Struct SqliteDeviceStore 

pub struct SqliteDeviceStore { /* private fields */ }

Available on crate features device and sqlite only.

SQLite-backed DeviceStore.

Wrap an existing SqlitePool and call init_schema once at startup. The store is Clone (cheap: wraps Arcs); share across handlers / tasks.

Encryption

The primary constructor new requires a SessionCrypto envelope key. The bindings column is encrypted before storage and decrypted on load. Use plaintext only for local development and testing.

Implementations

impl SqliteDeviceStore

pub fn new(pool: SqlitePool, crypto: SessionCrypto) -> Self

Create an encrypted store (recommended for production).

pub fn plaintext(pool: SqlitePool) -> Self

Create a plaintext store (development/testing only). Logs a warning so production builds don’t accidentally pick this path.

pub fn with_clock(self, clock: Arc<dyn Clock>) -> Self

Inject a Clock for deterministic-simulation testing. The clock is read on every record_sighting / set_trust_level call where the caller did not supply an explicit now.

pub fn with_sweep_config(self, config: SweepConfig) -> Self

Override the SweepConfig driving the retention ladder.

pub async fn init_schema(&self) -> Result<(), Error>

Create the devices and device_bindings_refresh tables and supporting indexes. Idempotent: safe to call on every startup.

Trait Implementations

impl Clone for SqliteDeviceStore

fn clone(&self) -> SqliteDeviceStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl DeviceStore for SqliteDeviceStore

type Error = SqlDeviceStoreError

The error type returned by storage operations.

fn load( &self, tenant_id: &TenantId, id: &DeviceId, ) -> impl Future<Output = Result<Option<Device>, Self::Error>> + Send

Load the device by id. Returns None if absent.

fn find_by_fingerprint( &self, tenant_id: &TenantId, hash: &FingerprintHash, ) -> impl Future<Output = Result<Option<Device>, Self::Error>> + Send

Look up a device by its keyed fingerprint within a tenant. Used as the fast-path during request handling when no device_id cookie is present yet. Collisions must be vanishingly rare given a per-tenant HMAC key, but implementations MUST scope the query by tenant_id to prevent cross-tenant correlation.

fn find_for_user( &self, tenant_id: &TenantId, user_id: &UserId, limit: usize, ) -> impl Future<Output = Result<Vec<Device>, Self::Error>> + Send

List active devices for a user, newest-sighted first. limit caps the result so a high-cardinality user doesn’t blow up device-management UIs.

fn find_by_refresh_family( &self, tenant_id: &TenantId, family_id: &str, ) -> impl Future<Output = Result<Vec<Device>, Self::Error>> + Send

Find every device in tenant carrying a DeviceBinding::Refresh { family_id } matching the supplied family_id. Used by the refresh-cascade path to convert “this refresh-token family was compromised” into the list of Devices to revoke.

fn save( &self, device: &Device, ) -> impl Future<Output = Result<(), Self::Error>> + Send

Persist a new device row, or overwrite an existing one. Idempotent.

fn record_sighting( &self, tenant_id: &TenantId, id: &DeviceId, now: DateTime<Utc>, ) -> impl Future<Output = Result<(), Self::Error>> + Send

Touch the last_seen_at timestamp for the given device. Implementations SHOULD perform this as a single UPDATE rather than a load-modify-save round trip.

fn set_trust_level( &self, tenant_id: &TenantId, id: &DeviceId, level: DeviceTrustLevel, now: DateTime<Utc>, ) -> impl Future<Output = Result<(), Self::Error>> + Send

Set the trust level. Drives transitions across the DeviceTrustLevel ladder. Setting to DeviceTrustLevel::Revoked also stamps revoked_at = now.

fn delete( &self, tenant_id: &TenantId, id: &DeviceId, ) -> impl Future<Output = Result<(), Self::Error>> + Send

Hard-delete the row. Idempotent. Used by the retention sweep once a Revoked device has aged out of the configured grace window, and by Art 17 erasure cascades.

fn sweep( &self, tenant_id: &TenantId, now: DateTime<Utc>, ) -> impl Future<Output = Result<SweepCounts, Self::Error>> + Send

Drive the three-stage retention ladder: Trusted → Seen (after the configured Trusted-idle window), Seen → Revoked (after the configured Seen-idle window), Revoked → purged (after the configured grace window). Returns the count of rows changed at each stage.

fn find_active_for_user( &self, tenant_id: &TenantId, user_id: &UserId, limit: usize, ) -> impl Future<Output = Result<Vec<Device>, Self::Error>> + Send

Same as find_for_user but excludes Revoked rows. Default implementation filters in-memory after a full find_for_user call; SQL backends SHOULD override with a WHERE trust_level != 'Revoked' clause that the optimiser can use against the trust-level index.

impl HealthCheck for SqliteDeviceStore

fn check(&self) -> Pin<Box<dyn Future<Output = HealthStatus> + Send + '_>>

Probe the component and return its current health.