AdvertConfirmationKey
in package
Confirmation key of a Bazaar advert / Comcat company profile (`activation_key`, e-mails `BZ_ADVERT_ACTIVATION_REQUEST` / `CC_ADVERT_ACTIVATION_REQUEST`, link `?do=confirm&key=…`).
Same idea as ActivationKey for accounts: the plain key travels only in the e-mailed link, the column keeps its sha256 hash, so whoever reads the table cannot confirm someone else's advert. Unlike the account key there is no expiry — an advert is confirmed for as long as it exists.
The stored value has three states:
- pending =
hash(plain)→ the link confirms, - consumed =
hash('consumed:' . hash(plain))→ the link answers "already confirmed" (idempotent, but only for the holder of the right key) and can never confirm again — not even when an admin clearsconfirmed_atlater, - legacy = the old plain 40-char key (written before migration
2026-10-05_47, or by hand in the admin). It can never collide with a 64-char hash, so comparing it as plain text gives a DB reader nothing a plain column did not give before.
Pure, no I/O — AdvertConfirmByKeyTrait owns storage.
Table of Contents
Constants
- HASH_LENGTH : int = 64
- Length of a stored hash (sha256 hex) — anything else is a legacy plain key.
- META_PLAIN_KEY : string = '__activationKeyPlain'
- Key in the save `$meta` that carries the plain key from `prepareAdvertForAdd()` to the activation e-mail in `completedSave()` (the entity itself only holds the hash).
- CONSUMED_PREFIX : string = 'consumed:'
Methods
- consumedValue() : string
- Stored value after a successful confirmation.
- generate() : string
- 32 random bytes as hex (64 characters, 256 bits) — safe in a URL as is.
- hash() : string
- matchesConsumed() : bool
- Is this the key whose confirmation has already been consumed? Constant-time comparison.
- matchesPending() : bool
- Does the key from the link open a pending confirmation? Constant-time comparison.
Constants
HASH_LENGTH
Length of a stored hash (sha256 hex) — anything else is a legacy plain key.
public
int
HASH_LENGTH
= 64
META_PLAIN_KEY
Key in the save `$meta` that carries the plain key from `prepareAdvertForAdd()` to the activation e-mail in `completedSave()` (the entity itself only holds the hash).
public
string
META_PLAIN_KEY
= '__activationKeyPlain'
CONSUMED_PREFIX
private
string
CONSUMED_PREFIX
= 'consumed:'
Methods
consumedValue()
Stored value after a successful confirmation.
public
static consumedValue(string $plainKey) : string
Parameters
- $plainKey : string
Return values
stringgenerate()
32 random bytes as hex (64 characters, 256 bits) — safe in a URL as is.
public
static generate() : string
Return values
stringhash()
public
static hash(string $plainKey) : string
Parameters
- $plainKey : string
Return values
stringmatchesConsumed()
Is this the key whose confirmation has already been consumed? Constant-time comparison.
public
static matchesConsumed(string $plainKey, string|null $storedValue) : bool
Parameters
- $plainKey : string
- $storedValue : string|null
Return values
boolmatchesPending()
Does the key from the link open a pending confirmation? Constant-time comparison.
public
static matchesPending(string $plainKey, string|null $storedValue) : bool
Parameters
- $plainKey : string
- $storedValue : string|null