ActivationKey
in package
FinalYes
Account activation key — the same contract as {@see PasswordResetToken}, only with a longer validity.
The plain key travels only in the e-mailed activation link; cms_system_users.activation_key
keeps its sha256 hash and activation_expires the deadline. A new activation e-mail issues a
new key (the old plain key cannot be recovered from the hash), so only the last link works.
Links sent before the change carry the old 40-character plain key; migration
2026-10-03_70_… hashed the stored keys in place, so those links keep working until the
expiry the migration gave them.
Pure, no I/O — UserManager owns storage and delivery.
Table of Contents
Constants
- TTL_SECONDS : int = 259200
- Link validity — 72 hours.
Methods
- buildExpiry() : DateTime
- generate() : string
- hash() : string
- matches() : bool
- Empty stored hash (already activated / consumed), missing or past expiry never matches.
Constants
TTL_SECONDS
Link validity — 72 hours.
public
int
TTL_SECONDS
= 259200
Methods
buildExpiry()
public
static buildExpiry(DateTimeInterface $now) : DateTime
Parameters
- $now : DateTimeInterface
Return values
DateTimegenerate()
public
static generate() : string
Return values
stringhash()
public
static hash(string $plainKey) : string
Parameters
- $plainKey : string
Return values
stringmatches()
Empty stored hash (already activated / consumed), missing or past expiry never matches.
public
static matches(string $plainKey, string|null $storedHash, DateTimeInterface|null $expiresAt, DateTimeInterface $now) : bool
Parameters
- $plainKey : string
- $storedHash : string|null
- $expiresAt : DateTimeInterface|null
- $now : DateTimeInterface