KemalIdentity::Postgres::ApiTokenRepository
Inherits KemalIdentity::ApiTokens::Repository < Reference < Object
ApiTokens::Repository over auth_api_tokens.
The hot path is #find_by_digest — one indexed lookup with a join, returning token state and
account status together, for the same reason sessions do it: an API's request rate is exactly
where a second round trip per request is felt.
Constants
Constructors
Instance methods
Stores a newly issued token.
Raises KemalIdentity::InfrastructureError on a duplicate digest — the unique index makes
a collision a loud error rather than two accounts sharing a credential.
Deletes rows past their expiry, returning the count. Disk reclamation only — correctness never depends on it, because expiry is evaluated on read.
Brings a token's expiry forward to at, returning false if it does not exist, is
already revoked, or already expires at or before at.
This is what a rotation with an overlap window needs: the replacement is issued, the old
credential is given a deadline instead of being killed outright, and the fleet has until
then to pick the new one up. Because the deadline lands on the row, expiry is enforced
by the authentication path on every request — no sweeper, no scheduled revoke, nothing
that has to have run for the window to close (blueprints/0025, TOK-08).
It must never lengthen a token's life. "Expire" is not "renew": a rotation that could extend the credential it replaces is not a rotation, and a management screen that could push a deadline out is a way to keep a compromised credential alive. The comparison belongs in the statement rather than in a read followed by a write, so that two callers cannot interleave into a later deadline than either asked for:
UPDATE auth_api_tokens SET expires_at = $2
WHERE id = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > $2)A time in the past is allowed and closes the window immediately. The token then fails as
Expired rather than Revoked, which is the honest reason: nobody revoked it.
An inner join, so a token pointing at an account that no longer exists resolves to nothing: the failure mode is closed rather than open.
Every token for an account, newest first, revoked ones included.
This is the management screen. It returns revoked tokens too, because "when did I revoke that?" is exactly the question such a screen exists to answer.
Marks one token revoked, returning false if it does not exist or was already revoked.
Revokes every live token for an account, returning how many it revoked. What "revoke all my API tokens" calls, and the right response to a compromised account.