Struct DurableInviteStore 

pub struct DurableInviteStore { /* private fields */ }

Storage-backed invite state. Every mutating operation is one conditional KV batch, so two daemons cannot consume the same token even if an outer process lock is lost.

Implementations

impl DurableInviteStore

pub async fn redeemable( &self, token_hash: &str, ) -> StorageResult<Option<Invite>>

Read one currently redeemable invite without consuming it.

Handlers use this to prepare fallible provisioning before the atomic consume that commits a redemption. Callers must commit with Self::consume_if_unchanged so a stale provisioned identity cannot win after another daemon consumed the same record.

Errors

Returns a storage error if the record cannot be read or decoded.

pub async fn consume_if_unchanged( &self, expected: &Invite, ) -> StorageResult<bool>

Consume the exact invite previously returned by Self::redeemable.

This is the commit operation for prepare-then-consume handlers. It fails closed if the record changed, expired, or was consumed while the caller performed provisioning.

Errors

Returns a storage error if the conditional mutation cannot be applied.

pub async fn consume_with_ownership( &self, expected: &Invite, ownership: &OwnershipStore, principal: PrincipalUid, ) -> Result<bool, OwnershipError>

Commit token consumption and principal ownership in one backend batch. The ownership store must use the same authoritative runtime KV backend.

Errors

Returns validation or potentially ambiguous storage errors; only a definite false permits rollback of the new identity.

impl DurableInviteStore

pub fn new(backend: Arc<dyn KvStore>) -> StorageResult<Self>

Bind the fixed system-control projection.

Errors

Returns a storage error if the backend rejects the fixed invite namespace.

pub async fn ensure_legacy_import(&self, home: &AstridHome) -> StorageResult<()>

Ensure a released native invite file has been imported exactly once. The source is validated and parsed before any durable mutation. A durable receipt makes restart idempotent; retirement happens only after record and receipt read-back succeeds.

Errors

Returns a storage error if the legacy source is unsafe or malformed, conflicts with durable state, or cannot be durably imported.

pub async fn list(&self) -> StorageResult<Vec<Invite>>

Load all current records in deterministic token-identifier order.

Errors

Returns a storage error if records cannot be listed or decoded.

pub async fn issue(&self, invite: &Invite) -> StorageResult<bool>

Insert one invite iff its identifier is absent.

Errors

Returns a storage error if the conditional batch cannot be applied.

pub async fn redeem(&self, token_hash: &str) -> StorageResult<Option<Invite>>

Atomically consume one invite. Only one concurrent caller can win.

Errors

Returns a storage error if the record cannot be read, decoded, or conditionally removed.

pub async fn revoke(&self, token_hash: &str) -> StorageResult<bool>

Remove one invite by its canonical fingerprint.

Errors

Returns a storage error if the conditional delete cannot be applied.

pub async fn prune(&self) -> StorageResult<usize>

Prune expired and exhausted records using conditional deletes.

Errors

Returns a storage error if records cannot be read or a conditional delete cannot be applied.

Trait Implementations

impl Clone for DurableInviteStore

fn clone(&self) -> DurableInviteStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.