memory

func (*Store) AcceptWorkspaceInvitation ¶

func (s *Store) AcceptWorkspaceInvitation(ctx context.Context, invitationID, userID credbound.UUID, at time.Time, membership credbound.Membership, commit credbound.Commit) error

AcceptWorkspaceInvitation marks the invitation accepted by the user and installs the resulting membership in the same commit; an accepted or revoked invitation reports credbound.ErrConflict.

func (*Store) AcceptedWorkspaceInvitations ¶

func (s *Store) AcceptedWorkspaceInvitations(ctx context.Context, userID credbound.UUID) iter.Seq2[credbound.WorkspaceInvitation, error]

AcceptedWorkspaceInvitations streams every invitation the user accepted, oldest first, for the PrivacyStore capability.

func (*Store) ActivateTOTP ¶

func (s *Store) ActivateTOTP(ctx context.Context, factor credbound.TOTPFactor, recovery []credbound.RecoveryCode, commit credbound.Commit) error

ActivateTOTP activates the pending factor and stores its recovery codes in the same commit.

func (*Store) AdoptSCIMUser ¶

func (s *Store) AdoptSCIMUser(ctx context.Context, membership credbound.Membership, link credbound.SCIMUser, commit credbound.Commit) error

AdoptSCIMUser links a directory user to an existing Credbound account, installing the membership in the same commit.

func (*Store) AnonymizeUser ¶

func (s *Store) AnonymizeUser(ctx context.Context, userID credbound.UUID, at time.Time, commit credbound.Commit) error

AnonymizeUser pseudonymizes a user: it scrubs the mutable personal data, disables the account, revokes every credential and removes the second factors, all under the commit's snapshot, while the append-only audit chain is preserved. Disabling the last enabled root or a sole workspace admin reports ErrConflict, exactly like SetUserDisabled.

func (*Store) AppendAudit ¶

func (s *Store) AppendAudit(ctx context.Context, commit credbound.Commit) error

AppendAudit commits a standalone audit event (and any transactional hook) without another mutation.

func (*Store) AuditChainHead ¶

func (s *Store) AuditChainHead(ctx context.Context) (int64, []byte, error)

AuditChainHead returns the sequence number and hash of the latest chained audit event.

func (*Store) AuditEvents ¶

func (s *Store) AuditEvents(ctx context.Context, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.AuditEvent], error]

AuditEvents streams the workspace's audit events, newest first, as one cursor page.

func (*Store) Bootstrap ¶

func (s *Store) Bootstrap(ctx context.Context, user credbound.User, email credbound.EmailAddress, password credbound.PasswordCredential, workspace credbound.Workspace, membership credbound.Membership, admin credbound.InstanceAdministrator, commit credbound.Commit) error

Bootstrap atomically creates the first user with its primary email, password, workspace, admin membership and root administrator; once the instance is populated it reports credbound.ErrConflict.

func (*Store) ChainedAuditEvents ¶

func (s *Store) ChainedAuditEvents(ctx context.Context, afterSequence int64) iter.Seq2[credbound.AuditEvent, error]

ChainedAuditEvents streams every chained audit event in sequence order for verification with credbound.VerifyAuditChain.

func (*Store) ChangePassword ¶

func (s *Store) ChangePassword(ctx context.Context, password credbound.PasswordCredential, at time.Time, commit credbound.Commit) error

ChangePassword swaps the user's password credential and stamps their active sessions revoked in the same commit.

func (*Store) ClaimEmailIssuance ¶

func (s *Store) ClaimEmailIssuance(ctx context.Context, address, purpose string, at, notBefore time.Time) (bool, error)

ClaimEmailIssuance atomically records an email issuance and reports whether it was allowed: it claims only when no earlier issuance for (address, purpose) is newer than notBefore. Entries older than notBefore no longer throttle anything and are pruned on every claim, so anonymous traffic cannot grow the map beyond the current cooldown window.

func (*Store) CompletePasswordReset ¶

func (s *Store) CompletePasswordReset(ctx context.Context, resetID credbound.UUID, password credbound.PasswordCredential, at time.Time, commit credbound.Commit) error

CompletePasswordReset consumes the reset and installs the password — the account's first, for a passwordless member provisioned by SSO JIT or SCIM — revoking the user's other pending resets, tokens, sessions and throttle in the same commit; a reused reset reports credbound.ErrConflict.

func (*Store) ConfirmWorkspaceDomain ¶

func (s *Store) ConfirmWorkspaceDomain(ctx context.Context, id credbound.UUID, at time.Time, commit credbound.Commit) error

ConfirmWorkspaceDomain marks the domain verified; confirming twice reports credbound.ErrConflict.

func (*Store) ConfirmedWorkspaceDomainByName ¶

func (s *Store) ConfirmedWorkspaceDomainByName(ctx context.Context, name string) (credbound.WorkspaceDomain, error)

ConfirmedWorkspaceDomainByName resolves a confirmed domain by name; unknown or unconfirmed domains report credbound.ErrNotFound.

func (*Store) ConsumeEmailAuthentication ¶

func (s *Store) ConsumeEmailAuthentication(ctx context.Context, tokenID, userID credbound.UUID, at time.Time, completesLogin bool, commit credbound.Commit) error

ConsumeEmailAuthentication marks the user's credential used and, when the consumption completes the sign-in, updates last-seen and clears the login throttle; reuse reports credbound.ErrConflict.

func (*Store) ConsumeOAuthAuthorizationCode ¶

func (s *Store) ConsumeOAuthAuthorizationCode(ctx context.Context, codeID credbound.UUID, usedAt time.Time, access credbound.OAuthAccessToken, refresh *credbound.OAuthRefreshToken, commit credbound.Commit) error

ConsumeOAuthAuthorizationCode atomically marks the single-use code consumed and stores the access and optional refresh token it was exchanged for.

func (*Store) ConsumeRecoveryCode ¶

func (s *Store) ConsumeRecoveryCode(ctx context.Context, userID credbound.UUID, digest []byte, usedAt time.Time, commit credbound.Commit) (bool, error)

ConsumeRecoveryCode marks the matching unused recovery code used, reporting false when no unused code matches the digest.

func (*Store) CountUnusedRecoveryCodes ¶

func (s *Store) CountUnusedRecoveryCodes(ctx context.Context, userID credbound.UUID) (int64, error)

CountUnusedRecoveryCodes reports how many of the user's recovery codes remain unused.

func (*Store) CreateEmailAuthentication ¶

func (s *Store) CreateEmailAuthentication(ctx context.Context, credential credbound.EmailAuthenticationCredential, commit credbound.Commit) error

CreateEmailAuthentication stores a single-use magic-link or email OTP credential.

func (*Store) CreateOAuthClient ¶

func (s *Store) CreateOAuthClient(ctx context.Context, client credbound.OAuthClient, initialAccessTokenID credbound.UUID, usedAt time.Time, commit credbound.Commit) error

CreateOAuthClient stores a dynamically registered client, consuming a use of the initial access token in the same commit when one gated the registration.

func (*Store) CreateOAuthClientAccessToken ¶

func (s *Store) CreateOAuthClientAccessToken(ctx context.Context, value credbound.OAuthClientAccessToken, commit credbound.Commit) error

CreateOAuthClientAccessToken stores a client-credentials access token.

func (*Store) CreateOAuthGrantAndCode ¶

func (s *Store) CreateOAuthGrantAndCode(ctx context.Context, grant credbound.OAuthGrant, code credbound.OAuthAuthorizationCode, commit credbound.Commit) error

CreateOAuthGrantAndCode atomically stores a user grant with its single-use authorization code.

func (*Store) CreateOAuthInitialAccessToken ¶

func (s *Store) CreateOAuthInitialAccessToken(ctx context.Context, token credbound.OAuthInitialAccessToken, commit credbound.Commit) error

CreateOAuthInitialAccessToken stores an initial access token for gated dynamic client registration.

func (*Store) CreateOAuthIssuer ¶

func (s *Store) CreateOAuthIssuer(ctx context.Context, issuer credbound.OAuthIssuer, commit credbound.Commit) error

CreateOAuthIssuer stores an authorization server issuer; a duplicate ID or URL reports credbound.ErrConflict.

func (*Store) CreateOAuthProtectedResource ¶

func (s *Store) CreateOAuthProtectedResource(ctx context.Context, resource credbound.OAuthProtectedResource, commit credbound.Commit) error

CreateOAuthProtectedResource stores a protected resource; a duplicate ID or URI reports credbound.ErrConflict.

func (*Store) CreatePAT ¶

func (s *Store) CreatePAT(ctx context.Context, pat credbound.PAT, commit credbound.Commit) error

CreatePAT stores a personal access token record; a duplicate ID or prefix reports credbound.ErrConflict.

func (*Store) CreatePasswordReset ¶

func (s *Store) CreatePasswordReset(ctx context.Context, credential credbound.PasswordResetCredential, commit credbound.Commit) error

CreatePasswordReset stores a single-use password reset credential.

func (*Store) CreateSCIMConfiguration ¶

func (s *Store) CreateSCIMConfiguration(ctx context.Context, configuration credbound.SCIMConfiguration, credential credbound.SCIMCredential, commit credbound.Commit) error

CreateSCIMConfiguration stores a workspace's SCIM configuration together with its first bearer credential.

func (*Store) CreateSCIMUser ¶

func (s *Store) CreateSCIMUser(ctx context.Context, user credbound.User, email credbound.EmailAddress, membership credbound.Membership, link credbound.SCIMUser, commit credbound.Commit) error

CreateSCIMUser atomically creates the Credbound user, email and membership for a directory user and links them to the SCIM record.

func (*Store) CreateSession ¶

func (s *Store) CreateSession(ctx context.Context, session credbound.Session, credentialDigest []byte, commit credbound.Commit) error

CreateSession stores a server-side session; a duplicate ID reports credbound.ErrConflict. A non-empty credentialDigest must still fingerprint the user's current password credential, so a session can never be minted from an authentication whose password was concurrently replaced; a mismatch (or a vanished credential) reports credbound.ErrConflict.

func (*Store) CreateSignup ¶

func (s *Store) CreateSignup(ctx context.Context, user credbound.User, email credbound.EmailAddress, verification *credbound.EmailVerificationCredential, password credbound.PasswordCredential, workspace credbound.Workspace, membership credbound.Membership, commit credbound.Commit) error

CreateSignup atomically creates a self-service user, its primary email (with the optional pending verification), password credential and fresh workspace; an unverified address stays excluded from sign-in lookup until VerifyEmail.

func (*Store) CreateUser ¶

func (s *Store) CreateUser(ctx context.Context, user credbound.User, email credbound.EmailAddress, password credbound.PasswordCredential, membership credbound.Membership, commit credbound.Commit) error

CreateUser inserts a user with a primary email, password credential and initial membership in an existing workspace; a duplicate user ID or email address reports credbound.ErrConflict.

func (*Store) CreateWorkspace ¶

func (s *Store) CreateWorkspace(ctx context.Context, workspace credbound.Workspace, owner credbound.Membership, commit credbound.Commit) error

CreateWorkspace inserts a workspace together with its owning membership.

func (*Store) CreateWorkspaceDomain ¶

func (s *Store) CreateWorkspaceDomain(ctx context.Context, domain credbound.WorkspaceDomain, staleBefore time.Time, commit credbound.Commit) error

CreateWorkspaceDomain stores an unconfirmed domain claim; a domain already claimed by any workspace reports credbound.ErrConflict.

func (*Store) CreateWorkspaceInvitation ¶

func (s *Store) CreateWorkspaceInvitation(ctx context.Context, invitation credbound.WorkspaceInvitation, commit credbound.Commit) error

CreateWorkspaceInvitation stores an invitation; a pending invitation for the same address in the workspace reports credbound.ErrConflict.

func (*Store) DeletePasskey ¶

func (s *Store) DeletePasskey(ctx context.Context, userID, passkeyID credbound.UUID, commit credbound.Commit) error

DeletePasskey removes one of the user's passkeys.

func (*Store) DeleteSCIMGroup ¶

func (s *Store) DeleteSCIMGroup(ctx context.Context, group credbound.SCIMGroup, memberships []credbound.Membership, commit credbound.Commit) error

DeleteSCIMGroup soft-deletes the group and applies the recomputed memberships in the same commit.

func (*Store) DeleteWorkspaceDomain ¶

func (s *Store) DeleteWorkspaceDomain(ctx context.Context, id credbound.UUID, commit credbound.Commit) error

DeleteWorkspaceDomain removes the domain claim.

func (*Store) DisableSCIMConfiguration ¶

func (s *Store) DisableSCIMConfiguration(ctx context.Context, id credbound.UUID, disabledAt time.Time, commit credbound.Commit) error

DisableSCIMConfiguration marks the configuration disabled so its credentials stop authenticating.

func (*Store) DisableTOTP ¶

func (s *Store) DisableTOTP(ctx context.Context, userID credbound.UUID, commit credbound.Commit) error

DisableTOTP removes the user's TOTP factor and recovery codes.

func (*Store) EmailAuthenticationByID ¶

func (s *Store) EmailAuthenticationByID(ctx context.Context, tokenID credbound.UUID) (credbound.EmailAuthenticationCredential, error)

EmailAuthenticationByID returns the email authentication credential with the given token ID.

func (*Store) EmailByAddress ¶

func (s *Store) EmailByAddress(ctx context.Context, address string) (credbound.EmailAddress, error)

EmailByAddress returns the address record without its verification credential; ErrNotFound when no address matches.

func (*Store) EmailVerificationByID ¶

func (s *Store) EmailVerificationByID(ctx context.Context, emailID credbound.UUID) (credbound.EmailAddress, credbound.EmailVerificationCredential, error)

EmailVerificationByID returns the email address and its pending verification credential.

func (*Store) Emails ¶

func (s *Store) Emails(ctx context.Context, userID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.EmailAddress], error]

Emails streams the user's email addresses, newest first, as one cursor page.

func (*Store) InstanceAdministrator ¶

func (s *Store) InstanceAdministrator(ctx context.Context, userID credbound.UUID) (credbound.InstanceAdministrator, error)

InstanceAdministrator returns the user's instance-administration role.

func (*Store) InstanceAdministrators ¶

func (s *Store) InstanceAdministrators(ctx context.Context) iter.Seq2[credbound.InstanceAdministrator, error]

InstanceAdministrators streams every instance role assignment, oldest first.

func (*Store) InstanceAuditEvents ¶

func (s *Store) InstanceAuditEvents(ctx context.Context, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.AuditEvent], error]

InstanceAuditEvents streams audit events across the whole instance, newest first, as one cursor page.

func (*Store) JITProvisionSSOUser ¶

func (s *Store) JITProvisionSSOUser(ctx context.Context, user credbound.User, email credbound.EmailAddress, membership credbound.Membership, identity credbound.SSOIdentity, _ time.Time, commit credbound.Commit) error

JITProvisionSSOUser atomically creates a user with a verified email, workspace membership and linked SSO identity for domain-based just-in-time provisioning.

func (*Store) LinkSSO ¶

func (s *Store) LinkSSO(ctx context.Context, identity credbound.SSOIdentity, commit credbound.Commit) error

LinkSSO stores a new SSO identity link; an identity already linked to any user reports credbound.ErrConflict.

func (*Store) LoginThrottleByUserID ¶

func (s *Store) LoginThrottleByUserID(ctx context.Context, userID credbound.UUID) (credbound.LoginThrottle, error)

LoginThrottleByUserID returns the user's current login throttle state.

func (*Store) Membership ¶

func (s *Store) Membership(ctx context.Context, workspaceID, userID credbound.UUID) (credbound.Membership, error)

Membership returns the user's membership in the workspace.

func (*Store) Memberships ¶

func (s *Store) Memberships(ctx context.Context, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.Membership], error]

Memberships streams the workspace's memberships, newest first, as one cursor page.

func (*Store) OAuthAccessTokenByPrefix ¶

func (s *Store) OAuthAccessTokenByPrefix(ctx context.Context, prefix string) (credbound.OAuthAccessToken, error)

OAuthAccessTokenByPrefix returns the access token record addressed by its lookup prefix.

func (*Store) OAuthAuthorizationCodeByPrefix ¶

func (s *Store) OAuthAuthorizationCodeByPrefix(ctx context.Context, prefix string) (credbound.OAuthAuthorizationCode, error)

OAuthAuthorizationCodeByPrefix returns the authorization code record addressed by its lookup prefix.

func (*Store) OAuthClientAccessTokenByPrefix ¶

func (s *Store) OAuthClientAccessTokenByPrefix(ctx context.Context, prefix string) (credbound.OAuthClientAccessToken, error)

OAuthClientAccessTokenByPrefix returns the client-credentials access token addressed by its lookup prefix.

func (*Store) OAuthClientByClientID ¶

func (s *Store) OAuthClientByClientID(ctx context.Context, issuerID credbound.UUID, clientID string) (credbound.OAuthClient, error)

OAuthClientByClientID resolves the issuer's client by its OAuth client_id.

func (*Store) OAuthClientByID ¶

func (s *Store) OAuthClientByID(ctx context.Context, id credbound.UUID) (credbound.OAuthClient, error)

OAuthClientByID returns the client with the given record ID.

func (*Store) OAuthClients ¶

func (s *Store) OAuthClients(ctx context.Context, issuerID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.OAuthClient], error]

OAuthClients streams the issuer's clients, newest first, as one cursor page.

func (*Store) OAuthGrant ¶

func (s *Store) OAuthGrant(ctx context.Context, id credbound.UUID) (credbound.OAuthGrant, error)

OAuthGrant returns the grant with the given ID.

func (*Store) OAuthGrants ¶

func (s *Store) OAuthGrants(ctx context.Context, userID, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.OAuthGrant], error]

OAuthGrants streams grants, optionally filtered by user and workspace, newest first, as one cursor page.

func (*Store) OAuthInitialAccessTokenByPrefix ¶

func (s *Store) OAuthInitialAccessTokenByPrefix(ctx context.Context, prefix string) (credbound.OAuthInitialAccessToken, error)

OAuthInitialAccessTokenByPrefix returns the token record addressed by its lookup prefix.

func (*Store) OAuthInitialAccessTokens ¶

func (s *Store) OAuthInitialAccessTokens(ctx context.Context, issuerID credbound.UUID) iter.Seq2[credbound.OAuthInitialAccessToken, error]

OAuthInitialAccessTokens streams the issuer's DCR bootstrap credentials, oldest first, revoked ones included and digests omitted.

func (*Store) OAuthIssuerByID ¶

func (s *Store) OAuthIssuerByID(ctx context.Context, id credbound.UUID) (credbound.OAuthIssuer, error)

OAuthIssuerByID returns the issuer with the given ID.

func (*Store) OAuthIssuerByURL ¶

func (s *Store) OAuthIssuerByURL(ctx context.Context, raw string) (credbound.OAuthIssuer, error)

OAuthIssuerByURL resolves an issuer by its canonical URL.

func (*Store) OAuthIssuers ¶

func (s *Store) OAuthIssuers(ctx context.Context, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.OAuthIssuer], error]

OAuthIssuers streams all issuers, newest first, as one cursor page.

func (*Store) OAuthProtectedResourceByID ¶

func (s *Store) OAuthProtectedResourceByID(ctx context.Context, id credbound.UUID) (credbound.OAuthProtectedResource, error)

OAuthProtectedResourceByID returns the resource with the given ID.

func (*Store) OAuthProtectedResourceByURI ¶

func (s *Store) OAuthProtectedResourceByURI(ctx context.Context, uri string) (credbound.OAuthProtectedResource, error)

OAuthProtectedResourceByURI resolves a resource by its canonical URI.

func (*Store) OAuthProtectedResources ¶

func (s *Store) OAuthProtectedResources(ctx context.Context, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.OAuthProtectedResource], error]

OAuthProtectedResources streams resources, optionally filtered by workspace, newest first, as one cursor page.

func (*Store) OAuthRefreshTokenByPrefix ¶

func (s *Store) OAuthRefreshTokenByPrefix(ctx context.Context, prefix string) (credbound.OAuthRefreshToken, error)

OAuthRefreshTokenByPrefix returns the refresh token record addressed by its lookup prefix.

func (*Store) PATByID ¶ added in v0.0.4

func (s *Store) PATByID(ctx context.Context, id credbound.UUID) (credbound.PAT, error)

PATs streams the user's tokens, newest first, as one cursor page with digests omitted. PATByID returns one token by identifier.

func (*Store) PATByPrefix ¶

func (s *Store) PATByPrefix(ctx context.Context, prefix string) (credbound.PAT, error)

PATByPrefix returns the token record addressed by its lookup prefix.

func (*Store) PATs ¶

func (s *Store) PATs(ctx context.Context, userID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.PAT], error]

func (*Store) PasskeyByCredentialID ¶

func (s *Store) PasskeyByCredentialID(ctx context.Context, credentialID []byte) (credbound.Passkey, error)

PasskeyByCredentialID returns the passkey owning the credential ID, for discoverable (usernameless) authentication.

func (*Store) Passkeys ¶

func (s *Store) Passkeys(ctx context.Context, userID credbound.UUID) iter.Seq2[credbound.Passkey, error]

Passkeys streams the user's passkeys in creation order.

func (*Store) PasswordByUserID ¶

func (s *Store) PasswordByUserID(ctx context.Context, userID credbound.UUID) (credbound.PasswordCredential, error)

PasswordByUserID returns the user's stored password credential.

func (*Store) PasswordResetByID ¶

func (s *Store) PasswordResetByID(ctx context.Context, resetID credbound.UUID) (credbound.PasswordResetCredential, error)

PasswordResetByID returns the password reset credential with the given ID.

func (*Store) PendingWorkspaceInvitation ¶

func (s *Store) PendingWorkspaceInvitation(ctx context.Context, workspaceID credbound.UUID, email string) (credbound.WorkspaceInvitation, error)

PendingWorkspaceInvitation returns the workspace's unaccepted, unrevoked invitation for the email address.

func (*Store) RecordAuthentication ¶

func (s *Store) RecordAuthentication(ctx context.Context, userID credbound.UUID, seenAt time.Time, commit credbound.Commit) error

RecordAuthentication marks a successful login, updating the user's last- seen time and clearing any login throttle.

func (*Store) RecordLoginFailure ¶

func (s *Store) RecordLoginFailure(ctx context.Context, userID credbound.UUID, at time.Time, threshold int64, lockedUntil time.Time, commit credbound.Commit) (credbound.LoginThrottle, error)

RecordLoginFailure counts a failed login (restarting the window after an expired lockout) and applies lockedUntil once the failure threshold is reached, returning the updated throttle.

func (*Store) RecordPasswordAuthentication ¶

func (s *Store) RecordPasswordAuthentication(ctx context.Context, userID credbound.UUID, currentHash string, seenAt time.Time, commit credbound.Commit) error

RecordPasswordAuthentication marks a successful password login like RecordAuthentication, but only while currentHash is still the stored credential; a credential that moved or vanished reports credbound.ErrConflict and leaves the store untouched.

func (*Store) RegisterInvitedUser ¶

func (s *Store) RegisterInvitedUser(ctx context.Context, invitationID credbound.UUID, user credbound.User, email credbound.EmailAddress, password credbound.PasswordCredential, membership credbound.Membership, at time.Time, commit credbound.Commit) error

RegisterInvitedUser atomically creates the invited user with email, password and membership while accepting the invitation.

func (*Store) RehashPassword ¶

func (s *Store) RehashPassword(ctx context.Context, password credbound.PasswordCredential, previousHash string, commit credbound.Commit) error

RehashPassword swaps the user's password credential only while the hash the verification ran against is still in place; a concurrent replacement (or a vanished credential) reports credbound.ErrConflict and leaves the store untouched.

func (*Store) ReissueEmailVerification ¶

func (s *Store) ReissueEmailVerification(ctx context.Context, emailID credbound.UUID, verification credbound.EmailVerificationCredential, commit credbound.Commit) error

ReissueEmailVerification replaces the pending verification credential of an unverified address; an already-verified or missing address reports credbound.ErrConflict.

func (*Store) RemoveEmail ¶

func (s *Store) RemoveEmail(ctx context.Context, userID, emailID credbound.UUID, commit credbound.Commit) error

RemoveEmail deletes a non-primary address, refusing to remove the user's last verified one (credbound.ErrConflict).

func (*Store) RemoveInstanceRole ¶

func (s *Store) RemoveInstanceRole(ctx context.Context, userID credbound.UUID, commit credbound.Commit) error

RemoveInstanceRole revokes the user's instance role, refusing to remove the last root administrator (credbound.ErrConflict).

func (*Store) RemoveMembership ¶

func (s *Store) RemoveMembership(ctx context.Context, workspaceID, userID credbound.UUID, at time.Time, commit credbound.Commit) error

RemoveMembership deletes the membership, refusing to remove the workspace's last active admin (credbound.ErrConflict) and revoking the member's workspace-scoped tokens.

func (*Store) ReplaceRecoveryCodes ¶

func (s *Store) ReplaceRecoveryCodes(ctx context.Context, userID credbound.UUID, codes []credbound.RecoveryCode, commit credbound.Commit) error

ReplaceRecoveryCodes atomically deletes the user's recovery codes and inserts the replacement set; without an active TOTP factor it reports credbound.ErrNotFound.

func (*Store) ResetSecondFactor ¶

func (s *Store) ResetSecondFactor(ctx context.Context, userID credbound.UUID, at time.Time, commit credbound.Commit) error

ResetSecondFactor removes the user's TOTP factor with its recovery codes and every passkey, and revokes the user's active sessions, in one transaction. It succeeds even when no second factor exists; an unknown user reports credbound.ErrNotFound.

func (*Store) RevokeOAuthAccessToken ¶

func (s *Store) RevokeOAuthAccessToken(ctx context.Context, id credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeOAuthAccessToken marks the access token revoked.

func (*Store) RevokeOAuthClientAccessToken ¶

func (s *Store) RevokeOAuthClientAccessToken(ctx context.Context, id credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeOAuthClientAccessToken marks the client-credentials access token revoked.

func (*Store) RevokeOAuthGrant ¶

func (s *Store) RevokeOAuthGrant(ctx context.Context, grantID credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeOAuthGrant revokes the grant together with its outstanding access and refresh tokens.

func (*Store) RevokeOAuthInitialAccessToken ¶

func (s *Store) RevokeOAuthInitialAccessToken(ctx context.Context, id credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeOAuthInitialAccessToken marks the token revoked.

func (*Store) RevokeOAuthRefreshFamily ¶

func (s *Store) RevokeOAuthRefreshFamily(ctx context.Context, familyID credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeOAuthRefreshFamily revokes every token in the refresh-token family and the access tokens of the grants the family descends from, the fail-safe response to detected refresh token reuse: the thief's already- minted access token must die with the family, not survive until expiry.

func (*Store) RevokePAT ¶

func (s *Store) RevokePAT(ctx context.Context, userID, id credbound.UUID, revokedAt time.Time, commit credbound.Commit) error

RevokePAT marks the user's token revoked.

func (*Store) RevokeSCIMCredential ¶

func (s *Store) RevokeSCIMCredential(ctx context.Context, configurationID, id credbound.UUID, revokedAt time.Time, commit credbound.Commit) error

RevokeSCIMCredential marks the configuration's credential revoked.

func (*Store) RevokeSession ¶

func (s *Store) RevokeSession(ctx context.Context, id credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeSession marks the session revoked; an already-revoked session is left unchanged.

func (*Store) RevokeUserCredentials ¶

func (s *Store) RevokeUserCredentials(ctx context.Context, userID credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeUserCredentials revokes all of the user's tokens (PATs and OAuth) and sessions in one commit.

func (*Store) RevokeUserSessions ¶

func (s *Store) RevokeUserSessions(ctx context.Context, userID credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeUserSessions revokes every session of the user.

func (*Store) RevokeWorkspaceInvitation ¶

func (s *Store) RevokeWorkspaceInvitation(ctx context.Context, workspaceID, invitationID credbound.UUID, at time.Time, commit credbound.Commit) error

RevokeWorkspaceInvitation marks the workspace's invitation revoked; an accepted or already-revoked invitation reports credbound.ErrConflict.

func (*Store) RotateOAuthClientCredentials ¶

func (s *Store) RotateOAuthClientCredentials(ctx context.Context, clientRecordID credbound.UUID, secretDigest, jwks, metadataHash []byte, at time.Time, commit credbound.Commit) error

SetOAuthClientDisabled enables or disables the client. RotateOAuthClientCredentials replaces the client's secret digest and/or inline JWKS (with its recomputed metadata hash) after an administrative credential rotation.

func (*Store) RotateOAuthRefreshToken ¶

func (s *Store) RotateOAuthRefreshToken(ctx context.Context, previousID credbound.UUID, usedAt time.Time, access credbound.OAuthAccessToken, refresh credbound.OAuthRefreshToken, commit credbound.Commit) error

RotateOAuthRefreshToken atomically retires the used refresh token and stores its successor pair, keeping the family linked for reuse detection.

func (*Store) SCIMConfiguration ¶

func (s *Store) SCIMConfiguration(ctx context.Context, id credbound.UUID) (credbound.SCIMConfiguration, error)

SCIMConfiguration returns the configuration with the given ID.

func (*Store) SCIMConfigurationByCredentialPrefix ¶

func (s *Store) SCIMConfigurationByCredentialPrefix(ctx context.Context, prefix string) (credbound.SCIMConfiguration, credbound.SCIMCredential, error)

SCIMConfigurationByCredentialPrefix resolves the configuration and credential addressed by a bearer token's lookup prefix.

func (*Store) SCIMConfigurations ¶

func (s *Store) SCIMConfigurations(ctx context.Context, workspaceID credbound.UUID) iter.Seq2[credbound.SCIMConfiguration, error]

SCIMConfigurations streams the workspace's provisioning domains, oldest first.

func (*Store) SCIMCredentials ¶

func (s *Store) SCIMCredentials(ctx context.Context, configurationID credbound.UUID) iter.Seq2[credbound.SCIMCredential, error]

SCIMCredentials streams the configuration's bearer credentials, oldest first, with digests omitted.

func (*Store) SCIMGroup ¶

func (s *Store) SCIMGroup(ctx context.Context, configurationID, id credbound.UUID) (credbound.SCIMGroup, error)

SCIMGroup returns the configuration's group with the given ID.

func (*Store) SCIMGroupByExternalID ¶

func (s *Store) SCIMGroupByExternalID(ctx context.Context, configurationID credbound.UUID, externalID string) (credbound.SCIMGroup, error)

SCIMGroupByExternalID resolves the configuration's group by its directory external ID.

func (*Store) SCIMGroups ¶

func (s *Store) SCIMGroups(ctx context.Context, configurationID credbound.UUID, filter credbound.SCIMFilter, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.SCIMGroup], error]

SCIMGroups streams the configuration's groups matching the filter, newest first, as one cursor page.

func (*Store) SCIMUser ¶

func (s *Store) SCIMUser(ctx context.Context, configurationID, id credbound.UUID) (credbound.SCIMUser, error)

SCIMUser returns the configuration's SCIM user with the given ID.

func (*Store) SCIMUserByExternalID ¶

func (s *Store) SCIMUserByExternalID(ctx context.Context, configurationID credbound.UUID, externalID string) (credbound.SCIMUser, error)

SCIMUserByExternalID resolves the configuration's SCIM user by its directory external ID.

func (*Store) SCIMUserByUserName ¶

func (s *Store) SCIMUserByUserName(ctx context.Context, configurationID credbound.UUID, userName string) (credbound.SCIMUser, error)

SCIMUserByUserName resolves the configuration's SCIM user by normalized userName.

func (*Store) SCIMUsers ¶

func (s *Store) SCIMUsers(ctx context.Context, configurationID credbound.UUID, filter credbound.SCIMFilter, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.SCIMUser], error]

SCIMUsers streams the configuration's users matching the filter, newest first, as one cursor page.

func (*Store) SCIMUsersByUser ¶

func (s *Store) SCIMUsersByUser(ctx context.Context, userID credbound.UUID) iter.Seq2[credbound.SCIMUser, error]

SCIMUsersByUser streams every tenant-scoped SCIM profile linked to the user across configurations, oldest first, for the PrivacyStore capability.

func (*Store) SSOIdentities ¶

func (s *Store) SSOIdentities(ctx context.Context, userID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.SSOIdentity], error]

SSOIdentities streams the user's SSO identity links, newest first, as one cursor page.

func (*Store) SSOIdentity ¶

func (s *Store) SSOIdentity(ctx context.Context, providerConfigurationID credbound.UUID, issuer, subject string) (credbound.SSOIdentity, error)

SSOIdentity resolves a linked identity by provider configuration, issuer and subject.

func (*Store) SaveEmail ¶

func (s *Store) SaveEmail(ctx context.Context, email credbound.EmailAddress, verification credbound.EmailVerificationCredential, commit credbound.Commit) error

SaveEmail adds an additional email address with its pending verification credential; a duplicate address reports credbound.ErrConflict.

func (*Store) SavePasskey ¶

func (s *Store) SavePasskey(ctx context.Context, passkey credbound.Passkey, commit credbound.Commit) error

SavePasskey stores a new passkey; a credential ID already registered to any user reports credbound.ErrConflict.

func (*Store) SaveSCIMCredential ¶

func (s *Store) SaveSCIMCredential(ctx context.Context, credential credbound.SCIMCredential, commit credbound.Commit) error

SaveSCIMCredential stores an additional bearer credential for a configuration.

func (*Store) SaveTOTPEnrollment ¶

func (s *Store) SaveTOTPEnrollment(ctx context.Context, factor credbound.TOTPFactor, commit credbound.Commit) error

SaveTOTPEnrollment stores a pending TOTP factor, replacing any prior pending enrollment; an already-active factor reports credbound.ErrConflict.

func (*Store) SessionByID ¶

func (s *Store) SessionByID(ctx context.Context, id credbound.UUID) (credbound.Session, error)

SessionByID returns the session with the given ID.

func (*Store) Sessions ¶

func (s *Store) Sessions(ctx context.Context, userID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.Session], error]

Sessions streams the user's sessions, newest first, as one cursor page with digests omitted.

func (*Store) SetAuditFailure ¶

func (s *Store) SetAuditFailure(err error)

SetAuditFailure is intended for fault-injection tests. While set, every mutation fails atomically before changing state.

func (*Store) SetInstanceRole ¶

func (s *Store) SetInstanceRole(ctx context.Context, admin credbound.InstanceAdministrator, commit credbound.Commit) error

SetInstanceRole grants or changes a user's instance role, refusing to demote the last root administrator (credbound.ErrConflict).

func (*Store) SetOAuthClientDisabled ¶

func (s *Store) SetOAuthClientDisabled(ctx context.Context, clientRecordID credbound.UUID, disabled bool, at time.Time, commit credbound.Commit) error

func (*Store) SetOAuthIssuerDisabled ¶

func (s *Store) SetOAuthIssuerDisabled(ctx context.Context, issuerID credbound.UUID, disabled bool, at time.Time, commit credbound.Commit) error

SetOAuthIssuerDisabled enables or disables the issuer.

func (*Store) SetOAuthProtectedResourceDisabled ¶

func (s *Store) SetOAuthProtectedResourceDisabled(ctx context.Context, resourceID credbound.UUID, disabled bool, at time.Time, commit credbound.Commit) error

SetOAuthProtectedResourceDisabled enables or disables the resource.

func (*Store) SetPrimaryEmail ¶

func (s *Store) SetPrimaryEmail(ctx context.Context, userID, emailID credbound.UUID, commit credbound.Commit) error

SetPrimaryEmail promotes a verified address to primary and demotes the previous one; an unverified target reports credbound.ErrConflict.

func (*Store) SetUserDisabled ¶

func (s *Store) SetUserDisabled(ctx context.Context, userID credbound.UUID, disabled bool, at time.Time, commit credbound.Commit) error

SetUserDisabled enables or disables a user; disabling refuses to orphan the last enabled root administrator or a workspace's last active admin (credbound.ErrConflict) and revokes the user's tokens and sessions.

func (*Store) SetWorkspaceDisabled ¶

func (s *Store) SetWorkspaceDisabled(ctx context.Context, workspaceID credbound.UUID, disabled bool, at time.Time, commit credbound.Commit) error

SetWorkspaceDisabled enables or disables the workspace; disabling revokes the members' workspace-scoped tokens.

func (*Store) TOTPByUserID ¶

func (s *Store) TOTPByUserID(ctx context.Context, userID credbound.UUID) (credbound.TOTPFactor, error)

TOTPByUserID returns the user's TOTP factor.

func (*Store) TouchPAT ¶

func (s *Store) TouchPAT(ctx context.Context, id credbound.UUID, usedAt time.Time, commit credbound.Commit) error

TouchPAT records a token use, updating the token's and user's last-seen times.

func (*Store) TouchPasskey ¶

func (s *Store) TouchPasskey(ctx context.Context, userID credbound.UUID, credentialID, credentialJSON []byte, usedAt time.Time, commit credbound.Commit) error

TouchPasskey persists the credential's updated JSON (sign counter) and last-used time after a successful assertion.

func (*Store) TouchSCIMCredential ¶

func (s *Store) TouchSCIMCredential(ctx context.Context, id credbound.UUID, usedAt time.Time, commit credbound.Commit) error

TouchSCIMCredential records a successful use of the credential.

func (*Store) TouchSSO ¶

func (s *Store) TouchSSO(ctx context.Context, userID, identityID credbound.UUID, usedAt time.Time, commit credbound.Commit) error

TouchSSO updates the identity's last-used time and the user's last-seen time after a successful SSO login.

func (*Store) TouchSession ¶

func (s *Store) TouchSession(ctx context.Context, id credbound.UUID, at time.Time, commit credbound.Commit) error

TouchSession updates the session's and user's last-seen times. A session already revoked reports credbound.ErrConflict, so an authentication racing a revocation can neither record activity on nor extend the idle window of a dead session.

func (*Store) UnlinkSSO ¶

func (s *Store) UnlinkSSO(ctx context.Context, userID, identityID credbound.UUID, commit credbound.Commit) error

UnlinkSSO removes the user's SSO identity link.

func (*Store) UpdateOAuthIssuer ¶

func (s *Store) UpdateOAuthIssuer(ctx context.Context, issuer credbound.OAuthIssuer, commit credbound.Commit) error

UpdateOAuthIssuer persists the issuer's mutable attributes.

func (*Store) UpdateSCIMConfiguration ¶

func (s *Store) UpdateSCIMConfiguration(ctx context.Context, configuration credbound.SCIMConfiguration, memberships []credbound.Membership, commit credbound.Commit) error

UpdateSCIMConfiguration persists the configuration's settings and applies the recomputed memberships in the same commit.

func (*Store) UpdateSCIMUser ¶

func (s *Store) UpdateSCIMUser(ctx context.Context, link credbound.SCIMUser, membership credbound.Membership, revokeWorkspacePATs bool, commit credbound.Commit) error

UpdateSCIMUser persists the directory record and membership change, optionally revoking the user's workspace PATs on deactivation.

func (*Store) UpdateUser ¶

func (s *Store) UpdateUser(ctx context.Context, user credbound.User, commit credbound.Commit) error

UpdateUser persists the user's mutable profile fields. The identity, lifecycle and last-seen fields are copied from the stored record so the caller cannot accidentally rewrite them through a profile update.

func (*Store) UpdateWorkspace ¶

func (s *Store) UpdateWorkspace(ctx context.Context, workspace credbound.Workspace, commit credbound.Commit) error

UpdateWorkspace persists the workspace's mutable attributes.

func (*Store) UpdateWorkspaceDomainPolicy ¶

func (s *Store) UpdateWorkspaceDomainPolicy(ctx context.Context, id credbound.UUID, policy credbound.WorkspaceDomainPolicyInput, at time.Time, commit credbound.Commit) error

UpdateWorkspaceDomainPolicy replaces the auto-join and SSO-enforcement policy of a confirmed domain; an unconfirmed domain reports credbound.ErrConflict.

func (*Store) UpsertMembership ¶

func (s *Store) UpsertMembership(ctx context.Context, membership credbound.Membership, commit credbound.Commit) error

UpsertMembership inserts or updates a membership, refusing a change that would leave the workspace without an active admin (credbound.ErrConflict); deactivation revokes the member's workspace-scoped tokens.

func (*Store) UpsertOAuthCIMDClient ¶

func (s *Store) UpsertOAuthCIMDClient(ctx context.Context, client credbound.OAuthClient, commit credbound.Commit) error

UpsertOAuthCIMDClient inserts or refreshes a client registered through a Client Identifier Metadata Document.

func (*Store) UpsertSCIMGroup ¶

func (s *Store) UpsertSCIMGroup(ctx context.Context, group credbound.SCIMGroup, memberships []credbound.Membership, commit credbound.Commit) error

UpsertSCIMGroup inserts or replaces a directory group and applies the recomputed memberships in the same commit.

func (*Store) UseTOTP ¶

func (s *Store) UseTOTP(ctx context.Context, userID credbound.UUID, step int64, commit credbound.Commit) (bool, error)

UseTOTP records a successful code for the given time step, reporting false without error when the step was already consumed (replay).

func (*Store) UserByEmail ¶

func (s *Store) UserByEmail(ctx context.Context, email string) (credbound.User, error)

UserByEmail resolves a user by verified email address.

func (*Store) UserByID ¶

func (s *Store) UserByID(ctx context.Context, id credbound.UUID) (credbound.User, error)

UserByID returns the user with the given ID.

func (*Store) UserWorkspaces ¶

func (s *Store) UserWorkspaces(ctx context.Context, userID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.Workspace], error]

UserWorkspaces streams the workspaces the user belongs to, newest first, as one cursor page.

func (*Store) Users ¶

func (s *Store) Users(ctx context.Context, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.User], error]

Users streams all users, newest first, as one cursor page.

func (*Store) VerifyEmail ¶

func (s *Store) VerifyEmail(ctx context.Context, emailID credbound.UUID, verifiedAt time.Time, commit credbound.Commit) error

VerifyEmail marks the address verified, makes it usable for sign-in and discards the verification credential; an already-verified address reports credbound.ErrConflict.

func (*Store) WorkspaceByID ¶

func (s *Store) WorkspaceByID(ctx context.Context, workspaceID credbound.UUID) (credbound.Workspace, error)

WorkspaceByID returns the workspace with the given ID.

func (*Store) WorkspaceDomainByID ¶

func (s *Store) WorkspaceDomainByID(ctx context.Context, id credbound.UUID) (credbound.WorkspaceDomain, error)

WorkspaceDomainByID returns the domain record with the given ID.

func (*Store) WorkspaceDomains ¶

func (s *Store) WorkspaceDomains(ctx context.Context, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.WorkspaceDomain], error]

WorkspaceDomains streams the workspace's domains, newest first, as one cursor page.

func (*Store) WorkspaceInvitationByID ¶

func (s *Store) WorkspaceInvitationByID(ctx context.Context, invitationID credbound.UUID) (credbound.WorkspaceInvitation, error)

WorkspaceInvitationByID returns the invitation with the given ID.

func (*Store) WorkspaceInvitations ¶

func (s *Store) WorkspaceInvitations(ctx context.Context, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.WorkspaceInvitation], error]

WorkspaceInvitations streams the workspace's invitations, newest first, as one cursor page.

func (*Store) WorkspacePATs ¶ added in v0.0.4

func (s *Store) WorkspacePATs(ctx context.Context, workspaceID credbound.UUID, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.PAT], error]

WorkspacePATs streams the tokens bound to one workspace, newest first.

func (*Store) Workspaces ¶

func (s *Store) Workspaces(ctx context.Context, page credbound.PageRequest) iter.Seq2[credbound.PageEvent[credbound.Workspace], error]

Workspaces streams all workspaces, newest first, as one cursor page.

func (*Tx) Active ¶

func (t *Tx) Active() bool

Active reports whether the hook callback owning this handle is still running; it is false once the commit has completed.

func (*Tx) Audit ¶

func (t *Tx) Audit() credbound.AuditEvent

Audit returns the audit event being committed with this transaction.

func (*Tx) Kind ¶

func (t *Tx) Kind() credbound.StoreKind

Kind reports credbound.StoreMemory.