[Bug]: Recovery emails / links do not respect token_expiry about authentik HOT 3 OPEN

Additional info: Does not matter whether use_global_settings is true or false.

from authentik.

From quickly looking through the code I can see how this would happen if the token expires and is rotated (when the token is rotated we currently default to the default expiry value which is 30 minutes)

from authentik.

While I could be confusing terms, I believe the issue we have found is specifically with token creation during the recovery flows.

In other words:

1. No token / active recovery flow exists for the user
2. Click create recovery link / send recovery email for the user
3. Notice that the new token is created in the authentik_core_token table but that it will always have an expiration time 30 minutes in the future regardless of the token_expiry setting.
4. Validate that after 30 minutes the reset links do not work.

from authentik.