axess-core 0.11.0

Core implementation for the axess library. Session state machine, multi-factor authentication engine, Cedar Policy evaluation, and pluggable storage backends. Use the `axess` facade crate unless you need direct access to internals. 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

//! The retention sweep of the mysql device store.

use sqlx::MySqlPool;

use crate::device::storage::sql_common::{SqlDeviceStoreError, SweepCutoffs};
use crate::device::store::SweepCounts;

/// Run the three retention transitions against `tenant`'s rows.
pub(super) async fn run(
    pool: &MySqlPool,
    tenant: &str,
    cutoffs: &SweepCutoffs,
) -> Result<SweepCounts, SqlDeviceStoreError> {
    // All three transitions are pure SQL UPDATE/DELETE with
    // affected-row counts; no row reads in user space, no
    // per-row roundtrips.

    // Stage 1: Trusted → Seen, stamped with the demotion. A row is
    // moved one level per sweep, so a demoted row gets its whole
    // Seen window from `now`.
    let trusted_demoted = sqlx::query(
        "UPDATE devices SET trust_level = 'Seen', demoted_at = ? \
         WHERE tenant_id = ? \
           AND trust_level = 'Trusted' \
           AND last_seen_at < ?",
    )
    .bind(cutoffs.now)
    .bind(tenant)
    .bind(cutoffs.trusted)
    .execute(pool)
    .await?
    .rows_affected();

    // Stage 2: Seen → Revoked once `seen_idle` has passed since the
    // later of the last sighting and the demotion. A row demoted a
    // moment ago has `demoted_at = now`, which is not before the
    // cutoff, so it is not revoked by the sweep that demoted it.
    let seen_demoted = sqlx::query(
        "UPDATE devices SET trust_level = 'Revoked', revoked_at = ?, demoted_at = NULL \
         WHERE tenant_id = ? \
           AND trust_level = 'Seen' \
           AND last_seen_at < ? \
           AND (demoted_at IS NULL OR demoted_at < ?)",
    )
    .bind(cutoffs.now)
    .bind(tenant)
    .bind(cutoffs.seen)
    .bind(cutoffs.seen)
    .execute(pool)
    .await?
    .rows_affected();

    // Stage 3: Revoked → purge. ON DELETE CASCADE handles
    // the `device_bindings_refresh` rows.
    //
    // We compare against `revoked_at`, NOT `last_seen_at`, so
    // a device just demoted in stage 2 (revoked_at = now) is
    // NOT eligible for purge in this sweep; its grace clock
    // starts now and a future sweep finishes the job.
    let purged = sqlx::query(
        "DELETE FROM devices \
         WHERE tenant_id = ? \
           AND trust_level = 'Revoked' \
           AND revoked_at IS NOT NULL \
           AND revoked_at < ?",
    )
    .bind(tenant)
    .bind(cutoffs.grace)
    .execute(pool)
    .await?
    .rows_affected();

    Ok(SweepCounts {
        trusted_to_seen: trusted_demoted,
        seen_to_revoked: seen_demoted,
        revoked_purged: purged,
    })
}