Skip to main content

CodeStore

rustlavel_oauth_provider::code

Trait CodeStore 

Source 
pub trait CodeStore:
    Send
    + Sync
    + 'static {
    // Required methods
    fn store<'a>(&'a self, code: AuthorizationCode) -> StoreFuture<'a, ()>;
    fn consume<'a>(
        &'a self,
        hash: &'a str,
        family: &'a str,
        now: u64,
    ) -> StoreFuture<'a, Consumption>;
    fn purge<'a>(&'a self, now: u64) -> StoreFuture<'a, usize>;
}
Expand description

Where live and recently-spent authorisation codes are kept.

Required Methods§

Source

fn store<'a>(&'a self, code: AuthorizationCode) -> StoreFuture<'a, ()>

Source

fn consume<'a>( &'a self, hash: &'a str, family: &'a str, now: u64, ) -> StoreFuture<'a, Consumption>

Spend a code, exactly once.

Implementations must make the check-and-mark atomic: with two requests carrying the same code in flight, exactly one may receive Consumption::Fresh. A read followed by a separate write leaves a window in which both do, which is the whole attack this is here to stop.

family is the token family the caller is about to issue into, recorded on the code so a replay knows what to revoke.

Source

fn purge<'a>(&'a self, now: u64) -> StoreFuture<'a, usize>

Drop records whose retention window has passed, returning how many.

Housekeeping rather than security — CodeStore::consume already refuses an expired code — but a busy server accumulates one dead record per login, forever, without it.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§