sqlitestore

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 19, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Overview

Package sqlitestore implements auth's user-plane and operator-plane store ports on SQLite: the same ports pgstore implements, for a CLI, a single-host service or a test suite that has no Postgres to run against.

It uses modernc.org/sqlite, a pure-Go driver, so a binary embedding this package still cross-compiles with nothing but GOOS and GOARCH.

Its tables carry an auth_ prefix, since SQLite has no schemas, and migrate with their own goose version table, so an app keeping its own tables in the same file runs Migrate beside its own migrations and neither sees the other's history.

Where it differs from pgstore

The ports behave the same; storetest holds both to that. What differs is what SQLite is:

  • One writer at a time. Every transaction begins IMMEDIATE, taking the write lock up front, and a writer that cannot get it waits up to the busy timeout and then fails. Under sustained concurrent writes that surfaces as an error where Postgres would have queued the work.
  • Ids are TEXT. Each id is parsed as a uuid and stored in its canonical lower-case form, which is what makes an upper-case id find its row as it would against a uuid column.
  • Instants are TEXT in a fixed-width UTC layout, read back in UTC.
  • Lists (scopes, transports, recovery-code hashes) are JSON arrays.

Index

Constants

View Source 
const VersionTable = "auth_goose_db_version"

VersionTable is goose's bookkeeping for the auth tables, kept apart from the app's own goose_db_version.

Variables

This section is empty.

Functions

func DSN 

func DSN(path string) string

DSN returns the modernc.org/sqlite data source name Store expects for the database file at path. A host that opens its own *sql.DB and hands it to New must open it with these settings:

  • foreign_keys(1): SQLite ignores REFERENCES unless every connection asks it not to, and the cascades are part of the schema.
  • busy_timeout(5000): a writer waits for the lock rather than failing at once.
  • _txlock=immediate: a transaction takes the write lock when it begins, not at its first write, where SQLite would fail it without waiting.

func Migrate 

func Migrate(ctx context.Context, db *sql.DB) error

Migrate brings the auth tables to the current version.

Types

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store implements every port pgstore does, and store.TxRunner, over one database.

func New 

func New(db *sql.DB) *Store

New returns a Store over db, which must have been opened with DSN's settings and migrated. Open does both.

func Open 

func Open(ctx context.Context, path string) (*Store, error)

Open opens (creating if needed) the SQLite database at path, configures it as Store requires and migrates it. It is the whole setup for a CLI or a small service; Close the Store when done.

path is a file. An in-memory database is refused: database/sql opens a fresh one per connection, so writes would land in databases nobody reads. A test wants a file under t.TempDir(), or memstore.

func (*Store) ClearFailedLoginAttempts 

func (s *Store) ClearFailedLoginAttempts(ctx context.Context, email string) error

func (*Store) Close 

func (s *Store) Close() error

Close closes the database if Open opened it, and does nothing if the host handed it to New.

func (*Store) ConsumeWebAuthnChallenge 

func (s *Store) ConsumeWebAuthnChallenge(ctx context.Context, tokenHash string) (*store.WebAuthnChallenge, error)

ConsumeWebAuthnChallenge lets the DELETE decide, so two redemptions of one challenge cannot both get the row.

func (*Store) CountRecentFailedLoginAttempts 

func (s *Store) CountRecentFailedLoginAttempts(ctx context.Context, email string, since time.Time) (int, error)

func (*Store) CountSuperusers 

func (s *Store) CountSuperusers(ctx context.Context) (int, error)

func (*Store) CreateAccount 

func (s *Store) CreateAccount(ctx context.Context, a *store.Account) error

func (*Store) CreateEmailLoginToken 

func (s *Store) CreateEmailLoginToken(ctx context.Context, t *store.EmailLoginToken) error

func (*Store) CreateEmailVerificationToken 

func (s *Store) CreateEmailVerificationToken(ctx context.Context, t *store.EmailVerificationToken) error

func (*Store) CreatePasswordResetToken 

func (s *Store) CreatePasswordResetToken(ctx context.Context, t *store.PasswordResetToken) error

func (*Store) CreatePendingTwoFactorSession 

func (s *Store) CreatePendingTwoFactorSession(ctx context.Context, p *store.PendingTwoFactorSession) error

func (*Store) CreateRefreshToken 

func (s *Store) CreateRefreshToken(ctx context.Context, t *store.RefreshToken) error

func (*Store) CreateSuperuser 

func (s *Store) CreateSuperuser(ctx context.Context, su *store.Superuser) error

func (*Store) CreateSuperuserPendingTwoFactorSession 

func (s *Store) CreateSuperuserPendingTwoFactorSession(ctx context.Context, p *store.PendingTwoFactorSession) error

func (*Store) CreateSuperuserRefreshToken 

func (s *Store) CreateSuperuserRefreshToken(ctx context.Context, t *store.SuperuserRefreshToken) error

func (*Store) CreateSuperuserTOTPSettings 

func (s *Store) CreateSuperuserTOTPSettings(ctx context.Context, t *store.TOTPSettings) error

func (*Store) CreateTOTPSettings 

func (s *Store) CreateTOTPSettings(ctx context.Context, t *store.TOTPSettings) error

func (*Store) CreateUser 

func (s *Store) CreateUser(ctx context.Context, u *store.User) error

func (*Store) CreateWebAuthnChallenge 

func (s *Store) CreateWebAuthnChallenge(ctx context.Context, c *store.WebAuthnChallenge) error

func (*Store) CreateWebAuthnCredential 

func (s *Store) CreateWebAuthnCredential(ctx context.Context, c *store.WebAuthnCredential) error

func (*Store) DB 

func (s *Store) DB() *sql.DB

DB exposes the handle, for an app keeping its own tables in the same file.

func (*Store) DeleteAccount 

func (s *Store) DeleteAccount(ctx context.Context, id string) error

func (*Store) DeleteEmailLoginTokens 

func (s *Store) DeleteEmailLoginTokens(ctx context.Context, email string, kind store.EmailLoginKind) error

func (*Store) DeletePendingTwoFactorSession 

func (s *Store) DeletePendingTwoFactorSession(ctx context.Context, id string) error

func (*Store) DeleteSuperuserPendingTwoFactorSession 

func (s *Store) DeleteSuperuserPendingTwoFactorSession(ctx context.Context, id string) error

func (*Store) DeleteSuperuserTOTPSettings 

func (s *Store) DeleteSuperuserTOTPSettings(ctx context.Context, superuserID string) error

func (*Store) DeleteTOTPSettings 

func (s *Store) DeleteTOTPSettings(ctx context.Context, userID string) error

func (*Store) DeleteUserEmailVerificationTokens 

func (s *Store) DeleteUserEmailVerificationTokens(ctx context.Context, userID string) error

func (*Store) DeleteUserPasswordResetTokens 

func (s *Store) DeleteUserPasswordResetTokens(ctx context.Context, userID string) error

func (*Store) DeleteWebAuthnCredential 

func (s *Store) DeleteWebAuthnCredential(ctx context.Context, id string) error

func (*Store) GetAccount 

func (s *Store) GetAccount(ctx context.Context, id string) (*store.Account, error)

func (*Store) GetAccountByProvider 

func (s *Store) GetAccountByProvider(ctx context.Context, provider, providerAccountID string) (*store.Account, error)

func (*Store) GetEmailLoginTokenByEmail 

func (s *Store) GetEmailLoginTokenByEmail(ctx context.Context, email string, kind store.EmailLoginKind) (*store.EmailLoginToken, error)

func (*Store) GetEmailLoginTokenByHash 

func (s *Store) GetEmailLoginTokenByHash(ctx context.Context, hash string) (*store.EmailLoginToken, error)

func (*Store) GetEmailVerificationTokenByHash 

func (s *Store) GetEmailVerificationTokenByHash(ctx context.Context, hash string) (*store.EmailVerificationToken, error)

func (*Store) GetPasswordResetTokenByHash 

func (s *Store) GetPasswordResetTokenByHash(ctx context.Context, hash string) (*store.PasswordResetToken, error)

func (*Store) GetPendingTwoFactorSessionByHash 

func (s *Store) GetPendingTwoFactorSessionByHash(ctx context.Context, hash string) (*store.PendingTwoFactorSession, error)

func (*Store) GetRefreshTokenByHash 

func (s *Store) GetRefreshTokenByHash(ctx context.Context, hash string) (*store.RefreshToken, error)

func (*Store) GetSuperuserByEmail 

func (s *Store) GetSuperuserByEmail(ctx context.Context, email string) (*store.Superuser, error)

func (*Store) GetSuperuserByID 

func (s *Store) GetSuperuserByID(ctx context.Context, id string) (*store.Superuser, error)

func (*Store) GetSuperuserPendingTwoFactorSessionByHash 

func (s *Store) GetSuperuserPendingTwoFactorSessionByHash(ctx context.Context, hash string) (*store.PendingTwoFactorSession, error)

func (*Store) GetSuperuserRefreshTokenByHash 

func (s *Store) GetSuperuserRefreshTokenByHash(ctx context.Context, hash string) (*store.SuperuserRefreshToken, error)

func (*Store) GetSuperuserTOTPSettings 

func (s *Store) GetSuperuserTOTPSettings(ctx context.Context, superuserID string) (*store.TOTPSettings, error)

func (*Store) GetTOTPSettingsByUserID 

func (s *Store) GetTOTPSettingsByUserID(ctx context.Context, userID string) (*store.TOTPSettings, error)

func (*Store) GetUserByEmail 

func (s *Store) GetUserByEmail(ctx context.Context, email string) (*store.User, error)

func (*Store) GetUserByID 

func (s *Store) GetUserByID(ctx context.Context, id string) (*store.User, error)

func (*Store) GetWebAuthnCredential 

func (s *Store) GetWebAuthnCredential(ctx context.Context, id string) (*store.WebAuthnCredential, error)

func (*Store) GetWebAuthnCredentialByCredentialID 

func (s *Store) GetWebAuthnCredentialByCredentialID(ctx context.Context, credentialID []byte) (*store.WebAuthnCredential, error)

func (*Store) IncrementEmailLoginTokenAttempts 

func (s *Store) IncrementEmailLoginTokenAttempts(ctx context.Context, id string) (int, error)

IncrementEmailLoginTokenAttempts lets the database compute the count, so parallel guesses each cost one.

func (*Store) IsAccountLocked 

func (s *Store) IsAccountLocked(ctx context.Context, userID string) (bool, error)

func (*Store) ListAccountsByUser 

func (s *Store) ListAccountsByUser(ctx context.Context, userID string) ([]*store.Account, error)

func (*Store) ListActiveRefreshTokens 

func (s *Store) ListActiveRefreshTokens(ctx context.Context, userID string) ([]*store.RefreshToken, error)

func (*Store) ListActiveSuperuserRefreshTokens 

func (s *Store) ListActiveSuperuserRefreshTokens(ctx context.Context, superuserID string) ([]*store.SuperuserRefreshToken, error)

func (*Store) ListSuperusers 

func (s *Store) ListSuperusers(ctx context.Context) ([]*store.Superuser, error)

func (*Store) ListWebAuthnCredentialsByUser 

func (s *Store) ListWebAuthnCredentialsByUser(ctx context.Context, userID string) ([]*store.WebAuthnCredential, error)

func (*Store) LockAccount 

func (s *Store) LockAccount(ctx context.Context, userID string) error

func (*Store) MarkEmailLoginTokenUsed 

func (s *Store) MarkEmailLoginTokenUsed(ctx context.Context, id string, usedAt time.Time) error

MarkEmailLoginTokenUsed is a compare-and-set: no row means another redemption won.

func (*Store) MarkEmailVerificationTokenUsed 

func (s *Store) MarkEmailVerificationTokenUsed(ctx context.Context, id string) error

func (*Store) MarkPasswordResetTokenUsed 

func (s *Store) MarkPasswordResetTokenUsed(ctx context.Context, id string) error

func (*Store) RecordFailedLoginAttempt 

func (s *Store) RecordFailedLoginAttempt(ctx context.Context, a *store.FailedLoginAttempt) error

func (*Store) RevokeAllSuperuserRefreshTokens 

func (s *Store) RevokeAllSuperuserRefreshTokens(ctx context.Context, superuserID string) error

func (*Store) RevokeAllUserRefreshTokens 

func (s *Store) RevokeAllUserRefreshTokens(ctx context.Context, userID string) error

func (*Store) RevokeRefreshToken 

func (s *Store) RevokeRefreshToken(ctx context.Context, id string) error

func (*Store) RevokeSuperuserRefreshToken 

func (s *Store) RevokeSuperuserRefreshToken(ctx context.Context, id string) error

func (*Store) RunInTx 

func (s *Store) RunInTx(ctx context.Context, fn func(ctx context.Context) error) (err error)

RunInTx runs fn in one transaction. store.TxRunner requires every store call made with fn's context to join it, so q reads the transaction back out of the context; a call inside an open transaction joins that one.

func (*Store) TouchRefreshToken 

func (s *Store) TouchRefreshToken(ctx context.Context, id string, expiresAt time.Time) error

TouchRefreshToken does not extend a revoked session back to life.

func (*Store) UnlockAccount 

func (s *Store) UnlockAccount(ctx context.Context, userID string) error

func (*Store) UpdateAccount 

func (s *Store) UpdateAccount(ctx context.Context, a *store.Account) error

func (*Store) UpdateSuperuser 

func (s *Store) UpdateSuperuser(ctx context.Context, su *store.Superuser) error

func (*Store) UpdateSuperuserTOTPSettings 

func (s *Store) UpdateSuperuserTOTPSettings(ctx context.Context, t *store.TOTPSettings) error

func (*Store) UpdateTOTPSettings 

func (s *Store) UpdateTOTPSettings(ctx context.Context, t *store.TOTPSettings) error

func (*Store) UpdateUser 

func (s *Store) UpdateUser(ctx context.Context, u *store.User) error

func (*Store) UpdateWebAuthnCredential 

func (s *Store) UpdateWebAuthnCredential(ctx context.Context, c *store.WebAuthnCredential) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.