storage

func (*Storage) BeginTX ¶ added in v1.42.3

func (s *Storage) BeginTX(ctx context.Context) (context.Context, error)

BeginTX implements fosite's storage.Transactional. It opens a transaction and returns a context carrying it; subsequent storage calls in the flow run on that transaction. If the context already carries a live one, it is returned unchanged — Postgres has no nested transactions without savepoints, and the fosite flows here never nest.

func (*Storage) ClientAssertionJWTValid ¶

func (s *Storage) ClientAssertionJWTValid(_ context.Context, _ string) error

func (*Storage) Commit ¶ added in v1.42.3

func (s *Storage) Commit(ctx context.Context) error

func (*Storage) CreateAccessTokenSession ¶

func (s *Storage) CreateAccessTokenSession(ctx context.Context, signature string, req fosite.Requester) error

func (*Storage) CreateAuthorizeCodeSession ¶

func (s *Storage) CreateAuthorizeCodeSession(ctx context.Context, signature string, req fosite.Requester) error

func (*Storage) CreateOpenIDConnectSession ¶

func (s *Storage) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, req fosite.Requester) error

func (*Storage) CreatePKCERequestSession ¶

func (s *Storage) CreatePKCERequestSession(ctx context.Context, signature string, req fosite.Requester) error

func (*Storage) CreateRefreshTokenSession ¶

func (s *Storage) CreateRefreshTokenSession(ctx context.Context, signature string, accessTokenSignature string, req fosite.Requester) error

func (*Storage) DeleteAccessTokenSession ¶

func (s *Storage) DeleteAccessTokenSession(ctx context.Context, signature string) error

func (*Storage) DeleteOpenIDConnectSession ¶

func (s *Storage) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error

func (*Storage) DeletePKCERequestSession ¶

func (s *Storage) DeletePKCERequestSession(ctx context.Context, signature string) error

func (*Storage) DeleteRefreshTokenSession ¶

func (s *Storage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

func (*Storage) DenylistAccessToken ¶ added in v1.77.1

func (s *Storage) DenylistAccessToken(ctx context.Context, jti uuid.UUID, expiresAt time.Time) error

DenylistAccessToken implements core.AccessTokenDenylister for a token that was minted but will never be delivered.

func (*Storage) GetAccessTokenSession ¶

func (s *Storage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

A nil session skips hydration and leaves the requester's Session nil — safe only for callers that never read it, like fosite's revocation path.

func (*Storage) GetAuthorizeCodeSession ¶

func (s *Storage) GetAuthorizeCodeSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

func (*Storage) GetClient ¶

func (s *Storage) GetClient(ctx context.Context, id string) (fosite.Client, error)

func (*Storage) GetOpenIDConnectSession ¶

func (s *Storage) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

func (*Storage) GetPKCERequestSession ¶

func (s *Storage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

func (*Storage) GetRefreshTokenSession ¶

func (s *Storage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

A nil session skips hydration and leaves the requester's Session nil — safe only for callers that never read it, like fosite's revocation path.

func (*Storage) InvalidateAuthorizeCodeSession ¶

func (s *Storage) InvalidateAuthorizeCodeSession(ctx context.Context, signature string) error

func (*Storage) IsAccessTokenRevoked ¶ added in v1.76.0

func (s *Storage) IsAccessTokenRevoked(ctx context.Context, jti uuid.UUID) (bool, error)

IsAccessTokenRevoked reports whether jti is on the revocation denylist.

func (*Storage) RevokeAccessToken ¶

func (s *Storage) RevokeAccessToken(ctx context.Context, requestID string) error

RevokeAccessToken deletes every access token issued under requestID and denylists the jtis not yet expired — JWTs verify statelessly, so only the denylist entry stops a deleted-but-live token. The two writes must commit together; inTx holds that even on fosite's code-reuse path, which has no outer transaction.

Storing access tokens at all is temporary: the rows are what make ownership and the jti resolvable, and they go away once the denylist is the whole mechanism.

func (*Storage) RevokeRefreshToken ¶

func (s *Storage) RevokeRefreshToken(ctx context.Context, requestID string) error

func (*Storage) RevokeUserClientTokens ¶ added in v1.63.0

func (s *Storage) RevokeUserClientTokens(ctx context.Context, subject, clientID string) (RevokedCounts, error)

RevokeUserClientTokens revokes everything clientID holds for subject on app de-authorization, unspent authorization codes included — Doorkeeper's revoke_tokens_and_grants_for revokes grants too.

func (*Storage) Rollback ¶ added in v1.42.3

func (s *Storage) Rollback(ctx context.Context) error

func (*Storage) RotateRefreshToken ¶

func (s *Storage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

RotateRefreshToken retires the presented refresh token and the grant's access tokens on refresh-grant rotation. fosite calls it inside its own transaction; inTx keeps the two writes atomic if a caller ever does not.

Zero rows means the token went inactive between fosite's read and this write, typically a user de-authorizing the client. ErrInactiveToken makes fosite roll the rotation back, so no successor is minted for a revoked grant. The pair lock, held until fosite commits, keeps a de-authorization from running between this guard and the successor's insert.

func (*Storage) SetClientAssertionJWT ¶

func (s *Storage) SetClientAssertionJWT(_ context.Context, _ string, _ time.Time) error