2 files changed, 96 insertions, 0 deletions
diff --git a/lib/public/Security/VerificationToken/IVerificationToken.php b/lib/public/Security/VerificationToken/IVerificationToken.php
new file mode 100644
index 00000000000..519fbd1bbed
--- /dev/null
+++ b/lib/public/Security/VerificationToken/IVerificationToken.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2021 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\VerificationToken;
+
+use OCP\IUser;
+
+/**
+ * @since 23.0.0
+ */
+interface IVerificationToken {
+	/**
+	 * Checks whether the a provided tokent matches a stored token and its
+	 * constraints. An InvalidTokenException is thrown on issues, otherwise
+	 * the check is successful.
+	 *
+	 * null can be passed as $user, but mind that this is for conveniently
+	 * passing the return of IUserManager::getUser() to this method. When
+	 * $user is null, InvalidTokenException is thrown for all the issued
+	 * tokens are user related.
+	 *
+	 * @throws InvalidTokenException
+	 * @since 23.0.0
+	 */
+	public function check(string $token, ?IUser $user, string $subject, string $passwordPrefix = '', bool $expiresWithLogin = false): void;
+
+	/**
+	 * @since 23.0.0
+	 */
+	public function create(IUser $user, string $subject, string $passwordPrefix = ''): string;
+
+	/**
+	 * Deletes the token identified by the provided parameters
+	 *
+	 * @since 23.0.0
+	 */
+	public function delete(string $token, IUser $user, string $subject): void;
+}
diff --git a/lib/public/Security/VerificationToken/InvalidTokenException.php b/lib/public/Security/VerificationToken/InvalidTokenException.php
new file mode 100644
index 00000000000..a84f8817350
--- /dev/null
+++ b/lib/public/Security/VerificationToken/InvalidTokenException.php
@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2021 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\VerificationToken;
+
+/** @since 23.0.0 */
+class InvalidTokenException extends \Exception {
+	/**
+	 * @since 23.0.0
+	 */
+	public function __construct(int $code) {
+		parent::__construct('', $code);
+	}
+
+	/**
+	 * @var int
+	 * @since 23.0.0
+	 */
+	public const USER_UNKNOWN = 1;
+
+	/**
+	 * @var int
+	 * @since 23.0.0
+	 */
+	public const TOKEN_NOT_FOUND = 2;
+
+	/**
+	 * @var int
+	 * @since 23.0.0
+	 */
+	public const TOKEN_DECRYPTION_ERROR = 3;
+
+	/**
+	 * @var int
+	 * @since 23.0.0
+	 */
+	public const TOKEN_INVALID_FORMAT = 4;
+
+	/**
+	 * @var int
+	 * @since 23.0.0
+	 */
+	public const TOKEN_EXPIRED = 5;
+
+	/**
+	 * @var int
+	 * @since 23.0.0
+	 */
+	public const TOKEN_MISMATCH = 6;
+}