Struct SqliteStore 

pub struct SqliteStore { /* private fields */ }

Implementations

impl SqliteStore

pub async fn open(path: PathBuf) -> Result<Self, AuthError>

pub async fn open_with_key( path: PathBuf, enc_key: Option<TokenEncryptionKey>, ) -> Result<Self, AuthError>

pub async fn pragma(&self, name: &str) -> Result<String, AuthError>

pub async fn register_client( &self, client: RegisteredClient, ) -> Result<(), AuthError>

pub async fn find_client( &self, client_id: &str, ) -> Result<Option<RegisteredClient>, AuthError>

pub async fn insert_authorization_request( &self, request: AuthorizationRequestRow, ) -> Result<(), AuthError>

pub async fn take_authorization_request( &self, state: &str, ) -> Result<AuthorizationRequestRow, AuthError>

pub async fn insert_auth_code( &self, code: AuthorizationCodeRow, ) -> Result<(), AuthError>

pub async fn redeem_auth_code( &self, code: &str, ) -> Result<AuthorizationCodeRow, AuthError>

pub async fn upsert_refresh_token( &self, token: RefreshTokenRow, ) -> Result<(), AuthError>

Insert a new refresh token row, storing a SHA-256 hash of the raw token as the primary key. The plaintext token is never persisted; only the caller-returned value contains it. If an encryption key is configured, provider_refresh_token is encrypted at rest before storage.

Use Self::rotate_refresh_token instead of calling this twice when replacing an existing token — that method performs the swap atomically.

pub async fn rotate_refresh_token( &self, old_token: &str, new_token: RefreshTokenRow, ) -> Result<Option<RefreshTokenRow>, AuthError>

Atomically replace an existing refresh token with a new one in a single SQLite transaction. The old token is deleted and the new token is inserted; if the old token is not found or has expired the operation fails without inserting the new row (replay-safe).

Both the DELETE and the INSERT are wrapped in an explicit BEGIN / COMMIT so a crash between the two statements cannot leave the database without a valid refresh token.

Returns the newly issued RefreshTokenRow (with refresh_token set to the new plaintext value) on success.

pub async fn find_refresh_token( &self, refresh_token: &str, ) -> Result<Option<RefreshTokenRow>, AuthError>

pub async fn has_any_refresh_token(&self) -> Result<bool, AuthError>

Whether any unexpired refresh token has ever been issued, for any client. This is a single-tenant, admin-only gateway, so “someone already completed the Google consent screen once” is a reasonable proxy for “we don’t need to force full re-consent again” without having to know which subject is about to authenticate.

No longer called internally — authorize() now uses the provider-scoped Self::has_any_refresh_token_for_provider instead (this unscoped version incorrectly treats “some OTHER provider already has a refresh token on file” as a reason to skip forced consent on a user’s very first login with a different provider). Retained as general-purpose public API for other consumers of this shared crate, not because removing the internal call site was an accident — do not assume this is dead code to delete.

pub async fn has_any_refresh_token_for_provider( &self, provider: &str, ) -> Result<bool, AuthError>

Same as Self::has_any_refresh_token, scoped to one provider.

authorize() (Task 11) uses this instead of the unscoped version to decide whether to force the upstream consent screen — the unscoped version incorrectly treats “Google already has a refresh token on file” as a reason to skip forced consent on a user’s very first Authelia or GitHub login, silently degrading that new provider’s first session to no local refresh token.

pub async fn upsert_browser_session( &self, session: BrowserSessionRow, ) -> Result<(), AuthError>

pub async fn find_browser_session( &self, session_id: &str, ) -> Result<Option<BrowserSessionRow>, AuthError>

pub async fn revoke_browser_session( &self, session_id: &str, ) -> Result<(), AuthError>

pub async fn execute_test_statement(&self, sql: &str) -> Result<(), AuthError>

Run an arbitrary SQL batch against the store — test fixtures only.

Gated behind cfg(any(test, debug_assertions)) (deliberately not a Cargo feature, mirroring upstream::cache’s test seam) so an arbitrary-SQL execution method can never ship in --all-features --release artifacts.

pub async fn insert_browser_login_state( &self, login: BrowserLoginStateRow, ) -> Result<(), AuthError>

pub async fn count_pending_oauth_states(&self) -> Result<usize, AuthError>

pub async fn take_browser_login_state( &self, state: &str, ) -> Result<Option<BrowserLoginStateRow>, AuthError>

pub async fn insert_native_authorization_result( &self, result: NativeAuthorizationResultRow, ) -> Result<(), AuthError>

Store a native-flow authorization code keyed by state, for the polling desktop client to retrieve via take_native_authorization_result.

Last-write-wins on a state collision (e.g. a client retrying /authorize with the same state after a timeout): each row is single-use (deleted on first successful poll), so overwriting with the newest code is correct — silently dropping the newest code instead (DO NOTHING) would leave the polling client hung until the row’s TTL expires, with no error surfaced anywhere.

pub async fn take_native_authorization_result( &self, state: &str, ) -> Result<Option<NativeAuthorizationResultRow>, AuthError>

One-shot read-and-delete of a pending native-flow authorization code.

pub async fn cleanup_expired(&self) -> Result<u64, AuthError>

Delete expired rows from all short-lived tables. Also drops upstream OAuth credential rows whose access token has expired AND have no refresh token available for re-use (SEC-9). Returns the total number of deleted rows.

pub async fn upsert_upstream_oauth_credentials( &self, row: UpstreamOauthCredentialRow, ) -> Result<(), AuthError>

pub async fn find_upstream_oauth_credentials( &self, upstream_name: &str, subject: &str, ) -> Result<Option<UpstreamOauthCredentialRow>, AuthError>

pub async fn delete_upstream_oauth_credentials( &self, upstream_name: &str, subject: &str, ) -> Result<(), AuthError>

pub async fn save_upstream_oauth_state( &self, row: UpstreamOauthStateRow, ) -> Result<(), AuthError>

pub async fn find_upstream_oauth_state_subject( &self, upstream_name: &str, csrf_token: &str, now: i64, ) -> Result<Option<String>, AuthError>

pub async fn find_upstream_oauth_state_owner( &self, csrf_token: &str, now: i64, ) -> Result<Option<(String, String)>, AuthError>

Look up (upstream_name, subject) by csrf_token alone.

Used by the OAuth callback handler to recover the upstream identity from the state parameter without requiring the caller to know it upfront.

pub async fn delete_upstream_oauth_state_by_csrf( &self, csrf_token: &str, now: i64, ) -> Result<(), AuthError>

Delete a pending OAuth state token by CSRF token to foreclose replay attacks after exchange failure.

pub async fn set_upstream_oauth_state_client_id( &self, upstream_name: &str, csrf_token: &str, client_id: &str, ) -> Result<(), AuthError>

Bind a dynamic OAuth client_id to a pending CSRF state row.

Called by begin_authorization after generating the authorization URL so that complete_authorization_callback can later look up which client_id was used for this specific flow (lab-77y5.15).

pub async fn get_upstream_oauth_state_client_id( &self, upstream_name: &str, csrf_token: &str, now: i64, ) -> Result<Option<String>, AuthError>

Retrieve the dynamic_client_id bound to a pending CSRF state row.

Returns None when no row matches or the row has expired. Used by complete_authorization_callback to recover the exact client_id that was used when the authorization URL was generated (lab-77y5.15).

pub async fn take_upstream_oauth_state( &self, upstream_name: &str, subject: &str, csrf_token: &str, now: i64, ) -> Result<Option<UpstreamOauthStateRow>, AuthError>

Atomic take-once via DELETE ... RETURNING.

pub async fn save_dynamic_client_registration( &self, upstream_name: &str, subject: &str, client_id: &str, ) -> Result<(), AuthError>

pub async fn find_dynamic_client_registration( &self, upstream_name: &str, subject: &str, ) -> Result<Option<String>, AuthError>

pub async fn delete_dynamic_client_registration( &self, upstream_name: &str, subject: &str, ) -> Result<(), AuthError>

pub async fn add_allowed_user( &self, email: &str, added_by: &str, created_at: i64, ) -> Result<(), AuthError>

Add an email address to the allowlist.

email is normalised to lowercase before storage. Returns AuthError::Validation if the email is already present.

pub async fn remove_allowed_user(&self, email: &str) -> Result<(), AuthError>

Remove an email address from the allowlist.

Idempotent: returns Ok(()) even if the email was not present.

pub async fn list_allowed_users(&self) -> Result<Vec<AllowedUserRow>, AuthError>

Return all allowlist rows ordered by created_at ASC.

Trait Implementations

impl Clone for SqliteStore

fn clone(&self) -> SqliteStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SqliteStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.