forgot password

app/accesslayer/views.py

@@ -158,7 +158,7 @@ class ForgotPassword(APIView):
                 created=date_now,
                 timeout_at=timeout_at
             ).save()
-            
+
             url = f"{settings.FRONT_END_URL}/forgot-password/reset"\
                   f"?token={TOKEN}"
 
@@ -190,10 +190,15 @@ class ValidateForgotPasswordResetToken(APIView):
     def post(self, request, *args, **kwargs):
         token = request.data['token']
 
+        date_now = datetime.now()
+
         existingToken = AuthToken.objects.filter(token=token).first()
         if existingToken:
             if not existingToken.is_active:
                 raise Exception('Request is no longer active')
+            elif existingToken.timeout_at < date_now:
+                raise Exception('Token already expired')
+            
             return Response(data={
                                 "username": existingToken.user.username,
                                 "email": existingToken.user.email