hanna/fabrica

feat(store): web session queries

0a2f109 · hanna committed on 2026-07-25

Add sessions.rs: create a session (id = SHA-256 of the cookie value),
resolve the user behind a live session (joining users, filtering expired
sessions and disabled accounts), touch last_seen at most once a minute,
delete on logout, and reap expired rows. USER_COLUMNS/map_user are now
crate-visible so the join reuses them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/store/src/lib.rs +2 −0

crates/store/src/sessions.rs +127 −0

crates/store/src/tests.rs +56 −0

crates/store/src/users.rs +2 −2

 mod invites;
 mod keys;
 mod repos;
+mod sessions;
 mod tokens;
 mod users;
 pub use crate::invites::NewInvite;
 pub use crate::keys::NewKey;
 pub use crate::repos::NewRepo;
+pub use crate::sessions::NewSession;
 pub use crate::tokens::NewToken;
 pub use crate::users::NewUser;

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Web sessions.
+//!
+//! The `sessions.id` primary key is the SHA-256 of the cookie value (never the
+//! cookie itself), so a database leak does not yield usable sessions. Lookup
+//! filters on `expires_at` so an expired row is treated as absent.
+use model::User;
+use sqlx::Row;
+use crate::users::USER_COLUMNS;
+use crate::{Store, StoreError, now_ms};
+/// Fields needed to create a session row.
+#[derive(Debug, Clone)]
+pub struct NewSession {
+    /// The session id: SHA-256 (hex) of the cookie value.
+    pub id: String,
+    /// The authenticated user's id.
+    pub user_id: String,
+    /// The client user-agent, if known.
+    pub user_agent: Option<String>,
+    /// The client IP, if known.
+    pub ip: Option<String>,
+    /// Absolute expiry, epoch ms.
+    pub expires_at: i64,
+}
+impl Store {
+    /// Create a session row.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn create_session(&self, new: NewSession) -> Result<(), StoreError> {
+        let now = now_ms();
+        sqlx::query(
+            "INSERT INTO sessions (id, user_id, user_agent, ip, created_at, last_seen_at, expires_at) \
+             VALUES ($1, $2, $3, $4, $5, $5, $6)",
+        )
+        .bind(new.id)
+        .bind(new.user_id)
+        .bind(new.user_agent)
+        .bind(new.ip)
+        .bind(now)
+        .bind(new.expires_at)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+    /// Resolve the user behind a live (non-expired) session, or `None`.
+    ///
+    /// A disabled user resolves to `None` — a session must not outlive the
+    /// account's ability to log in.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn user_for_session(&self, session_id: &str) -> Result<Option<User>, StoreError> {
+        let sql = format!(
+            "SELECT {cols} FROM users u JOIN sessions s ON s.user_id = u.id \
+             WHERE s.id = $1 AND s.expires_at > $2 AND u.disabled_at IS NULL",
+            cols = USER_COLUMNS
+                .split(", ")
+                .map(|c| format!("u.{c}"))
+                .collect::<Vec<_>>()
+                .join(", "),
+        );
+        let row = sqlx::query(sqlx::AssertSqlSafe(sql))
+            .bind(session_id)
+            .bind(now_ms())
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_user(r)).transpose()?)
+    }
+    /// Update a session's `last_seen_at`, at most once a minute.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn touch_session(&self, session_id: &str) -> Result<(), StoreError> {
+        let now = now_ms();
+        sqlx::query(
+            "UPDATE sessions SET last_seen_at = $1 \
+             WHERE id = $2 AND last_seen_at < $3",
+        )
+        .bind(now)
+        .bind(session_id)
+        .bind(now - 60_000)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+    /// Delete a session (logout). Returns `true` if a row was removed.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_session(&self, session_id: &str) -> Result<bool, StoreError> {
+        let deleted = sqlx::query("DELETE FROM sessions WHERE id = $1")
+            .bind(session_id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted > 0)
+    }
+    /// Delete every expired session. Returns how many rows were removed.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_expired_sessions(&self) -> Result<u64, StoreError> {
+        let deleted = sqlx::query("DELETE FROM sessions WHERE expires_at <= $1")
+            .bind(now_ms())
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted)
+    }
+}

+}
 #[tokio::test]
+async fn sessions_resolve_the_user_and_respect_expiry() {
+    use super::NewSession;
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("s", "s@example.com"))
+            .await
+            .unwrap();
+        fx.store
+            .create_session(NewSession {
+                id: "sess-live".to_string(),
+                user_id: user.id.clone(),
+                user_agent: Some("curl".to_string()),
+                ip: None,
+                expires_at: now_plus_a_day(),
+            })
+            .await
+            .unwrap();
+        let resolved = fx.store.user_for_session("sess-live").await.unwrap();
+        assert_eq!(resolved.map(|u| u.id), Some(user.id.clone()));
+        // An expired session resolves to nobody and is reaped.
+        fx.store
+            .create_session(NewSession {
+                id: "sess-dead".to_string(),
+                user_id: user.id.clone(),
+                user_agent: None,
+                ip: None,
+                expires_at: 1,
+            })
+            .await
+            .unwrap();
+        assert!(
+            fx.store
+                .user_for_session("sess-dead")
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert_eq!(fx.store.delete_expired_sessions().await.unwrap(), 1);
+        // Logout deletes the live session.
+        assert!(fx.store.delete_session("sess-live").await.unwrap());
+        assert!(
+            fx.store
+                .user_for_session("sess-live")
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+}
+#[tokio::test]
 async fn invites_round_trip_and_are_single_use() {
     use super::NewInvite;

 /// The columns of `users` in a fixed order, shared by every `SELECT` so the
 /// row-mapping in [`Store::map_user`] can rely on names.
-const USER_COLUMNS: &str = "id, username, email, display_name, password_hash, \
+pub(crate) const USER_COLUMNS: &str = "id, username, email, display_name, password_hash, \
      must_change_password, is_admin, disabled_at, created_at, updated_at";
 /// Fields needed to create a user. The server fills in the id, timestamps, and
+    }
     /// Map a `users` row (selected via [`USER_COLUMNS`]) to a [`User`].
-    fn map_user(&self, row: &AnyRow) -> Result<User, sqlx::Error> {
+    pub(crate) fn map_user(&self, row: &AnyRow) -> Result<User, sqlx::Error> {
         Ok(User {
             id: row.try_get("id")?,
             username: row.try_get("username")?,