Bryan Helmkamp be6dd7df97 Serve CLI auth sessions from SQLite ... Points the session listing, revocation, refresh, and logout paths at `AuthSessionStore`. Listing a user's sessions and revoking one stop scanning the whole refresh-token keyspace; both are now indexed queries. Fixes two timestamps that were wrong by construction. `created_at` was fed from the newest token's `issued_at`, so a session's reported start drifted forward on every refresh, and `last_seen_at` read a field only ever set at issue -- so both rendered the same value. They now come from the session row, where they mean what they say. Deletes `next_refresh_row`, which had to fabricate an identity of ("https://github.com", "0") and empty profile strings for the no-existing-row case, because a token was required to carry chain-level fields. Rotation now takes just the new hash, expiry, and user agent. That also removes the pre-read it existed to feed, closing the window between that read and the one `consume_and_rotate` did itself. Opening the store per request is gone with it: five handlers each had a 500-response arm for "could not open the store", which field access on AppStores cannot fail. Drops the replay-revocation cache. Its only effect was reporting `revoked` rather than `expired` for the third and later presentations in a concurrent burst, and `fabro-client` (client.rs:508-513) matches both codes in one arm and treats them identically. Replay detection itself is unaffected: it is `Reused` into `delete_session`, which lives in the database. The concurrency test now accepts either code, since losers that arrive after the winner's revocation find the row already cascaded away. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>		2026-07-26 00:00:15 -04:00
..
fixtures/spa	refactor: organize crates into three layers	2026-07-23 17:59:34 -04:00
it	Serve CLI auth sessions from SQLite	2026-07-26 00:00:15 -04:00