Bryan Helmkamp 701708b32d Add SQLite-backed AuthSessionStore ... Every operation the SlateDB store answers with a full keyspace scan becomes an indexed query here: listing a user's sessions joins one row per session via the partial unique index instead of scanning every token ever issued and grouping by chain, and revoking one is a single DELETE that cascades. Rotation is the structural win. Claiming the presented token is one `UPDATE ... WHERE used_at_ms IS NULL ... RETURNING`, and it is the transaction's first statement, so SQLite takes the write lock before anything is read. A concurrent caller blocks on that lock and then sees the token already spent, which is exactly the replay signal -- so the store needs no `KeyedMutex` to serialise rotation, and the guarantee survives more than one server process. Expiry is checked ahead of reuse on the cold path, preserving the ordering callers depend on: only replaying a still-live token revokes its chain. Drops the ordering CHECKs between a session's timestamps and its tokens'. Rotation stamps `now` from the process clock against rows written by an earlier request, so an NTP step backwards would have turned a harmless clock anomaly into refresh failing outright for every affected session. The store is not wired into the server yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>		2026-07-25 23:42:14 -04:00
..
migrations	Add SQLite-backed AuthSessionStore	2026-07-25 23:42:14 -04:00
src	refactor: organize crates into three layers	2026-07-23 17:59:34 -04:00
tests	Add SQLite-backed AuthSessionStore	2026-07-25 23:42:14 -04:00
Cargo.toml	refactor: organize crates into three layers	2026-07-23 17:59:34 -04:00