Source code
from datetime import datetime
from django.conf import settings
from django.utils.crypto import constant_time_compare, salted_hmac
from django.utils.http import base36_to_int, int_to_base36
class PasswordResetTokenGenerator:
key_salt = "django.contrib.auth.tokens.PasswordResetTokenGenerator"
algorithm = None
_secret = None
_secret_fallbacks = None
def __init__(self):
self.algorithm = self.algorithm or "sha256"
def _get_secret(self):
return self._secret or settings.SECRET_KEY
def _set_secret(self, secret):
self._secret = secret
secret = property(_get_secret, _set_secret)
def _get_fallbacks(self):
if self._secret_fallbacks is None:
return settings.SECRET_KEY_FALLBACKS
return self._secret_fallbacks
def _set_fallbacks(self, fallbacks):
self._secret_fallbacks = fallbacks
secret_fallbacks = property(_get_fallbacks, _set_fallbacks)
def make_token(self, user):
return self._make_token_with_timestamp(
user,
self._num_seconds(self._now()),
self.secret,
)
def check_token(self, user, token):
if not (user and token):
return False
try:
ts_b36, _ = token.split("-")
except ValueError:
return False
try:
ts = base36_to_int(ts_b36)
except ValueError:
return False
for secret in [self.secret, *self.secret_fallbacks]:
if constant_time_compare(
self._make_token_with_timestamp(user, ts, secret),
token,
):
break
else:
return False
if (self._num_seconds(self._now()) - ts) > settings.PASSWORD_RESET_TIMEOUT:
return False
return True
def _make_token_with_timestamp(self, user, timestamp, secret):
ts_b36 = int_to_base36(timestamp)
hash_string = salted_hmac(
self.key_salt,
self._make_hash_value(user, timestamp),
secret=secret,
algorithm=self.algorithm,
).hexdigest()[
::2
]
return "%s-%s" % (ts_b36, hash_string)
def _make_hash_value(self, user, timestamp):
login_timestamp = (
""
if user.last_login is None
else user.last_login.replace(microsecond=0, tzinfo=None)
)
email_field = user.get_email_field_name()
email = getattr(user, email_field, "") or ""
return f"{user.pk}{user.password}{login_timestamp}{timestamp}{email}"
def _num_seconds(self, dt):
return int((dt - datetime(2001, 1, 1)).total_seconds())
def _now(self):
return datetime.now()
Run 1
The code is well-structured and follows Django's established patterns, making it highly readable for someone familiar with the framework. Class organization is logical with clear separation between public methods (`make_token`, `check_token`) and private helpers. Nesting is minimal—the deepest nesting occurs in `check_token` with a try/except and a for loop, which remains manageable. Intent is clear throughout, with method names accurately describing their behavior. Code length is appropriate: each method is concise and focused without unnecessary verbosity. Action granularity is excellent—most lines perform a single operation, and the token generation logic is split into digestible steps. The reading flow is natural, with token creation check logic flowing sequentially from parsing to validation. Minor drawbacks include some trailing whitespace and the compact string formatting in `_make_token_with_timestamp`, but these are negligible. Overall, this is professionally written code that balances clarity with conciseness.
Run 2
The code is well-structured with clear separation of concerns and logical organization. Methods are concise and focused, with one primary action per line. Nesting is minimal—primarily in check_token, where a try/except and a for loop are used but remain readable. The intent is clear, with descriptive method names like _make_token_with_timestamp and check_token. Comments are sparse but helpful, marking key algorithms or fallback loops. The code avoids unnecessary length; helper methods prevent duplication. The reading flow is natural, following a top-down progression from token generation to validation. Minor friction includes the use of `secret` vs `secret_fallbacks` properties and some inline formatting in `_make_token_with_timestamp`, but overall readability is high.
Run 3
The code is generally well-structured, with clear separation of concerns between token generation, validation, and hashing. Methods are concise, focused, and named descriptively. The use of properties for secret and secret_fallbacks keeps access clean. Error handling in check_token is appropriately flat and early-return style, avoiding deep nesting. The for-else pattern is used correctly, though it may be slightly unfamiliar to some readers. Minor readability issues include excessive comments, unusual line breaks around the hexdigest call, and multiple actions in a few lines (e.g., unpacking token.split and comparing timestamps in the same line). Overall, the code is maintainable, predictable, and readable.
Run 1
Code Structure: Well-organized class with focused methods separating configuration, token creation, validation, and hashing. Nesting: Shallow overall; guard clauses and early returns keep validation easy to follow. Clarity of intent: Descriptive method and variable names convey purpose, but missing documentation leaves hashing choices, timestamp origin, and fallback behavior unexplained. Code length: Mostly concise, though property boilerplate and excessive blank lines add visual bulk. Action granularity: Statements generally perform one clear action each; chained HMAC generation and slicing are slightly denser. Reading flow: Validation follows a natural parse, verify, and expiry-check sequence. The loop-else construct requires familiarity, and the awkward multiline hexadecimal slice interrupts an otherwise smooth flow.
Run 2
Code Structure: Well-organized class with focused methods separating configuration, token generation, validation, and hashing. Nesting: Shallow control flow and early returns keep validation easy to follow, although the loop-else construct requires familiarity. Clarity of intent: Descriptive method names communicate purpose, but missing docstrings leave the epoch, hash slicing, and timestamp normalization unexplained. Code length: Mostly concise; property accessors add some boilerplate, and excessive blank lines introduce visual noise. Action granularity: Statements generally perform one action each, with multiline expressions remaining cohesive. Reading flow: Validation proceeds naturally from input checks through parsing, signature verification, and expiration. Awkward formatting of the hexdigest slice interrupts an otherwise readable flow.
Run 3
Code Structure: The class separates configuration, token creation, validation, hashing, and time handling into focused methods. Nesting: Early returns keep validation mostly flat; the loop and conditional introduce only modest nesting. Clarity of intent: Descriptive method and variable names convey the purpose, but the unexplained epoch, alternating-character hash slice, and timestamp normalization require inference. Code length: Mostly concise, although property boilerplate and excessive blank lines add visual overhead. Action granularity: Statements generally perform one action each, with multiline expressions remaining logically cohesive. Reading flow: Validation proceeds naturally from input checks through parsing, signature verification, and expiration checks. The loop-else construct and awkwardly wrapped hexdigest slice slightly interrupt that flow.