Encode sign-in mail as base64 so webmail cannot mangle the verify token.

Quoted-printable still rewrote token= as token=3D in the raw MIME, which some clients never decode. Distinguish a missing token from a real expiry, and keep links valid for 60 minutes. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-01 17:07:00 -06:00
parent fa928d1b2c
commit f780eac1fa
9 changed files with 148 additions and 25 deletions
@@ -1,2 +1,2 @@
-/** Parity with magic-link request TTL (15 minutes). */
-export const STAKEHOLDER_INVITE_TTL_MS = 15 * 60 * 1000;
+/** Parity with magic-link request TTL (60 minutes). */
+export const STAKEHOLDER_INVITE_TTL_MS = 60 * 60 * 1000;