information.
-
-package model
-
-const (
-	PASSWORD_RECOVERY_CODE_SIZE  = 128
-	PASSWORD_RECOVER_EXPIRY_TIME = 1000 * 60 * 60 // 1 hour
-)
-
-type PasswordRecovery struct {
-	UserId   string
-	Code     string
-	CreateAt int64
-}
-
-func (p *PasswordRecovery) IsValid() *AppError {
-
-	if len(p.UserId) != 26 {
-		return NewLocAppError("User.IsValid", "model.password_recovery.is_valid.user_id.app_error", nil, "")
-	}
-
-	if len(p.Code) != PASSWORD_RECOVERY_CODE_SIZE {
-		return NewLocAppError("User.IsValid", "model.password_recovery.is_valid.code.app_error", nil, "")
-	}
-
-	if p.CreateAt == 0 {
-		return NewLocAppError("User.IsValid", "model.password_recovery.is_valid.create_at.app_error", nil, "")
-	}
-
-	return nil
-}
-
-func (p *PasswordRecovery) PreSave() {
-	p.Code = NewRandomString(PASSWORD_RECOVERY_CODE_SIZE)
-	p.CreateAt = GetMillis()
-}
diff --git a/model/password_recovery_test.go b/model/password_recovery_test.go
deleted file mode 100644
index d64f430fc..000000000
--- a/model/password_recovery_test.go
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright (c) 2017 Mattermost, Inc. All Rights Reserved.
-// See License.txt for license information.
-
-package model
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestPasswordRecoveryIsValid(t *testing.T) {
-	// Valid example.
-	p := PasswordRecovery{
-		UserId:   NewId(),
-		Code:     strings.Repeat("a", 128),
-		CreateAt: GetMillis(),
-	}
-
-	if err := p.IsValid(); err != nil {
-		t.Fatal(err)
-	}
-
-	// Various invalid ones.
-	p.UserId = "abc"
-	if err := p.IsValid(); err == nil {
-		t.Fatal("Should have failed validation")
-	}
-
-	p.UserId = NewId()
-	p.Code = "abc"
-	if err := p.IsValid(); err == nil {
-		t.Fatal("Should have failed validation")
-	}
-
-	p.Code = strings.Repeat("a", 128)
-	p.CreateAt = 0
-	if err := p.IsValid(); err == nil {
-		t.Fatal("Should have failed validation")
-	}
-}
-
-func TestPasswordRecoveryPreSave(t *testing.T) {
-	p := PasswordRecovery{
-		UserId: NewId(),
-	}
-
-	// Check it's valid after running PreSave
-	p.PreSave()
-
-	if err := p.IsValid(); err != nil {
-		t.Fatal(err)
-	}
-}
diff --git a/model/token.go b/model/token.go
new file mode 100644
index 000000000..54cbd210e
--- /dev/null
+++ b/model/token.go
@@ -0,0 +1,39 @@
+// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package model
+
+import "net/http"
+
+const (
+	TOKEN_SIZE            = 128
+	MAX_TOKEN_EXIPRY_TIME = 1000 * 60 * 60 * 24 // 24 hour
+)
+
+type Token struct {
+	Token    string
+	CreateAt int64
+	Type     string
+	Extra    string
+}
+
+func NewToken(tokentype, extra string) *Token {
+	return &Token{
+		Token:    NewRandomString(TOKEN_SIZE),
+		CreateAt: GetMillis(),
+		Type:     tokentype,
+		Extra:    extra,
+	}
+}
+
+func (t *Token) IsValid() *AppError {
+	if len(t.Token) != TOKEN_SIZE {
+		return NewAppError("Token.IsValid", "model.token.is_valid.size", nil, "", http.StatusInternalServerError)
+	}
+
+	if t.CreateAt == 0 {
+		return NewAppError("Token.IsValid", "model.token.is_valid.expiry", nil, "", http.StatusInternalServerError)
+	}
+
+	return nil
+}
diff --git a/model/user.go b/model/user.go
index 1c390a121..f983139f9 100644
--- a/model/user.go
+++ b/model/user.go
@@ -130,6 +130,10 @@ func (u *User) IsValid() *AppError {
 		return InvalidUserError("auth_data_pwd", u.Id)
 	}
 
+	if len(u.Password) > 72 {
+		return InvalidUserError("password_limit", u.Id)
+	}
+
 	return nil
 }