Enum PkceStateStore 

#[non_exhaustive]
pub enum PkceStateStore {
    InMemory(InMemoryPkceStateStore),
}

PKCE state store that dispatches to an in-memory or Redis backend.

Backends

• InMemory (default): per-process DashMap. Safe for single-replica deployments. State is lost on restart.

• Redis (requires redis-pkce Cargo feature): distributed, shared across all replicas. Required for multi-instance Kubernetes / ECS / fly.io deployments where /auth/start and /auth/callback may hit different nodes.

Multi-replica requirement

Set FRAISEQL_REQUIRE_REDIS=1 in your deployment environment to make FraiseQL refuse to start without a Redis-backed PKCE store. This is the recommended pattern for production Kubernetes deployments.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

InMemory(InMemoryPkceStateStore)

Single-node DashMap-backed store.

Implementations

impl PkceStateStore

pub fn new( state_ttl_secs: u64, encryptor: Option<Arc<StateEncryptionService>>, ) -> Self

Create an in-memory PKCE state store (single-replica deployments).

pub const fn is_in_memory(&self) -> bool

Returns true when backed by the in-memory DashMap store.

Used by the FRAISEQL_REQUIRE_REDIS startup check.

pub async fn create_state( &self, redirect_uri: &str, ) -> Result<(String, String), Error>

Generate an authorization-code verifier and reserve a state slot.

Returns (outbound_token, code_verifier):

• outbound_token goes in the OIDC ?state= query parameter.
• code_verifier is passed to Self::s256_challenge and stored until the callback arrives.

Errors

Returns an error if encryption fails (effectively never with a valid key) or the Redis backend is unreachable.

pub async fn consume_state( &self, outbound_token: &str, ) -> Result<ConsumedPkceState, PkceError>

Consume a state token, atomically removing it from the store.

Returns PkceError::StateNotFound for:

• tokens that were never issued,
• tokens that have already been consumed (one-time use), and
• tokens that fail decryption (tampered or from a different key).

Returns PkceError::StateExpired when the in-memory token is valid but its TTL has elapsed. The Redis backend returns StateNotFound for expired tokens (Redis TTL handles expiry).

Errors

Returns PkceError::StateNotFound if the token is unknown, already consumed, or fails decryption. Returns PkceError::StateExpired if the token’s TTL has elapsed.

pub fn s256_challenge(verifier: &str) -> String

Compute the S256 code challenge for a given verifier.

Per RFC 7636 §4.2: code_challenge = BASE64URL(SHA256(ASCII(code_verifier))) (no padding).

pub async fn cleanup_expired(&self)

Remove expired entries.

No-op for the Redis backend — Redis TTL handles expiry automatically. Call from a background task on a fixed interval for the in-memory backend.

pub fn len(&self) -> usize

Number of entries currently in the store.

Returns 0 for the Redis backend — Redis state is not enumerable locally.

pub fn is_empty(&self) -> bool

Returns true when the in-memory store contains no entries.

Always returns true for the Redis backend.