hanna/fabrica

feat(store): group, key, and token queries; repo rename/delete

9fa34c4 · hanna committed on 2026-07-25

Add the store surface the CLI's key/repo/group/token commands need:

- groups: ensure_group_path creates a path and every missing intermediate
  (linking parents), reusing existing groups — powering both `group add`
  and the `repo add owner group/sub/repo` convenience; plus lookup, list,
  and cascading delete.
- keys: create assigns ordinals unique per user (across kinds, so
  `key del <index>` needs no --type) and never renumbers survivors;
  lookup by ordinal and by fingerprint (for duplicate rejection and SSH
  auth); delete.
- tokens: create returns the row whose id is the JWT jti; list, lookup,
  revoke (revoked_at), delete, and a once-a-minute last_used_at touch.
- repos: by-id, list-all, metadata-only rename, and row delete.

Model gains Group, Key, and ApiToken entities. All queries stay in the
portable SQL subset and are covered against both SQLite flavours.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/model/src/entity.rs +67 −0

crates/model/src/lib.rs +1 −1

crates/store/src/groups.rs +159 −0

crates/store/src/keys.rs +173 −0

crates/store/src/lib.rs +5 −0

crates/store/src/repos.rs +74 −0

crates/store/src/tests.rs +207 −1

crates/store/src/tokens.rs +171 −0

@@ @@ -79,6 +79,73 @@ pub struct User { @@
     pub updated_at: Timestamp,
+}
 /// A nested, user-owned group. Groups provide the repository hierarchy; `path` is
 /// the materialized `group/sub/leaf` under the owner.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Group {
     /// ULID primary key.
     pub id: String,
     /// Owning user.
     pub owner_id: String,
     /// Parent group, or `None` for a top-level group.
     pub parent_id: Option<String>,
     /// The group's own name (the final path segment).
     pub name: String,
     /// Materialized full path within the owner, e.g. `group/sub/leaf`.
     pub path: String,
     /// Optional description.
     pub description: Option<String>,
     /// Creation time.
     pub created_at: Timestamp,
+}
 /// A registered public key, for SSH push authentication and/or signature
 /// verification.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Key {
     /// ULID primary key.
     pub id: String,
     /// Owning user.
     pub user_id: String,
     /// SSH or GPG.
     pub kind: KeyKind,
     /// Optional label.
     pub name: Option<String>,
     /// `SHA256:…` for SSH, full hex for GPG.
     pub fingerprint: String,
     /// The `authorized_keys` line (SSH) or ASCII-armored block (GPG).
     pub public_key: String,
     /// Stable 1-based index within `(user, kind)`, used by `key del`. Deleting one
     /// key never renumbers the others.
     pub ordinal: i64,
     /// When the key was last used to authenticate, if ever.
     pub last_used_at: Option<Timestamp>,
     /// Creation time.
     pub created_at: Timestamp,
+}
 /// An API token record. The JWT itself is never stored; this row exists so a token
 /// can be listed and revoked (`revoked_at`), which the API checks on every request.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ApiToken {
     /// ULID primary key, and the JWT `jti`.
     pub id: String,
     /// Owning user.
     pub user_id: String,
     /// Human label.
     pub name: String,
     /// Comma-separated scope list.
     pub scopes: String,
     /// Expiry, or `None` for a non-expiring token.
     pub expires_at: Option<Timestamp>,
     /// When the token was revoked, if it has been.
     pub revoked_at: Option<Timestamp>,
     /// When the token was last used, if ever.
     pub last_used_at: Option<Timestamp>,
     /// Creation time.
     pub created_at: Timestamp,
+}
 /// A git repository. On disk it lives at `{repo_dir}/{id[0..2]}/{id}.git`; the
 /// database is the sole authority mapping `(owner, path)` to this id.
 #[derive(Debug, Clone, PartialEq, Eq)]

@@ @@ -11,5 +11,5 @@ @@
 pub mod entity;
 pub mod name;
 pub use entity::{KeyKind, Repo, Timestamp, User};
 pub use entity::{ApiToken, Group, Key, KeyKind, Repo, Timestamp, User};
 pub use name::{MAX_NAME_LEN, NameError, RESERVED_NAMES, validate_name};

@@ @@ -0,0 +1,159 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Groups: the nested, user-owned repository hierarchy.
 use model::Group;
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `groups` in a fixed order, shared by every `SELECT`.
 const GROUP_COLUMNS: &str = "id, owner_id, parent_id, name, path, description, created_at";
 impl Store {
     /// Ensure a group exists at `owner_id`/`path`, creating it and every missing
     /// intermediate group, and return the leaf group. Existing groups along the
     /// path are reused. Each segment name is validated.
     ///
     /// This powers both `fabrica group add` and the `repo add owner group/sub/repo`
     /// convenience that auto-creates the groups a repo is filed under.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if any segment is an invalid name.
     /// * [`StoreError::Query`] on a database failure.
     pub async fn ensure_group_path(&self, owner_id: &str, path: &str) -> Result<Group, StoreError> {
         let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
         if segments.is_empty() {
             return Err(StoreError::Name(model::NameError::Empty));
+        }
         for segment in &segments {
             model::validate_name(segment)?;
+        }
         let mut parent_id: Option<String> = None;
         let mut prefix = String::new();
         let mut leaf: Option<Group> = None;
         for segment in segments {
             if prefix.is_empty() {
                 prefix.push_str(segment);
             } else {
                 prefix.push('/');
                 prefix.push_str(segment);
+            }
             let group = match self.group_by_owner_path(owner_id, &prefix).await? {
                 Some(existing) => existing,
                 None => {
                     self.insert_group(owner_id, parent_id.as_deref(), segment, &prefix)
                         .await?
+                }
             };
             parent_id = Some(group.id.clone());
             leaf = Some(group);
+        }
         // `leaf` is always set: `segments` was non-empty.
         leaf.ok_or(StoreError::Name(model::NameError::Empty))
+    }
     /// Insert a single group row.
     async fn insert_group(
         &self,
         owner_id: &str,
         parent_id: Option<&str>,
         name: &str,
         path: &str,
     ) -> Result<Group, StoreError> {
         let group = Group {
             id: new_id(),
             owner_id: owner_id.to_string(),
             parent_id: parent_id.map(str::to_string),
             name: name.to_string(),
             path: path.to_string(),
             description: None,
             created_at: now_ms(),
         };
         let sql = "INSERT INTO groups (id, owner_id, parent_id, name, path, description, created_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7)";
         sqlx::query(sql)
             .bind(group.id.clone())
             .bind(group.owner_id.clone())
             .bind(group.parent_id.clone())
             .bind(group.name.clone())
             .bind(group.path.clone())
             .bind(group.description.clone())
             .bind(group.created_at)
             .execute(&self.pool)
             .await
             .map_err(|e| map_conflict(e, "group", &[("path", "path")]))?;
         Ok(group)
+    }
     /// Resolve a group by `(owner_id, path)`, or `None` if absent.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn group_by_owner_path(
         &self,
         owner_id: &str,
         path: &str,
     ) -> Result<Option<Group>, StoreError> {
         let sql = format!("SELECT {GROUP_COLUMNS} FROM groups WHERE owner_id = $1 AND path = $2");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(owner_id)
             .bind(path)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(map_group).transpose()?)
+    }
     /// List every group owned by `owner_id`, ordered by path.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn groups_by_owner(&self, owner_id: &str) -> Result<Vec<Group>, StoreError> {
         let sql =
             format!("SELECT {GROUP_COLUMNS} FROM groups WHERE owner_id = $1 ORDER BY path ASC");
         let rows = sqlx::query(AssertSqlSafe(sql))
             .bind(owner_id)
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_group)
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
     /// Delete a group by id. Child groups cascade (`ON DELETE CASCADE`); repos in
     /// the group have their `group_id` set null by the schema, so they survive as
     /// ungrouped repos. Returns `true` if a row was deleted.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn delete_group(&self, group_id: &str) -> Result<bool, StoreError> {
         let deleted = sqlx::query("DELETE FROM groups WHERE id = $1")
             .bind(group_id)
             .execute(&self.pool)
             .await?
             .rows_affected();
         Ok(deleted > 0)
+    }
+}
 /// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
 fn map_group(row: &AnyRow) -> Result<Group, sqlx::Error> {
     Ok(Group {
         id: row.try_get("id")?,
         owner_id: row.try_get("owner_id")?,
         parent_id: row.try_get("parent_id")?,
         name: row.try_get("name")?,
         path: row.try_get("path")?,
         description: row.try_get("description")?,
         created_at: row.try_get("created_at")?,
     })
+}

@@ @@ -0,0 +1,173 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Public keys: SSH (push auth + signatures) and GPG (signatures).
 use model::{Key, KeyKind};
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `keys` in a fixed order, shared by every `SELECT`.
 const KEY_COLUMNS: &str =
     "id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, created_at";
 /// Fields needed to register a key. The fingerprint is computed by the caller
 /// (which parses and validates the key material); the store assigns the id and
 /// ordinal.
 #[derive(Debug, Clone)]
 pub struct NewKey {
     /// Owning user id.
     pub user_id: String,
     /// SSH or GPG.
     pub kind: KeyKind,
     /// Optional label.
     pub name: Option<String>,
     /// `SHA256:…` (SSH) or hex (GPG) fingerprint.
     pub fingerprint: String,
     /// The `authorized_keys` line or armored block.
     pub public_key: String,
+}
 impl Store {
     /// Register a key, assigning the next ordinal for its owner.
     ///
     /// Ordinals are assigned unique **per user** (across both kinds), not merely
     /// per `(user, kind)`, so `fabrica key del <user> <index>` needs no `--type` to
     /// be unambiguous. Deleting a key never renumbers the survivors.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Conflict`] if the fingerprint is already registered.
     /// * [`StoreError::Query`] on any other database failure.
     pub async fn create_key(&self, new: NewKey) -> Result<Key, StoreError> {
         let next: i64 = sqlx::query(
             "SELECT COALESCE(MAX(ordinal), 0) + 1 AS next FROM keys WHERE user_id = $1",
+        )
         .bind(&new.user_id)
         .fetch_one(&self.pool)
         .await?
         .try_get("next")?;
         let key = Key {
             id: new_id(),
             user_id: new.user_id,
             kind: new.kind,
             name: new.name,
             fingerprint: new.fingerprint,
             public_key: new.public_key,
             ordinal: next,
             last_used_at: None,
             created_at: now_ms(),
         };
         let sql = "INSERT INTO keys \
              (id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, created_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)";
         sqlx::query(sql)
             .bind(key.id.clone())
             .bind(key.user_id.clone())
             .bind(key.kind.as_str())
             .bind(key.name.clone())
             .bind(key.fingerprint.clone())
             .bind(key.public_key.clone())
             .bind(key.ordinal)
             .bind(key.last_used_at)
             .bind(key.created_at)
             .execute(&self.pool)
             .await
             .map_err(|e| map_conflict(e, "key", &[("fingerprint", "fingerprint")]))?;
         Ok(key)
+    }
     /// List a user's keys, ordered by ordinal (i.e. registration order).
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn keys_by_user(&self, user_id: &str) -> Result<Vec<Key>, StoreError> {
         let sql = format!("SELECT {KEY_COLUMNS} FROM keys WHERE user_id = $1 ORDER BY ordinal ASC");
         let rows = sqlx::query(AssertSqlSafe(sql))
             .bind(user_id)
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_key)
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
     /// Fetch a user's key by its 1-based ordinal, or `None`.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn key_by_ordinal(
         &self,
         user_id: &str,
         ordinal: i64,
     ) -> Result<Option<Key>, StoreError> {
         let sql = format!("SELECT {KEY_COLUMNS} FROM keys WHERE user_id = $1 AND ordinal = $2");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(user_id)
             .bind(ordinal)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(map_key).transpose()?)
+    }
     /// Look up any key by `(kind, fingerprint)` — used to reject a duplicate before
     /// insert and name the existing owner, and by SSH auth to bind a session.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn key_by_fingerprint(
         &self,
         kind: KeyKind,
         fingerprint: &str,
     ) -> Result<Option<Key>, StoreError> {
         let sql = format!("SELECT {KEY_COLUMNS} FROM keys WHERE kind = $1 AND fingerprint = $2");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(kind.as_str())
             .bind(fingerprint)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(map_key).transpose()?)
+    }
     /// Delete a key by id. Returns `true` if a row was removed.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn delete_key(&self, key_id: &str) -> Result<bool, StoreError> {
         let deleted = sqlx::query("DELETE FROM keys WHERE id = $1")
             .bind(key_id)
             .execute(&self.pool)
             .await?
             .rows_affected();
         Ok(deleted > 0)
+    }
+}
 /// Map a `keys` row (selected via [`KEY_COLUMNS`]) to a [`Key`].
 fn map_key(row: &AnyRow) -> Result<Key, sqlx::Error> {
     let kind_str: String = row.try_get("kind")?;
     let kind = KeyKind::from_token(&kind_str)
         .ok_or_else(|| sqlx::Error::Decode(format!("invalid key kind {kind_str:?}").into()))?;
     Ok(Key {
         id: row.try_get("id")?,
         user_id: row.try_get("user_id")?,
         kind,
         name: row.try_get("name")?,
         fingerprint: row.try_get("fingerprint")?,
         public_key: row.try_get("public_key")?,
         ordinal: row.try_get("ordinal")?,
         last_used_at: row.try_get("last_used_at")?,
         created_at: row.try_get("created_at")?,
     })
+}

@@ @@ -25,7 +25,10 @@ @@
 //! Migrations live in `migrations/{sqlite,postgres}/NNNN_name.sql`; the matching
 //! set is embedded at build time and selected at runtime by [`Store::migrate`].
 mod groups;
 mod keys;
 mod repos;
 mod tokens;
 mod users;
 use std::sync::Once;
@@ @@ -36,7 +39,9 @@ use sqlx::Row; @@
 use sqlx::any::{AnyPoolOptions, AnyRow};
 use sqlx::migrate::Migrator;
 pub use crate::keys::NewKey;
 pub use crate::repos::NewRepo;
 pub use crate::tokens::NewToken;
 pub use crate::users::NewUser;
 /// Migrations for the SQLite dialect, embedded at build time.

@@ @@ -124,6 +124,80 @@ impl Store { @@
             .map_err(Into::into)
+    }
     /// Fetch a repository by id, or `None`.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn repo_by_id(&self, id: &str) -> Result<Option<Repo>, StoreError> {
         let sql = format!("SELECT {REPO_COLUMNS} FROM repos WHERE id = $1");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(id)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(|r| self.map_repo(r)).transpose()?)
+    }
     /// List every repository, ordered by owner then path. Used by `repo list`.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn list_repos(&self) -> Result<Vec<Repo>, StoreError> {
         let sql = format!("SELECT {REPO_COLUMNS} FROM repos ORDER BY owner_id ASC, path ASC");
         let rows = sqlx::query(AssertSqlSafe(sql))
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(|r| self.map_repo(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
     /// Rename a repository: update its leaf `name` and materialized `path`
     /// (metadata only — the on-disk directory is keyed by id and never moves).
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if `new_name` is invalid.
     /// * [`StoreError::Conflict`] if the owner already has a repo at `new_path`.
     /// * [`StoreError::Query`] on any other database failure.
     pub async fn rename_repo(
         &self,
         repo_id: &str,
         new_name: &str,
         new_path: &str,
     ) -> Result<bool, StoreError> {
         model::validate_name(new_name)?;
         let updated =
             sqlx::query("UPDATE repos SET name = $1, path = $2, updated_at = $3 WHERE id = $4")
                 .bind(new_name)
                 .bind(new_path)
                 .bind(now_ms())
                 .bind(repo_id)
                 .execute(&self.pool)
                 .await
                 .map_err(|e| map_conflict(e, "repo", &[("path", "path")]))?
                 .rows_affected();
         Ok(updated > 0)
+    }
     /// Delete a repository row (cascading to collaborators). The caller is
     /// responsible for the on-disk directory — moving it to trash, or purging it.
     /// Returns `true` if a row was removed.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn delete_repo(&self, repo_id: &str) -> Result<bool, StoreError> {
         let deleted = sqlx::query("DELETE FROM repos WHERE id = $1")
             .bind(repo_id)
             .execute(&self.pool)
             .await?
             .rows_affected();
         Ok(deleted > 0)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {

@@ @@ -8,9 +8,10 @@ @@
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 use model::KeyKind;
 use tempfile::TempDir;
 use super::{Backend, NewRepo, NewUser, Store, StoreError};
 use super::{Backend, NewKey, NewRepo, NewToken, NewUser, Store, StoreError};
 /// A migrated store plus any temp directory that must outlive it.
 struct Fixture {
         .unwrap_or("")
+}
 #[tokio::test]
 async fn ensure_group_path_creates_intermediates_and_reuses() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("g", "g@example.com"))
             .await
             .unwrap();
         let leaf = fx
             .store
             .ensure_group_path(&owner.id, "backend/service/v1")
             .await
             .unwrap();
         assert_eq!(leaf.name, "v1");
         assert_eq!(leaf.path, "backend/service/v1");
         // Every intermediate was created, parents linked.
         let all = fx.store.groups_by_owner(&owner.id).await.unwrap();
         let paths: Vec<&str> = all.iter().map(|g| g.path.as_str()).collect();
         assert_eq!(paths, ["backend", "backend/service", "backend/service/v1"]);
         let api = all.iter().find(|g| g.path == "backend/service").unwrap();
         let backend = all.iter().find(|g| g.path == "backend").unwrap();
         assert_eq!(api.parent_id.as_deref(), Some(backend.id.as_str()));
         assert!(backend.parent_id.is_none());
         // Re-ensuring reuses existing groups (no duplicates, same leaf id).
         let again = fx
             .store
             .ensure_group_path(&owner.id, "backend/service/v1")
             .await
             .unwrap();
         assert_eq!(again.id, leaf.id);
         assert_eq!(fx.store.groups_by_owner(&owner.id).await.unwrap().len(), 3);
         assert!(fx.store.delete_group(&backend.id).await.unwrap());
         // Deleting the top group cascades to its descendants.
         assert!(
             fx.store
                 .groups_by_owner(&owner.id)
                 .await
                 .unwrap()
                 .is_empty()
         );
+    }
+}
 #[tokio::test]
 async fn keys_get_stable_per_user_ordinals() {
     for fx in sqlite_fixtures().await {
         let user = fx
             .store
             .create_user(sample_user("k", "k@example.com"))
             .await
             .unwrap();
         let new_key = |fp: &str, kind| NewKey {
             user_id: user.id.clone(),
             kind,
             name: None,
             fingerprint: fp.to_string(),
             public_key: format!("material-{fp}"),
         };
         let k1 = fx
             .store
             .create_key(new_key("SHA256:a", KeyKind::Ssh))
             .await
             .unwrap();
         let k2 = fx
             .store
             .create_key(new_key("fp-b", KeyKind::Gpg))
             .await
             .unwrap();
         // Ordinals are unique per user across kinds, so `key del <index>` needs no
         // type.
         assert_eq!(k1.ordinal, 1);
         assert_eq!(k2.ordinal, 2);
         // Duplicate fingerprint is rejected.
         let err = fx
             .store
             .create_key(new_key("SHA256:a", KeyKind::Ssh))
             .await
             .unwrap_err();
         assert!(
             matches!(err, StoreError::Conflict { entity: "key", .. }),
             "got {err:?}"
         );
         // Delete the first; the second keeps its ordinal (no renumbering).
         assert!(fx.store.delete_key(&k1.id).await.unwrap());
         let remaining = fx.store.keys_by_user(&user.id).await.unwrap();
         assert_eq!(remaining.len(), 1);
         assert_eq!(remaining[0].ordinal, 2);
         // A new key takes max(ordinal)+1, not a filled gap.
         let k3 = fx
             .store
             .create_key(new_key("SHA256:c", KeyKind::Ssh))
             .await
             .unwrap();
         assert_eq!(k3.ordinal, 3);
         let by_ord = fx.store.key_by_ordinal(&user.id, 2).await.unwrap().unwrap();
         assert_eq!(by_ord.id, k2.id);
         let by_fp = fx
             .store
             .key_by_fingerprint(KeyKind::Gpg, "fp-b")
             .await
             .unwrap()
             .unwrap();
         assert_eq!(by_fp.id, k2.id);
+    }
+}
 #[tokio::test]
 async fn tokens_create_list_and_revoke() {
     for fx in sqlite_fixtures().await {
         let user = fx
             .store
             .create_user(sample_user("t", "t@example.com"))
             .await
             .unwrap();
         let first = fx
             .store
             .create_token(NewToken {
                 user_id: user.id.clone(),
                 name: "ci".to_string(),
                 scopes: "repo:read".to_string(),
                 expires_at: None,
             })
             .await
             .unwrap();
         fx.store
             .create_token(NewToken {
                 user_id: user.id.clone(),
                 name: "deploy".to_string(),
                 scopes: "repo:read,repo:write".to_string(),
                 expires_at: Some(now_plus_a_day()),
             })
             .await
             .unwrap();
         let listed = fx.store.tokens_by_user(&user.id).await.unwrap();
         assert_eq!(listed.len(), 2);
         assert_eq!(listed[0].name, "ci", "ordered by creation");
         // Revocation is what makes a token invalid to the API.
         assert!(fx.store.revoke_token(&first.id).await.unwrap());
         let revoked = fx.store.token_by_id(&first.id).await.unwrap().unwrap();
         assert!(revoked.revoked_at.is_some());
         // Revoking again is a no-op (already revoked).
         assert!(!fx.store.revoke_token(&first.id).await.unwrap());
         assert!(fx.store.delete_token(&first.id).await.unwrap());
         assert!(fx.store.token_by_id(&first.id).await.unwrap().is_none());
+    }
+}
 fn now_plus_a_day() -> i64 {
     super::now_ms() + 86_400_000
+}
 #[tokio::test]
 async fn rename_and_delete_repo() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("r", "r@example.com"))
             .await
             .unwrap();
         let repo = fx
             .store
             .create_repo(NewRepo {
                 owner_id: owner.id.clone(),
                 group_id: None,
                 name: "old".to_string(),
                 path: "old".to_string(),
                 description: None,
                 is_private: true,
                 default_branch: "main".to_string(),
             })
             .await
             .unwrap();
         assert!(fx.store.rename_repo(&repo.id, "new", "new").await.unwrap());
         assert!(
             fx.store
                 .repo_by_owner_path(&owner.id, "old")
                 .await
                 .unwrap()
                 .is_none()
         );
         let renamed = fx.store.repo_by_id(&repo.id).await.unwrap().unwrap();
         assert_eq!(renamed.name, "new");
         assert_eq!(renamed.path, "new");
         assert!(fx.store.delete_repo(&repo.id).await.unwrap());
         assert!(fx.store.repo_by_id(&repo.id).await.unwrap().is_none());
         assert!(!fx.store.delete_repo(&repo.id).await.unwrap());
+    }
+}
 /// Postgres round-trips, mirroring the SQLite ones. Ignored unless the
 /// `postgres-tests` feature is on and `FABRICA_TEST_POSTGRES_URL` points at a
 /// reachable database; the test cleans up the rows it creates so it can rerun.

@@ @@ -0,0 +1,171 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! API tokens: the revocation-tracking rows behind the stateless JWTs.
 //!
 //! The JWT itself is never stored. This row exists so a token can be listed and
 //! revoked: every API request validates the JWT signature *and* checks that the
 //! `jti` row is present and `revoked_at IS NULL`, which is what makes revocation
 //! real.
 use model::ApiToken;
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::{Store, StoreError, new_id, now_ms};
 /// The columns of `api_tokens` in a fixed order, shared by every `SELECT`.
 const TOKEN_COLUMNS: &str =
     "id, user_id, name, scopes, expires_at, revoked_at, last_used_at, created_at";
 /// Fields needed to mint a token row. The store generates the id, which the caller
 /// then embeds in the JWT as its `jti`.
 #[derive(Debug, Clone)]
 pub struct NewToken {
     /// Owning user id.
     pub user_id: String,
     /// Human label.
     pub name: String,
     /// Comma-separated scope list.
     pub scopes: String,
     /// Expiry, or `None` for a non-expiring token.
     pub expires_at: Option<i64>,
+}
 impl Store {
     /// Create a token row and return it; the returned `id` is the JWT `jti` the
     /// caller signs into the token.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn create_token(&self, new: NewToken) -> Result<ApiToken, StoreError> {
         let token = ApiToken {
             id: new_id(),
             user_id: new.user_id,
             name: new.name,
             scopes: new.scopes,
             expires_at: new.expires_at,
             revoked_at: None,
             last_used_at: None,
             created_at: now_ms(),
         };
         let sql = "INSERT INTO api_tokens \
              (id, user_id, name, scopes, expires_at, revoked_at, last_used_at, created_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8)";
         sqlx::query(sql)
             .bind(token.id.clone())
             .bind(token.user_id.clone())
             .bind(token.name.clone())
             .bind(token.scopes.clone())
             .bind(token.expires_at)
             .bind(token.revoked_at)
             .bind(token.last_used_at)
             .bind(token.created_at)
             .execute(&self.pool)
             .await?;
         Ok(token)
+    }
     /// List a user's tokens, newest last (ordered by creation), so the 1-based list
     /// position is stable for `token del <user> <index>`.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn tokens_by_user(&self, user_id: &str) -> Result<Vec<ApiToken>, StoreError> {
         let sql = format!(
             "SELECT {TOKEN_COLUMNS} FROM api_tokens WHERE user_id = $1 ORDER BY created_at ASC, id ASC"
         );
         let rows = sqlx::query(AssertSqlSafe(sql))
             .bind(user_id)
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_token)
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
     /// Fetch a token row by id (`jti`), or `None`. Used by the API to enforce
     /// revocation on every request.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn token_by_id(&self, id: &str) -> Result<Option<ApiToken>, StoreError> {
         let sql = format!("SELECT {TOKEN_COLUMNS} FROM api_tokens WHERE id = $1");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(id)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(map_token).transpose()?)
+    }
     /// Mark a token revoked (idempotent). Returns `true` if a row was updated.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn revoke_token(&self, id: &str) -> Result<bool, StoreError> {
         let updated = sqlx::query(
             "UPDATE api_tokens SET revoked_at = $1 WHERE id = $2 AND revoked_at IS NULL",
+        )
         .bind(now_ms())
         .bind(id)
         .execute(&self.pool)
         .await?
         .rows_affected();
         Ok(updated > 0)
+    }
     /// Delete a token row by id. Returns `true` if a row was removed.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn delete_token(&self, id: &str) -> Result<bool, StoreError> {
         let deleted = sqlx::query("DELETE FROM api_tokens WHERE id = $1")
             .bind(id)
             .execute(&self.pool)
             .await?
             .rows_affected();
         Ok(deleted > 0)
+    }
     /// Record that a token was just used, at most once a minute per token (the
     /// `last_used_at` throttle the spec calls for).
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn touch_token(&self, id: &str) -> Result<(), StoreError> {
         let now = now_ms();
         let minute_ago = now - 60_000;
         sqlx::query(
             "UPDATE api_tokens SET last_used_at = $1 \
              WHERE id = $2 AND (last_used_at IS NULL OR last_used_at < $3)",
+        )
         .bind(now)
         .bind(id)
         .bind(minute_ago)
         .execute(&self.pool)
         .await?;
         Ok(())
+    }
+}
 /// Map an `api_tokens` row (selected via [`TOKEN_COLUMNS`]) to an [`ApiToken`].
 fn map_token(row: &AnyRow) -> Result<ApiToken, sqlx::Error> {
     Ok(ApiToken {
         id: row.try_get("id")?,
         user_id: row.try_get("user_id")?,
         name: row.try_get("name")?,
         scopes: row.try_get("scopes")?,
         expires_at: row.try_get("expires_at")?,
         revoked_at: row.try_get("revoked_at")?,
         last_used_at: row.try_get("last_used_at")?,
         created_at: row.try_get("created_at")?,
     })
+}