Module account_linking 

Claiming the right to mail a Sisu person an account-linking link, and minting the token it carries. Both caps and the dedup guard are evaluated here and nowhere else, and no argument switches them off; an override has to soft-delete a ledger row.

The token is minted bound to no account: the recipient’s Sisu address is routinely not the address on their account here, so the click while logged in is what creates the binding.

Structs

ClaimedLinkingMails

The three buckets are disjoint and sum to the addresses tried.

DiscoveredPerson

One person Sisu’s list-by-course returned, and every address we could reach them at.

Constants

LINKING_MAIL_QUIET_PERIOD_SECS

How long after a linking mail the person is left alone, across every course and address.

LINK_STUDENT_NUMBER_PATH

Both the mailed URL and the frontend route that serves it are built from this one value.

MAX_LINKING_MAILS_PER_PERSON_AND_COURSE

How many linking mails one person may ever get for one course, tokens that expired unused included.

Functions

already_mailed 🔒

Whether this (person, course, address) already had its mail. The unique index behind claim_send_slots is what actually prevents a second one.

claim_linking_mails

One person’s claim_linking_mails_batch.

claim_linking_mails_batch

Claims one slot and one unbound token per person and address, dedup before rate cap and the allowance spent left to right. Returns one outcome per input, in order; a claimed slot means a mail the link-emails phase still owes.

distinct_addresses 🔒

Sisu can list one address twice and the dedup key is case-insensitive, so the pair is collapsed before either is charged against a cap.

link_student_number_url

The link the mail carries: a bearer credential, whoever holds it can claim the student number.

person_id_of_mails 🔒

remaining_allowance 🔒

How many mails the caps still allow this person for this course.

retire_capped_mails

Retires the linking-mail rows the caps are counting for this person, so the ordinary claim path can take a slot again. No parameter relaxes a cap: the single writer of the ledger evaluates them from the rows that exist, so getting past one means soft-deleting rows, audited as its own action.

void_tokens 🔒

Soft-deletes tokens whose slot lost the race, so no unusable link is left behind.