mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-19 00:03:30 +00:00
c69a47c4e6
A CLI auth session is a rotation chain, but the SlateDB records that back it today store identity and profile per token, so a chain has no owner and nothing stops its rows from disagreeing. These two tables give the chain a home: `auth_sessions` holds the identity and profile once, `refresh_tokens` holds only per-token facts. Two invariants the current code relies on but never states become constraints. The partial unique index on `(session_id) WHERE used_at_ms IS NULL` enforces that rotation leaves exactly one live token per chain -- which is what makes the session listing an indexed lookup instead of a scan-and-group. The foreign key with `ON DELETE CASCADE` makes revoking a session remove its tokens without a second statement. Tokens are retained after rotation until they expire so a replayed token stays distinguishable from a forgery. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| build-support | ||
| fabro-api | ||
| fabro-auth | ||
| fabro-client | ||
| fabro-config | ||
| fabro-core | ||
| fabro-db | ||
| fabro-dev | ||
| fabro-http | ||
| fabro-macros | ||
| fabro-model | ||
| fabro-oauth | ||
| fabro-options-metadata | ||
| fabro-proc | ||
| fabro-redact | ||
| fabro-static | ||
| fabro-telemetry | ||
| fabro-template | ||
| fabro-test | ||
| fabro-types | ||
| fabro-util | ||
| fabro-vault | ||