Struct AdminRecoveryCode 

pub struct AdminRecoveryCode {
    pub id: Uuid,
    pub user_id: Uuid,
    pub code_hash: String,
    pub created_at: i64,
    pub used_at: Option<i64>,
}

One single-use recovery code of an crate::sqlite::admin_user::AdminUser.

This layer never sees a plaintext code. code_hash arrives already hashed from admin::mfa, through the very same crate::admin::password this crate hashes operator passwords with – a recovery code is only ever compared, never needed back, so a read of this table yields nothing replayable. That is the opposite of admin_users.totp_secret, which verification needs in the clear.

Methods

• replace_all: mint a set, superseding the previous one, in one transaction
• list_unused / count_unused: what verification walks, and what the panel shows
• consume: spend one, single-use decided by the database
• delete_for_user: what removing the factor takes with it

Fields

id: Uuid

user_id: Uuid

code_hash: String

<algo>$<params>$<salt>$<hash>, exactly a password_hash.

created_at: i64

used_at: Option<i64>

When it was spent. None is the only usable state.

Implementations

impl AdminRecoveryCode

pub async fn replace_all( user_id: Uuid, hashes: &[String], database: &Database, ) -> Result<(), Error>

Replaces this user’s whole set with hashes.

One transaction, and that is the point: a regeneration that failed halfway between the DELETE and the INSERTs would leave the operator holding a printed set that no longer works, or – worse – half the old set still live alongside the new one.

Deletes the used rows too. They are an audit trail of the set being superseded, not of anything still reachable, and keeping them would make “10 minted, 7 remaining” a sum over sets.

pub async fn list_unused( user_id: Uuid, database: &Database, ) -> Result<Vec<AdminRecoveryCode>, Error>

The unspent codes, oldest first – what admin::mfa walks one PBKDF2 run at a time when a submission is not a TOTP code.

pub async fn count_unused( user_id: Uuid, database: &Database, ) -> Result<i64, Error>

How many are left – the “7 of 10 remaining” the panel and admin user totp status both show.

pub async fn consume(id: Uuid, database: &Database) -> Result<bool, Error>

Spends one code. false means it was already spent, or gone.

The used_at IS NULL test lives in the WHERE clause rather than in a read the caller does first: two submissions of one code racing must not both succeed, and rows_affected is what decides which one did. Same primitive as Nonce::verify.

Stamps rather than deletes – see the migration’s comment: “this code was spent, at T” is the audit trail a recovery-code use exists to leave.

pub async fn delete_for_user( user_id: Uuid, database: &Database, ) -> Result<u64, Error>

Drops every code of one user – what removing the second factor takes with it, since a recovery code recovers access to a factor that no longer exists.

pub fn to_json(&self) -> Value

The admin-facing rendering. Never code_hash: it is a password hash, and no front end has a reason to see one.

Trait Implementations

impl Clone for AdminRecoveryCode

fn clone(&self) -> AdminRecoveryCode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdminRecoveryCode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.