storage

func (*Storage) BeginTX ¶ added in v1.42.3

func (s *Storage) BeginTX(ctx context.Context) (context.Context, error)

BeginTX implements fosite's storage.Transactional. It opens a transaction and returns a context carrying it; subsequent storage calls in the flow run on that transaction. If the context already carries a live one, it is returned unchanged — Postgres has no nested transactions without savepoints, and the fosite flows here never nest.

func (*Storage) ClientAssertionJWTValid ¶

func (s *Storage) ClientAssertionJWTValid(_ context.Context, _ string) error

func (*Storage) Commit ¶ added in v1.42.3

func (s *Storage) Commit(ctx context.Context) error

func (*Storage) CreateAccessTokenSession ¶

func (s *Storage) CreateAccessTokenSession(ctx context.Context, signature string, req fosite.Requester) error

func (*Storage) CreateAuthorizeCodeSession ¶

func (s *Storage) CreateAuthorizeCodeSession(ctx context.Context, signature string, req fosite.Requester) error

func (*Storage) CreateOpenIDConnectSession ¶

func (s *Storage) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, req fosite.Requester) error

func (*Storage) CreatePKCERequestSession ¶

func (s *Storage) CreatePKCERequestSession(ctx context.Context, signature string, req fosite.Requester) error

func (*Storage) CreateRefreshTokenSession ¶

func (s *Storage) CreateRefreshTokenSession(ctx context.Context, signature string, accessTokenSignature string, req fosite.Requester) error

func (*Storage) DeleteAccessTokenSession ¶

func (s *Storage) DeleteAccessTokenSession(ctx context.Context, signature string) error

func (*Storage) DeleteOpenIDConnectSession ¶

func (s *Storage) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error

func (*Storage) DeletePKCERequestSession ¶

func (s *Storage) DeletePKCERequestSession(ctx context.Context, signature string) error

func (*Storage) DeleteRefreshTokenSession ¶

func (s *Storage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

func (*Storage) GetAccessTokenSession ¶

func (s *Storage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

A nil session skips hydration and leaves the requester's Session nil — safe only for callers that never read it, like fosite's revocation path.

func (*Storage) GetAuthorizeCodeSession ¶

func (s *Storage) GetAuthorizeCodeSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

func (*Storage) GetClient ¶

func (s *Storage) GetClient(ctx context.Context, id string) (fosite.Client, error)

func (*Storage) GetOpenIDConnectSession ¶

func (s *Storage) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

func (*Storage) GetPKCERequestSession ¶

func (s *Storage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

func (*Storage) GetRefreshTokenSession ¶

func (s *Storage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

A nil session skips hydration and leaves the requester's Session nil — safe only for callers that never read it, like fosite's revocation path.

func (*Storage) InvalidateAuthorizeCodeSession ¶

func (s *Storage) InvalidateAuthorizeCodeSession(ctx context.Context, signature string) error

func (*Storage) RevokeAccessToken ¶

func (s *Storage) RevokeAccessToken(ctx context.Context, requestID string) error

RevokeAccessToken deletes every access token issued under requestID and denylists the jti of those not yet expired. JWTs verify statelessly, so only the denylist entry stops them; deleting the row alone cannot. fosite calls this on every path that retires access tokens, including refresh rotation.

The delete and the denylist writes must commit together: a deleted row whose jti never reached the denylist leaves a token nothing can stop. inTx holds that even on fosite's code-reuse path, which has no outer transaction.

A JWT access token is stateless only for resource-server verification: revoking or rotating one is DB-driven end to end (fosite resolves ownership and request_id from the row; the jti comes from session_data here) for now. Eventually, access token storage will be removed completely.

func (*Storage) RevokeRefreshToken ¶

func (s *Storage) RevokeRefreshToken(ctx context.Context, requestID string) error

func (*Storage) Rollback ¶ added in v1.42.3

func (s *Storage) Rollback(ctx context.Context) error

func (*Storage) RotateRefreshToken ¶

func (s *Storage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

RotateRefreshToken retires the refresh token and the access token issued alongside it when the refresh grant rotates them. fosite calls it inside the transaction it began, so the revokes and the replacement inserts commit together; inTx keeps the two revokes atomic if a caller ever does not.

refreshTokenSignature is required by the fosite interface for backends that track rotation lineage (RFC 6749 §10.4 token-family revocation); we revoke by request_id and don't need it for now.

func (*Storage) SetClientAssertionJWT ¶

func (s *Storage) SetClientAssertionJWT(_ context.Context, _ string, _ time.Time) error