KemalIdentity::Testing::MemoryApiTokenRepository
Inherits KemalIdentity::ApiTokens::Repository < Reference < Object
In-memory ApiTokens::Repository.
Passes the same contract spec as the PostgreSQL and SQLite adapters. Wired to an account
repository because find_by_digest returns token state and account status together.
Constructors
Instance methods
Stores a newly issued token.
Raises KemalIdentity::InfrastructureError on a duplicate digest — the unique index makes
a collision a loud error rather than two accounts sharing a credential.
Deletes rows past their expiry, returning the count. Disk reclamation only — correctness never depends on it, because expiry is evaluated on read.
Brings a token's expiry forward to at, returning false if it does not exist, is
already revoked, or already expires at or before at.
This is what a rotation with an overlap window needs: the replacement is issued, the old
credential is given a deadline instead of being killed outright, and the fleet has until
then to pick the new one up. Because the deadline lands on the row, expiry is enforced
by the authentication path on every request — no sweeper, no scheduled revoke, nothing
that has to have run for the window to close (blueprints/0025, TOK-08).
It must never lengthen a token's life. "Expire" is not "renew": a rotation that could extend the credential it replaces is not a rotation, and a management screen that could push a deadline out is a way to keep a compromised credential alive. The comparison belongs in the statement rather than in a read followed by a write, so that two callers cannot interleave into a later deadline than either asked for:
UPDATE auth_api_tokens SET expires_at = $2
WHERE id = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > $2)A time in the past is allowed and closes the window immediately. The token then fails as
Expired rather than Revoked, which is the honest reason: nobody revoked it.
Resolves a token by the digest of its secret, with account status.
Returns nil — never raises — when nothing matches, and when the token's account does not
exist: the reference SQL is an inner join, so a token pointing at a deleted account
resolves to nothing and the failure mode is closed.
Expiry and revocation are not evaluated here. This reports facts; the service decides what they mean, which is what lets a management screen list revoked tokens through the same repository.
Every token for an account, newest first, revoked ones included.
This is the management screen. It returns revoked tokens too, because "when did I revoke that?" is exactly the question such a screen exists to answer.
Marks one token revoked, returning false if it does not exist or was already revoked.
Revokes every live token for an account, returning how many it revoked. What "revoke all my API tokens" calls, and the right response to a compromised account.