mongo

func (*Store) AddUserEmail ¶

func (s *Store) AddUserEmail(ctx context.Context, e *user.UserEmail) error

func (*Store) BatchResolve ¶

func (s *Store) BatchResolve(ctx context.Context, keys []string, opts settings.ResolveOpts) (map[string][]*settings.Setting, error)

func (*Store) Close ¶

func (s *Store) Close() error

Close closes the database connection.

func (*Store) ConsumePasswordReset ¶

func (s *Store) ConsumePasswordReset(ctx context.Context, token string) error

ConsumePasswordReset marks a password reset token as consumed.

func (*Store) ConsumeVerification ¶

func (s *Store) ConsumeVerification(ctx context.Context, token string) error

ConsumeVerification marks a verification token as consumed.

func (*Store) CreateAPIKey ¶

func (s *Store) CreateAPIKey(ctx context.Context, k *apikey.APIKey) error

CreateAPIKey persists a new API key.

func (*Store) CreateApp ¶

func (s *Store) CreateApp(ctx context.Context, a *app.App) error

CreateApp persists a new app.

func (*Store) CreateDelegation ¶

func (s *Store) CreateDelegation(ctx context.Context, d *principal.Delegation) error

CreateDelegation stores a new grant, refusing one that would duplicate a grant already live for the same (app, actor, subject, kind).

The liveness check runs here rather than in the index. Live means principal.Delegation.IsActive: not revoked AND not past its expiry, and a partialFilterExpression has no way to name the current time, so the unique index (see delegation_live_index_excludes_expired) now covers only grants that never expire and this covers the rest.

Read-then-write, not atomic, so two concurrent creates for the same tuple can both land. That trade is deliberate: filtering on revoked_at alone meant an impersonation grant that merely lapsed blocked every later impersonation of that user by that admin forever, because nothing but StopImpersonation ever writes revoked_at.

func (*Store) CreateDevice ¶

func (s *Store) CreateDevice(ctx context.Context, d *device.Device) error

CreateDevice persists a new device.

func (*Store) CreateEnvironment ¶

func (s *Store) CreateEnvironment(ctx context.Context, e *environment.Environment) error

CreateEnvironment persists a new environment.

func (*Store) CreateFormConfig ¶

func (s *Store) CreateFormConfig(ctx context.Context, fc *formconfig.FormConfig) error

func (*Store) CreateInvitation ¶

func (s *Store) CreateInvitation(ctx context.Context, inv *organization.Invitation) error

CreateInvitation persists a new invitation.

func (*Store) CreateMember ¶

func (s *Store) CreateMember(ctx context.Context, mem *organization.Member) error

CreateMember persists a new organization member.

func (*Store) CreateNotification ¶

func (s *Store) CreateNotification(ctx context.Context, n *notification.Notification) error

CreateNotification persists a new notification.

func (*Store) CreateOrganization ¶

func (s *Store) CreateOrganization(ctx context.Context, o *organization.Organization) error

CreateOrganization persists a new organization.

func (*Store) CreatePasswordReset ¶

func (s *Store) CreatePasswordReset(ctx context.Context, pr *account.PasswordReset) error

CreatePasswordReset persists a new password reset token.

func (*Store) CreateServiceAccount ¶

func (s *Store) CreateServiceAccount(ctx context.Context, svc *serviceaccount.ServiceAccount) error

CreateServiceAccount persists a new service account.

func (*Store) CreateSession ¶

func (s *Store) CreateSession(ctx context.Context, sess *session.Session) error

CreateSession persists a new session.

func (*Store) CreateTeam ¶

func (s *Store) CreateTeam(ctx context.Context, t *organization.Team) error

CreateTeam persists a new team.

func (*Store) CreateUser ¶

func (s *Store) CreateUser(ctx context.Context, u *user.User) error

CreateUser persists a new user.

func (*Store) CreateUserWithPrimaryEmail ¶

func (s *Store) CreateUserWithPrimaryEmail(ctx context.Context, u *user.User, primary *user.UserEmail) error

func (*Store) CreateVerification ¶

func (s *Store) CreateVerification(ctx context.Context, v *account.Verification) error

CreateVerification persists a new verification token.

func (*Store) CreateWebhook ¶

func (s *Store) CreateWebhook(ctx context.Context, w *webhook.Webhook) error

CreateWebhook persists a new webhook.

func (*Store) DB ¶

func (s *Store) DB() *grove.DB

DB returns the underlying grove database for direct access.

func (*Store) DeleteAPIKey ¶

func (s *Store) DeleteAPIKey(ctx context.Context, keyID id.APIKeyID) error

func (*Store) DeleteApp ¶

func (s *Store) DeleteApp(ctx context.Context, appID id.AppID) error

DeleteApp removes an app. DeleteApp removes an app and cascades to every app-scoped collection, so a deleted app leaves no orphaned users, sessions, org memberships, API keys, etc. behind (which the SQL backends achieve via ON DELETE CASCADE / explicit deletes). Runs inside a MongoTx for atomicity — this requires the deployment to run against a replica set or sharded cluster.

func (*Store) DeleteAppClientConfig ¶

func (s *Store) DeleteAppClientConfig(ctx context.Context, appID id.AppID) error

DeleteAppClientConfig removes the per-app client config override.

func (*Store) DeleteAppSessionConfig ¶

func (s *Store) DeleteAppSessionConfig(ctx context.Context, appID id.AppID) error

DeleteAppSessionConfig removes the per-app session config override.

func (*Store) DeleteBranding ¶

func (s *Store) DeleteBranding(ctx context.Context, orgID id.OrgID) error

func (*Store) DeleteDevice ¶

func (s *Store) DeleteDevice(ctx context.Context, deviceID id.DeviceID) error

DeleteDevice removes a device.

func (*Store) DeleteEnvironment ¶

func (s *Store) DeleteEnvironment(ctx context.Context, envID id.EnvironmentID) error

DeleteEnvironment removes an environment by ID. Returns an error if the environment is the default for its app.

func (*Store) DeleteExpiredPasswordResets ¶

func (s *Store) DeleteExpiredPasswordResets(ctx context.Context, before time.Time, batch int) (int64, error)

DeleteExpiredPasswordResets implements store.Retention.

func (*Store) DeleteExpiredRevokedRefreshTokens ¶

func (s *Store) DeleteExpiredRevokedRefreshTokens(ctx context.Context, before time.Time, batch int) (int64, error)

DeleteExpiredRevokedRefreshTokens implements store.Retention.

func (*Store) DeleteExpiredSessions ¶

func (s *Store) DeleteExpiredSessions(ctx context.Context, before time.Time, batch int) (int64, error)

DeleteExpiredSessions implements store.Retention.

func (*Store) DeleteExpiredVerifications ¶

func (s *Store) DeleteExpiredVerifications(ctx context.Context, before time.Time, batch int) (int64, error)

DeleteExpiredVerifications implements store.Retention.

func (*Store) DeleteFormConfig ¶

func (s *Store) DeleteFormConfig(ctx context.Context, appID id.AppID, formType string) error

func (*Store) DeleteInvitation ¶

func (s *Store) DeleteInvitation(ctx context.Context, invID id.InvitationID) error

DeleteInvitation removes an invitation by ID.

func (*Store) DeleteMember ¶

func (s *Store) DeleteMember(ctx context.Context, memberID id.MemberID) error

DeleteMember removes a member.

func (*Store) DeleteOrganization ¶

func (s *Store) DeleteOrganization(ctx context.Context, orgID id.OrgID) error

DeleteOrganization removes an organization.

func (*Store) DeleteOrganizationCascade ¶

func (s *Store) DeleteOrganizationCascade(ctx context.Context, orgID id.OrgID) error

DeleteOrganizationCascade deletes the organization and all of its dependent rows (members, teams, invitations) inside a single MongoTx session. On any error the entire transaction is aborted; the orgs row is the last delete so a failure mid-cascade leaves the org row visible (callers can retry).

MongoDB transactions require a replica set (or sharded cluster). On a standalone mongod the StartTransaction call returns ErrUnsupportedDeployment — callers running against standalone instances should treat that as a configuration issue rather than a code defect.

func (*Store) DeleteServiceAccount ¶

func (s *Store) DeleteServiceAccount(ctx context.Context, svcID id.ServiceAccountID) error

DeleteServiceAccount removes a service account.

func (*Store) DeleteSession ¶

func (s *Store) DeleteSession(ctx context.Context, sessionID id.SessionID) error

DeleteSession removes a session by ID.

func (*Store) DeleteSessionsByGrant ¶

func (s *Store) DeleteSessionsByGrant(ctx context.Context, grantID id.AgentGrantID) error

DeleteSessionsByGrant removes every session issued under grantID. Revoking an agent's delegation must also kill the session it minted, or the session keeps authenticating as the delegating human until it separately expires.

func (*Store) DeleteSetting ¶

func (s *Store) DeleteSetting(ctx context.Context, key string, scope settings.Scope, scopeID string) error

func (*Store) DeleteSettingsByNamespace ¶

func (s *Store) DeleteSettingsByNamespace(ctx context.Context, namespace string) error

func (*Store) DeleteTeam ¶

func (s *Store) DeleteTeam(ctx context.Context, teamID id.TeamID) error

DeleteTeam removes a team.

func (*Store) DeleteUser ¶

func (s *Store) DeleteUser(ctx context.Context, userID id.UserID) error

DeleteUser soft-deletes a user by setting the deleted_at timestamp.

func (*Store) DeleteUserEmail ¶

func (s *Store) DeleteUserEmail(ctx context.Context, userID id.UserID, email string) error

func (*Store) DeleteUserSessions ¶

func (s *Store) DeleteUserSessions(ctx context.Context, userID id.UserID) error

DeleteUserSessions removes all sessions for a user.

func (*Store) DeleteWebhook ¶

func (s *Store) DeleteWebhook(ctx context.Context, webhookID id.WebhookID) error

DeleteWebhook removes a webhook.

func (*Store) EnsureTTLIndexes ¶

func (s *Store) EnsureTTLIndexes(ctx context.Context, ttl map[string]time.Duration) error

EnsureTTLIndexes implements store.TTLIndexer. MongoDB's TTL monitor then removes rows as they pass their window, and the engine's sweeper only has to catch what the monitor has not reached yet.

func (*Store) FindActiveDelegation ¶

func (s *Store) FindActiveDelegation(
	ctx context.Context, appID id.AppID, actor, subject principal.Ref, grantKind principal.GrantKind,
) (*principal.Delegation, error)

FindActiveDelegation resolves the live grant letting actor act for subject.

Liveness is evaluated in the query rather than by loading and filtering in Go: this runs on the authentication path for every delegated request, and the partial unique index means at most one document can match.

func (*Store) FindByPrefix ¶

func (s *Store) FindByPrefix(ctx context.Context, prefix string) (*apikey.APIKey, error)

FindByPrefix returns an API key by prefix alone, ignoring app scoping. Used by the introspection endpoint where the caller doesn't know the appID.

func (*Store) GetAPIKey ¶

func (s *Store) GetAPIKey(ctx context.Context, keyID id.APIKeyID) (*apikey.APIKey, error)

GetAPIKey returns an API key by ID.

func (*Store) GetAPIKeyByPrefix ¶

func (s *Store) GetAPIKeyByPrefix(ctx context.Context, appID id.AppID, prefix string) (*apikey.APIKey, error)

GetAPIKeyByPrefix returns an API key by app ID and key prefix.

func (*Store) GetAPIKeyByPublicKey ¶

func (s *Store) GetAPIKeyByPublicKey(ctx context.Context, appID id.AppID, publicKey string) (*apikey.APIKey, error)

GetAPIKeyByPublicKey returns an API key by app ID and public key.

func (*Store) GetActiveEmailVerification ¶

func (s *Store) GetActiveEmailVerification(ctx context.Context, userID id.UserID) (*account.Verification, error)

GetActiveEmailVerification returns the most recent unconsumed, unexpired email verification for a user (OTP lookup by user, not token).

func (*Store) GetApp ¶

func (s *Store) GetApp(ctx context.Context, appID id.AppID) (*app.App, error)

GetApp returns an app by ID.

func (*Store) GetAppByPublishableKey ¶

func (s *Store) GetAppByPublishableKey(ctx context.Context, key string) (*app.App, error)

GetAppByPublishableKey returns an app by its publishable key.

func (*Store) GetAppBySlug ¶

func (s *Store) GetAppBySlug(ctx context.Context, slug string) (*app.App, error)

GetAppBySlug returns an app by its slug.

func (*Store) GetAppClientConfig ¶

func (s *Store) GetAppClientConfig(ctx context.Context, appID id.AppID) (*appclientconfig.Config, error)

GetAppClientConfig returns the client config override for the given app.

func (*Store) GetAppSessionConfig ¶

func (s *Store) GetAppSessionConfig(ctx context.Context, appID id.AppID) (*appsessionconfig.Config, error)

GetAppSessionConfig returns the session config override for the given app.

func (*Store) GetBranding ¶

func (s *Store) GetBranding(ctx context.Context, orgID id.OrgID) (*formconfig.BrandingConfig, error)

func (*Store) GetDefaultEnvironment ¶

func (s *Store) GetDefaultEnvironment(ctx context.Context, appID id.AppID) (*environment.Environment, error)

GetDefaultEnvironment returns the default environment for an app.

func (*Store) GetDelegation ¶

func (s *Store) GetDelegation(ctx context.Context, delID id.DelegationID) (*principal.Delegation, error)

func (*Store) GetDevice ¶

func (s *Store) GetDevice(ctx context.Context, deviceID id.DeviceID) (*device.Device, error)

GetDevice returns a device by ID.

func (*Store) GetDeviceByFingerprint ¶

func (s *Store) GetDeviceByFingerprint(ctx context.Context, userID id.UserID, fingerprint string) (*device.Device, error)

GetDeviceByFingerprint returns a device by user ID and fingerprint.

func (*Store) GetEnvironment ¶

func (s *Store) GetEnvironment(ctx context.Context, envID id.EnvironmentID) (*environment.Environment, error)

GetEnvironment returns an environment by ID.

func (*Store) GetEnvironmentBySlug ¶

func (s *Store) GetEnvironmentBySlug(ctx context.Context, appID id.AppID, slug string) (*environment.Environment, error)

GetEnvironmentBySlug returns an environment by app ID and slug.

func (*Store) GetFormConfig ¶

func (s *Store) GetFormConfig(ctx context.Context, appID id.AppID, formType string) (*formconfig.FormConfig, error)

func (*Store) GetInvitation ¶

func (s *Store) GetInvitation(ctx context.Context, invID id.InvitationID) (*organization.Invitation, error)

GetInvitation returns an invitation by ID.

func (*Store) GetInvitationByToken ¶

func (s *Store) GetInvitationByToken(ctx context.Context, token string) (*organization.Invitation, error)

GetInvitationByToken returns an invitation by its token.

func (*Store) GetMember ¶

func (s *Store) GetMember(ctx context.Context, memberID id.MemberID) (*organization.Member, error)

GetMember returns a member by ID.

func (*Store) GetMemberByUserAndOrg ¶

func (s *Store) GetMemberByUserAndOrg(ctx context.Context, userID id.UserID, orgID id.OrgID) (*organization.Member, error)

GetMemberByUserAndOrg returns a member by user ID and org ID.

func (*Store) GetNotification ¶

func (s *Store) GetNotification(ctx context.Context, notifID id.NotificationID) (*notification.Notification, error)

GetNotification returns a notification by ID.

func (*Store) GetOrganization ¶

func (s *Store) GetOrganization(ctx context.Context, orgID id.OrgID) (*organization.Organization, error)

GetOrganization returns an organization by ID.

func (*Store) GetOrganizationBySlug ¶

func (s *Store) GetOrganizationBySlug(ctx context.Context, appID id.AppID, slug string) (*organization.Organization, error)

GetOrganizationBySlug returns an organization by app ID and slug.

func (*Store) GetPasswordReset ¶

func (s *Store) GetPasswordReset(ctx context.Context, token string) (*account.PasswordReset, error)

GetPasswordReset returns a password reset by token.

func (*Store) GetPlatformApp ¶

func (s *Store) GetPlatformApp(ctx context.Context) (*app.App, error)

GetPlatformApp returns the single platform app (is_platform=true).

func (*Store) GetPrincipal ¶

func (s *Store) GetPrincipal(ctx context.Context, ref principal.Ref) (*principal.Principal, error)

GetPrincipal resolves any principal by ref. A user ref is assembled from the users collection; every other kind comes from the service accounts one, looked up by id alone. The ref's Kind only routes which collection to read, matching how the memory and postgres backends resolve a principal.

func (*Store) GetRevokedRefreshTokenFamily ¶

func (s *Store) GetRevokedRefreshTokenFamily(ctx context.Context, tokenHash string) (id.SessionFamilyID, error)

GetRevokedRefreshTokenFamily returns the family bound to a revoked token, or store.ErrNotFound if the hash is unknown.

func (*Store) GetServiceAccount ¶

func (s *Store) GetServiceAccount(ctx context.Context, svcID id.ServiceAccountID) (*serviceaccount.ServiceAccount, error)

GetServiceAccount returns a service account by ID.

func (*Store) GetSession ¶

func (s *Store) GetSession(ctx context.Context, sessionID id.SessionID) (*session.Session, error)

GetSession returns a session by ID.

func (*Store) GetSessionByRefreshToken ¶

func (s *Store) GetSessionByRefreshToken(ctx context.Context, refreshToken string) (*session.Session, error)

GetSessionByRefreshToken returns a session by its refresh token.

func (*Store) GetSessionByToken ¶

func (s *Store) GetSessionByToken(ctx context.Context, token string) (*session.Session, error)

GetSessionByToken returns a session by its access token.

func (*Store) GetSetting ¶

func (s *Store) GetSetting(ctx context.Context, key string, scope settings.Scope, scopeID string) (*settings.Setting, error)

func (*Store) GetTeam ¶

func (s *Store) GetTeam(ctx context.Context, teamID id.TeamID) (*organization.Team, error)

GetTeam returns a team by ID.

func (*Store) GetUser ¶

func (s *Store) GetUser(ctx context.Context, userID id.UserID) (*user.User, error)

GetUser returns a user by ID, excluding soft-deleted users.

func (*Store) GetUserByAnyEmail ¶

func (s *Store) GetUserByAnyEmail(ctx context.Context, appID id.AppID, envID id.EnvironmentID, email string) (*user.User, error)

func (*Store) GetUserByEmail ¶

func (s *Store) GetUserByEmail(ctx context.Context, appID id.AppID, envID id.EnvironmentID, email string) (*user.User, error)

GetUserByEmail returns a user by app ID, environment and email, excluding soft-deleted users. A nil envID matches app-wide.

func (*Store) GetUserByPhone ¶

func (s *Store) GetUserByPhone(ctx context.Context, appID id.AppID, envID id.EnvironmentID, phone string) (*user.User, error)

GetUserByPhone returns a user by app ID, environment and phone number, excluding soft-deleted users. A nil envID matches app-wide.

func (*Store) GetUserByUsername ¶

func (s *Store) GetUserByUsername(ctx context.Context, appID id.AppID, envID id.EnvironmentID, username string) (*user.User, error)

GetUserByUsername returns a user by app ID, environment and username, excluding soft-deleted users. A nil envID matches app-wide.

func (*Store) GetUserEmailRecord ¶

func (s *Store) GetUserEmailRecord(ctx context.Context, appID id.AppID, envID id.EnvironmentID, email string) (*user.UserEmail, error)

func (*Store) GetUserEmails ¶

func (s *Store) GetUserEmails(ctx context.Context, userID id.UserID) ([]*user.UserEmail, error)

func (*Store) GetVerification ¶

func (s *Store) GetVerification(ctx context.Context, token string) (*account.Verification, error)

GetVerification returns a verification by token.

func (*Store) GetWebhook ¶

func (s *Store) GetWebhook(ctx context.Context, webhookID id.WebhookID) (*webhook.Webhook, error)

GetWebhook returns a webhook by ID.

func (*Store) HashLegacyTokens ¶

func (s *Store) HashLegacyTokens(ctx context.Context, batch int) (int64, error)

HashLegacyTokens implements store.LegacyTokenHasher. Each collection is swept with a bounded find of documents whose hash is absent or empty and whose plaintext is present, then rewritten one by one. A document with neither plaintext nor hash is unusable and left alone.

func (*Store) IsRefreshTokenRevoked ¶

func (s *Store) IsRefreshTokenRevoked(ctx context.Context, tokenHash string) (bool, error)

IsRefreshTokenRevoked reports whether tokenHash has been recorded as revoked.

func (*Store) KVCounter ¶

func (s *Store) KVCounter(ctx context.Context, key string) (int64, error)

KVCounter implements store.KV.

func (*Store) KVDelete ¶

func (s *Store) KVDelete(ctx context.Context, key string) error

KVDelete implements store.KV.

func (*Store) KVDeleteExpired ¶

func (s *Store) KVDeleteExpired(ctx context.Context, now time.Time) (int64, error)

KVDeleteExpired implements store.KV.

func (*Store) KVGet ¶

func (s *Store) KVGet(ctx context.Context, key string) ([]byte, error)

KVGet implements store.KV.

func (*Store) KVIncrement ¶

func (s *Store) KVIncrement(ctx context.Context, key string, ttl time.Duration) (int64, error)

KVIncrement implements store.KV.

func (*Store) KVSet ¶

func (s *Store) KVSet(ctx context.Context, key string, value []byte, ttl time.Duration) error

KVSet implements store.KV.

func (*Store) KVSetNX ¶

func (s *Store) KVSetNX(ctx context.Context, key string, value []byte, ttl time.Duration) (bool, error)

KVSetNX implements store.KV.

func (*Store) ListAPIKeysByApp ¶

func (s *Store) ListAPIKeysByApp(ctx context.Context, appID id.AppID) ([]*apikey.APIKey, error)

ListAPIKeysByApp returns all API keys for an app, ordered by creation date descending.

func (*Store) ListAPIKeysByUser ¶

func (s *Store) ListAPIKeysByUser(ctx context.Context, appID id.AppID, userID id.UserID) ([]*apikey.APIKey, error)

ListAPIKeysByUser returns all API keys for a user within an app, ordered by creation date descending.

func (*Store) ListApps ¶

func (s *Store) ListApps(ctx context.Context) ([]*app.App, error)

ListApps returns all apps, ordered by creation date descending.

func (*Store) ListDelegations ¶

func (s *Store) ListDelegations(ctx context.Context, q *principal.DelegationQuery) ([]*principal.Delegation, error)

func (*Store) ListDevices ¶

func (s *Store) ListDevices(ctx context.Context, limit int) ([]*device.Device, error)

func (*Store) ListEnvironments ¶

func (s *Store) ListEnvironments(ctx context.Context, appID id.AppID) ([]*environment.Environment, error)

ListEnvironments returns all environments for an app, ordered by creation date ascending.

func (*Store) ListFormConfigs ¶

func (s *Store) ListFormConfigs(ctx context.Context, appID id.AppID) ([]*formconfig.FormConfig, error)

func (*Store) ListInvitations ¶

func (s *Store) ListInvitations(ctx context.Context, orgID id.OrgID) ([]*organization.Invitation, error)

ListInvitations returns all invitations for an organization, ordered by creation date descending.

func (*Store) ListInvitationsPage ¶

func (s *Store) ListInvitationsPage(ctx context.Context, orgID id.OrgID, opts page.Opts) (page.Page[*organization.Invitation], error)

func (*Store) ListMembers ¶

func (s *Store) ListMembers(ctx context.Context, orgID id.OrgID) ([]*organization.Member, error)

ListMembers returns all members of an organization, ordered by creation date ascending.

func (*Store) ListMembersPage ¶

func (s *Store) ListMembersPage(ctx context.Context, orgID id.OrgID, opts page.Opts) (page.Page[*organization.Member], error)

func (*Store) ListOrganizations ¶

func (s *Store) ListOrganizations(ctx context.Context, appID id.AppID) ([]*organization.Organization, error)

ListOrganizations returns all organizations for an app, ordered by creation date descending.

func (*Store) ListOrganizationsPage ¶

func (s *Store) ListOrganizationsPage(ctx context.Context, appID id.AppID, opts page.Opts) (page.Page[*organization.Organization], error)

func (*Store) ListPrincipals ¶

func (s *Store) ListPrincipals(ctx context.Context, q *principal.Query) ([]*principal.Principal, error)

ListPrincipals returns principals matching q. Only non-human principals live in the service accounts collection, so this never returns users.

func (*Store) ListServiceAccounts ¶

func (s *Store) ListServiceAccounts(ctx context.Context, q *serviceaccount.Query) (*serviceaccount.List, error)

ListServiceAccounts returns service accounts matching the query.

func (*Store) ListSessions ¶

func (s *Store) ListSessions(ctx context.Context, limit int) ([]*session.Session, error)

func (*Store) ListSettings ¶

func (s *Store) ListSettings(ctx context.Context, opts settings.ListOpts) ([]*settings.Setting, error)

func (*Store) ListTeams ¶

func (s *Store) ListTeams(ctx context.Context, orgID id.OrgID) ([]*organization.Team, error)

ListTeams returns all teams for an organization, ordered by name ascending.

func (*Store) ListTeamsPage ¶

func (s *Store) ListTeamsPage(ctx context.Context, orgID id.OrgID, opts page.Opts) (page.Page[*organization.Team], error)

func (*Store) ListUserDevices ¶

func (s *Store) ListUserDevices(ctx context.Context, userID id.UserID) ([]*device.Device, error)

ListUserDevices returns all devices for a user, ordered by last seen descending.

func (*Store) ListUserNotifications ¶

func (s *Store) ListUserNotifications(ctx context.Context, userID id.UserID) ([]*notification.Notification, error)

ListUserNotifications returns all notifications for a user, ordered by creation date descending.

func (*Store) ListUserOrganizations ¶

func (s *Store) ListUserOrganizations(ctx context.Context, userID id.UserID) ([]*organization.Organization, error)

ListUserOrganizations returns all organizations a user belongs to.

func (*Store) ListUserOrganizationsPage ¶

func (s *Store) ListUserOrganizationsPage(ctx context.Context, userID id.UserID, opts page.Opts) (page.Page[*organization.Organization], error)

func (*Store) ListUserSessions ¶

func (s *Store) ListUserSessions(ctx context.Context, userID id.UserID) ([]*session.Session, error)

ListUserSessions returns all sessions for a user, ordered by creation date descending.

func (*Store) ListUserSessionsPage ¶

func (s *Store) ListUserSessionsPage(ctx context.Context, userID id.UserID, opts page.Opts) (page.Page[*session.Session], error)

func (*Store) ListUsers ¶

func (s *Store) ListUsers(ctx context.Context, q *user.Query) (*user.List, error)

ListUsers returns a paginated list of users for an app, with optional email search.

func (*Store) ListWebhooks ¶

func (s *Store) ListWebhooks(ctx context.Context, appID id.AppID) ([]*webhook.Webhook, error)

ListWebhooks returns all webhooks for an app, ordered by creation date descending.

func (*Store) MarkRefreshTokenReplayed ¶

func (s *Store) MarkRefreshTokenReplayed(ctx context.Context, tokenHash string) (bool, error)

MarkRefreshTokenReplayed flips an already-revoked token's reason to "replay_detected", returning whether this call made the change. The filter excludes tokens already flagged, so a match is a real transition — the engine's once-per-family storm guard.

func (*Store) MarkRefreshTokenRevoked ¶

func (s *Store) MarkRefreshTokenRevoked(ctx context.Context, tokenHash string, familyID id.SessionFamilyID, reason string) error

MarkRefreshTokenRevoked records tokenHash as revoked. Idempotent: a duplicate-key error is swallowed (the original record wins).

func (*Store) MarkSent ¶

func (s *Store) MarkSent(ctx context.Context, notifID id.NotificationID) error

MarkSent marks a notification as sent.

func (*Store) MarkUserEmailVerified ¶

func (s *Store) MarkUserEmailVerified(ctx context.Context, userID id.UserID, email string) error

func (*Store) Migrate ¶

func (s *Store) Migrate(ctx context.Context, extraGroups ...*migrate.Group) error

Migrate runs the mongo migration orchestrator (the authoritative path for index/schema changes — every entry in Migrations runs exactly once and is tracked) and then ensures baseline indexes exist for any collection that doesn't yet have them.

The two paths coexist deliberately:

• The orchestrator is the only path that can RESHAPE an existing index (drop + recreate with different options). Repair migrations like fix_username_index_partial_filter live here.
• The eager ensureBaselineIndexes path is the only path that runs when an operator boots with WithDisableMigrate() (used in tests and some custom-control deployments). It tolerates index-shape conflicts so a stale index from a prior deployment doesn't block boot — the migration system is expected to repair it.

extraGroups are concatenated after the mongo Migrations group so plugins can register their own migration groups via the standard MigrationProvider interface (mirrors the postgres + sqlite stores).

func (*Store) Ping ¶

func (s *Store) Ping(ctx context.Context) error

Ping checks database connectivity.

func (*Store) ResolveSettings ¶

func (s *Store) ResolveSettings(ctx context.Context, key string, opts settings.ResolveOpts) ([]*settings.Setting, error)

func (*Store) RevokeDelegation ¶

func (s *Store) RevokeDelegation(ctx context.Context, delID id.DelegationID, at time.Time) error

RevokeDelegation marks a grant revoked. The revoked_at guard makes a repeat call a no-op rather than moving the timestamp, so a retried revocation cannot rewrite when the revocation actually happened.

func (*Store) RevokeRefreshTokenFamily ¶

func (s *Store) RevokeRefreshTokenFamily(ctx context.Context, familyID id.SessionFamilyID, reason string) error

RevokeRefreshTokenFamily revokes every active session sharing familyID, recording each refresh-token hash as revoked. Runs inside a MongoTx.

MongoDB transactions require a replica set or sharded cluster. On a standalone mongod this returns ErrUnsupportedDeployment.

func (*Store) RotateSession ¶

func (s *Store) RotateSession(ctx context.Context, sess *session.Session, expectedTokenHash string) (bool, error)

RotateSession atomically persists sess only if the stored access token hash still equals expectedTokenHash. Returns false when no document matched (a concurrent refresh already rotated the session), which prevents two concurrent refreshes from both winning.

func (*Store) SaveBranding ¶

func (s *Store) SaveBranding(ctx context.Context, b *formconfig.BrandingConfig) error

func (*Store) SeedLegacyInvitation ¶

func (s *Store) SeedLegacyInvitation(ctx context.Context, inv *organization.Invitation) error

func (*Store) SeedLegacyPasswordReset ¶

func (s *Store) SeedLegacyPasswordReset(ctx context.Context, pr *account.PasswordReset) error

func (*Store) SeedLegacySession ¶

func (s *Store) SeedLegacySession(ctx context.Context, sess *session.Session) error

SeedLegacySession writes sess exactly as a release before token hashing did: plaintext tokens and no hashes. It exists so the conformance suite can prove the upgrade path and is refused outside `go test`.

func (*Store) SeedLegacyVerification ¶

func (s *Store) SeedLegacyVerification(ctx context.Context, v *account.Verification) error

SeedLegacyVerification, SeedLegacyPasswordReset and SeedLegacyInvitation write documents the way releases before token hashing did: plaintext and no hash. They exist for the conformance suite and are refused outside `go test`.

func (*Store) SetAppClientConfig ¶

func (s *Store) SetAppClientConfig(ctx context.Context, cfg *appclientconfig.Config) error

SetAppClientConfig creates or updates the client config for an app.

func (*Store) SetAppSessionConfig ¶

func (s *Store) SetAppSessionConfig(ctx context.Context, cfg *appsessionconfig.Config) error

SetAppSessionConfig creates or updates the session config for an app.

func (*Store) SetDefaultEnvironment ¶

func (s *Store) SetDefaultEnvironment(ctx context.Context, appID id.AppID, envID id.EnvironmentID) error

SetDefaultEnvironment sets the given environment as the default for its app, clearing the default flag on any previously default environment.

func (*Store) SetPrimaryEmail ¶

func (s *Store) SetPrimaryEmail(ctx context.Context, userID id.UserID, email string) error

func (*Store) SetSetting ¶

func (s *Store) SetSetting(ctx context.Context, st *settings.Setting) error

func (*Store) TouchAPIKey ¶

func (s *Store) TouchAPIKey(ctx context.Context, keyID id.APIKeyID, at time.Time) error

DeleteAPIKey removes an API key. TouchAPIKey writes last_used_at alone.

func (*Store) TouchSession ¶

func (s *Store) TouchSession(ctx context.Context, sessionID id.SessionID, lastActivityAt, expiresAt time.Time) error

TouchSession performs a lightweight update of last_activity_at, expires_at, and updated_at.

func (*Store) UpdateAPIKey ¶

func (s *Store) UpdateAPIKey(ctx context.Context, k *apikey.APIKey) error

UpdateAPIKey modifies an existing API key.

func (*Store) UpdateApp ¶

func (s *Store) UpdateApp(ctx context.Context, a *app.App) error

UpdateApp modifies an existing app.

func (*Store) UpdateDevice ¶

func (s *Store) UpdateDevice(ctx context.Context, d *device.Device) error

UpdateDevice modifies an existing device.

func (*Store) UpdateEnvironment ¶

func (s *Store) UpdateEnvironment(ctx context.Context, e *environment.Environment) error

UpdateEnvironment modifies an existing environment.

func (*Store) UpdateFormConfig ¶

func (s *Store) UpdateFormConfig(ctx context.Context, fc *formconfig.FormConfig) error

func (*Store) UpdateInvitation ¶

func (s *Store) UpdateInvitation(ctx context.Context, inv *organization.Invitation) error

UpdateInvitation modifies an existing invitation.

func (*Store) UpdateMember ¶

func (s *Store) UpdateMember(ctx context.Context, mem *organization.Member) error

UpdateMember modifies an existing member.

func (*Store) UpdateOrganization ¶

func (s *Store) UpdateOrganization(ctx context.Context, o *organization.Organization) error

UpdateOrganization modifies an existing organization.

func (*Store) UpdateServiceAccount ¶

func (s *Store) UpdateServiceAccount(ctx context.Context, svc *serviceaccount.ServiceAccount) error

UpdateServiceAccount modifies an existing service account.

func (*Store) UpdateSession ¶

func (s *Store) UpdateSession(ctx context.Context, sess *session.Session) error

UpdateSession modifies an existing session.

func (*Store) UpdateTeam ¶

func (s *Store) UpdateTeam(ctx context.Context, t *organization.Team) error

UpdateTeam modifies an existing team.

func (*Store) UpdateUser ¶

func (s *Store) UpdateUser(ctx context.Context, u *user.User) error

UpdateUser modifies an existing user.

func (*Store) UpdateVerification ¶

func (s *Store) UpdateVerification(ctx context.Context, v *account.Verification) error

UpdateVerification persists mutable fields (attempts, consumed).

func (*Store) UpdateWebhook ¶

func (s *Store) UpdateWebhook(ctx context.Context, w *webhook.Webhook) error

UpdateWebhook modifies an existing webhook.

func (*Store) WithTx ¶

func (s *Store) WithTx(_ context.Context, fn func(tx organization.Store) error) error

WithTx is a best-effort no-op wrapper for now. Real backend transactions require plumbing driver.Tx through every Store method, which is a multi- day refactor deferred to a follow-up PR. Callers that need true atomic cascade semantics should use the dedicated DeleteOrganizationCascade method below — it uses MongoTx natively without requiring the full every-method-takes-a-tx refactor.