UserController::resetPassLogin

public UserController::resetPassLogin($uid, $timestamp, $hash)

public function resetPassLogin($uid, $timestamp, $hash) {
  // The current user is not logged in, so check the parameters.
  $current = REQUEST_TIME;
  /** @var \Drupal\user\UserInterface $user */
  $user = $this->userStorage->load($uid);

  // Verify that the user exists and is active.
  if ($user === NULL || !$user->isActive()) {
    // Blocked or invalid user ID, so deny access. The parameters will be in
    // the watchdog's URL for the administrator to check.
    throw new AccessDeniedHttpException();
  }

  // Time out, in seconds, until login URL expires.
  $timeout = $this->config('user.settings')->get('password_reset_timeout');
  // No time out for first time login.
  if ($user->getLastLoginTime() && $current - $timestamp > $timeout) {
    drupal_set_message($this->t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'error');
    return $this->redirect('user.pass');
  }
  elseif ($user->isAuthenticated() && ($timestamp >= $user->getLastLoginTime()) && ($timestamp <= $current) && Crypt::hashEquals($hash, user_pass_rehash($user, $timestamp))) {
    user_login_finalize($user);
    $this->logger->notice('User %name used one-time login link at time %timestamp.', ['%name' => $user->getDisplayName(), '%timestamp' => $timestamp]);
    drupal_set_message($this->t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.'));
    // Let the user's password be changed without the current password
    // check.
    $token = Crypt::randomBytesBase64(55);
    $_SESSION['pass_reset_' . $user->id()] = $token;
    return $this->redirect(
    'entity.user.edit_form', 
    ['user' => $user->id()], 
    [
      'query' => ['pass-reset-token' => $token],
      'absolute' => TRUE,
    ]
    );
  }

  drupal_set_message($this->t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.'), 'error');
  return $this->redirect('user.pass');
}