Module magic_link 

MagicLink — public-access tokens for contractors / external parties.

Story 3.2 (FR6 INV-13 INV-17). A syndic can issue a magic link to give temporary, scoped, single-use read access to a ticket / quote / invoice / contractor-evaluation without requiring the recipient to create an account. Typical use case: a plumber receives an SMS/email link with a tokenised URL, opens it, sees the relevant ticket, and may submit a response — all without an authenticated session.

Security model

• The clear token is generated once (32 random bytes, base64url) and never stored. Only its SHA-256 digest (hex) is persisted.
• Single-use: consumed_at is set the first time the token is validated. A second validation fails (replay protection).
• Time-bounded: expires_at enforces a TTL chosen at issue time.
• Bound to a single scope (scope_kind + scope_id) — the link cannot be reused to access another resource.

Mirrors the simpler RefreshToken pattern but replaces the revoked: bool flag with consumed_at: Option<DateTime<Utc>> to enforce single-use.

Structs

MagicLink

Enums

MagicLinkScopeKind

What kind of resource a MagicLink grants access to.