core: add key field to token for easier rotation

passbook/recovery/views.py

@@ -2,22 +2,22 @@
 from django.contrib import messages
 from django.contrib.auth import login
 from django.http import Http404, HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404, redirect
+from django.shortcuts import redirect
 from django.utils.translation import gettext as _
 from django.views import View
 
-from passbook.core.models import Token
+from passbook.core.models import Token, TokenIntents
 
 
 class UseTokenView(View):
     """Use token to login"""
 
-    def get(self, request: HttpRequest, uuid: str) -> HttpResponse:
+    def get(self, request: HttpRequest, key: str) -> HttpResponse:
         """Check if token exists, log user in and delete token."""
-        token: Token = get_object_or_404(Token, pk=uuid)
-        if token.is_expired:
-            token.delete()
+        tokens = Token.filter_not_expired(key=key, intent=TokenIntents.INTENT_RECOVERY)
+        if not tokens.exists():
             raise Http404
+        token = tokens.first()
         login(request, token.user, backend="django.contrib.auth.backends.ModelBackend")
         token.delete()
         messages.warning(request, _("Used recovery-link to authenticate."))