hanna/fabrica

feat(store): group, key, and token queries; repo rename/delete

9fa34c4 · hanna committed on 2026-07-25

Add the store surface the CLI's key/repo/group/token commands need:

- groups: ensure_group_path creates a path and every missing intermediate
  (linking parents), reusing existing groups — powering both `group add`
  and the `repo add owner group/sub/repo` convenience; plus lookup, list,
  and cascading delete.
- keys: create assigns ordinals unique per user (across kinds, so
  `key del <index>` needs no --type) and never renumbers survivors;
  lookup by ordinal and by fingerprint (for duplicate rejection and SSH
  auth); delete.
- tokens: create returns the row whose id is the JWT jti; list, lookup,
  revoke (revoked_at), delete, and a once-a-minute last_used_at touch.
- repos: by-id, list-all, metadata-only rename, and row delete.

Model gains Group, Key, and ApiToken entities. All queries stay in the
portable SQL subset and are covered against both SQLite flavours.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/model/src/entity.rs +67 −0

crates/model/src/lib.rs +1 −1

crates/store/src/groups.rs +159 −0

crates/store/src/keys.rs +173 −0

crates/store/src/lib.rs +5 −0

crates/store/src/repos.rs +74 −0

crates/store/src/tests.rs +207 −1

crates/store/src/tokens.rs +171 −0

     pub updated_at: Timestamp,
+}
+/// A nested, user-owned group. Groups provide the repository hierarchy; `path` is
+/// the materialized `group/sub/leaf` under the owner.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Group {
+    /// ULID primary key.
+    pub id: String,
+    /// Owning user.
+    pub owner_id: String,
+    /// Parent group, or `None` for a top-level group.
+    pub parent_id: Option<String>,
+    /// The group's own name (the final path segment).
+    pub name: String,
+    /// Materialized full path within the owner, e.g. `group/sub/leaf`.
+    pub path: String,
+    /// Optional description.
+    pub description: Option<String>,
+    /// Creation time.
+    pub created_at: Timestamp,
+}
+/// A registered public key, for SSH push authentication and/or signature
+/// verification.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Key {
+    /// ULID primary key.
+    pub id: String,
+    /// Owning user.
+    pub user_id: String,
+    /// SSH or GPG.
+    pub kind: KeyKind,
+    /// Optional label.
+    pub name: Option<String>,
+    /// `SHA256:…` for SSH, full hex for GPG.
+    pub fingerprint: String,
+    /// The `authorized_keys` line (SSH) or ASCII-armored block (GPG).
+    pub public_key: String,
+    /// Stable 1-based index within `(user, kind)`, used by `key del`. Deleting one
+    /// key never renumbers the others.
+    pub ordinal: i64,
+    /// When the key was last used to authenticate, if ever.
+    pub last_used_at: Option<Timestamp>,
+    /// Creation time.
+    pub created_at: Timestamp,
+}
+/// An API token record. The JWT itself is never stored; this row exists so a token
+/// can be listed and revoked (`revoked_at`), which the API checks on every request.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ApiToken {
+    /// ULID primary key, and the JWT `jti`.
+    pub id: String,
+    /// Owning user.
+    pub user_id: String,
+    /// Human label.
+    pub name: String,
+    /// Comma-separated scope list.
+    pub scopes: String,
+    /// Expiry, or `None` for a non-expiring token.
+    pub expires_at: Option<Timestamp>,
+    /// When the token was revoked, if it has been.
+    pub revoked_at: Option<Timestamp>,
+    /// When the token was last used, if ever.
+    pub last_used_at: Option<Timestamp>,
+    /// Creation time.
+    pub created_at: Timestamp,
+}
 /// A git repository. On disk it lives at `{repo_dir}/{id[0..2]}/{id}.git`; the
 /// database is the sole authority mapping `(owner, path)` to this id.
 #[derive(Debug, Clone, PartialEq, Eq)]

 pub mod entity;
 pub mod name;
-pub use entity::{KeyKind, Repo, Timestamp, User};
+pub use entity::{ApiToken, Group, Key, KeyKind, Repo, Timestamp, User};
 pub use name::{MAX_NAME_LEN, NameError, RESERVED_NAMES, validate_name};

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Groups: the nested, user-owned repository hierarchy.
+use model::Group;
+use sqlx::any::AnyRow;
+use sqlx::{AssertSqlSafe, Row};
+use crate::{Store, StoreError, map_conflict, new_id, now_ms};
+/// The columns of `groups` in a fixed order, shared by every `SELECT`.
+const GROUP_COLUMNS: &str = "id, owner_id, parent_id, name, path, description, created_at";
+impl Store {
+    /// Ensure a group exists at `owner_id`/`path`, creating it and every missing
+    /// intermediate group, and return the leaf group. Existing groups along the
+    /// path are reused. Each segment name is validated.
+    ///
+    /// This powers both `fabrica group add` and the `repo add owner group/sub/repo`
+    /// convenience that auto-creates the groups a repo is filed under.
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Name`] if any segment is an invalid name.
+    /// * [`StoreError::Query`] on a database failure.
+    pub async fn ensure_group_path(&self, owner_id: &str, path: &str) -> Result<Group, StoreError> {
+        let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
+        if segments.is_empty() {
+            return Err(StoreError::Name(model::NameError::Empty));
+        }
+        for segment in &segments {
+            model::validate_name(segment)?;
+        }
+        let mut parent_id: Option<String> = None;
+        let mut prefix = String::new();
+        let mut leaf: Option<Group> = None;
+        for segment in segments {
+            if prefix.is_empty() {
+                prefix.push_str(segment);
+            } else {
+                prefix.push('/');
+                prefix.push_str(segment);
+            }
+            let group = match self.group_by_owner_path(owner_id, &prefix).await? {
+                Some(existing) => existing,
+                None => {
+                    self.insert_group(owner_id, parent_id.as_deref(), segment, &prefix)
+                        .await?
+                }
+            };
+            parent_id = Some(group.id.clone());
+            leaf = Some(group);
+        }
+        // `leaf` is always set: `segments` was non-empty.
+        leaf.ok_or(StoreError::Name(model::NameError::Empty))
+    }
+    /// Insert a single group row.
+    async fn insert_group(
+        &self,
+        owner_id: &str,
+        parent_id: Option<&str>,
+        name: &str,
+        path: &str,
+    ) -> Result<Group, StoreError> {
+        let group = Group {
+            id: new_id(),
+            owner_id: owner_id.to_string(),
+            parent_id: parent_id.map(str::to_string),
+            name: name.to_string(),
+            path: path.to_string(),
+            description: None,
+            created_at: now_ms(),
+        };
+        let sql = "INSERT INTO groups (id, owner_id, parent_id, name, path, description, created_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7)";
+        sqlx::query(sql)
+            .bind(group.id.clone())
+            .bind(group.owner_id.clone())
+            .bind(group.parent_id.clone())
+            .bind(group.name.clone())
+            .bind(group.path.clone())
+            .bind(group.description.clone())
+            .bind(group.created_at)
+            .execute(&self.pool)
+            .await
+            .map_err(|e| map_conflict(e, "group", &[("path", "path")]))?;
+        Ok(group)
+    }
+    /// Resolve a group by `(owner_id, path)`, or `None` if absent.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn group_by_owner_path(
+        &self,
+        owner_id: &str,
+        path: &str,
+    ) -> Result<Option<Group>, StoreError> {
+        let sql = format!("SELECT {GROUP_COLUMNS} FROM groups WHERE owner_id = $1 AND path = $2");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(owner_id)
+            .bind(path)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(map_group).transpose()?)
+    }
+    /// List every group owned by `owner_id`, ordered by path.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn groups_by_owner(&self, owner_id: &str) -> Result<Vec<Group>, StoreError> {
+        let sql =
+            format!("SELECT {GROUP_COLUMNS} FROM groups WHERE owner_id = $1 ORDER BY path ASC");
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .bind(owner_id)
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(map_group)
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    /// Delete a group by id. Child groups cascade (`ON DELETE CASCADE`); repos in
+    /// the group have their `group_id` set null by the schema, so they survive as
+    /// ungrouped repos. Returns `true` if a row was deleted.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_group(&self, group_id: &str) -> Result<bool, StoreError> {
+        let deleted = sqlx::query("DELETE FROM groups WHERE id = $1")
+            .bind(group_id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted > 0)
+    }
+}
+/// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
+fn map_group(row: &AnyRow) -> Result<Group, sqlx::Error> {
+    Ok(Group {
+        id: row.try_get("id")?,
+        owner_id: row.try_get("owner_id")?,
+        parent_id: row.try_get("parent_id")?,
+        name: row.try_get("name")?,
+        path: row.try_get("path")?,
+        description: row.try_get("description")?,
+        created_at: row.try_get("created_at")?,
+    })
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Public keys: SSH (push auth + signatures) and GPG (signatures).
+use model::{Key, KeyKind};
+use sqlx::any::AnyRow;
+use sqlx::{AssertSqlSafe, Row};
+use crate::{Store, StoreError, map_conflict, new_id, now_ms};
+/// The columns of `keys` in a fixed order, shared by every `SELECT`.
+const KEY_COLUMNS: &str =
+    "id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, created_at";
+/// Fields needed to register a key. The fingerprint is computed by the caller
+/// (which parses and validates the key material); the store assigns the id and
+/// ordinal.
+#[derive(Debug, Clone)]
+pub struct NewKey {
+    /// Owning user id.
+    pub user_id: String,
+    /// SSH or GPG.
+    pub kind: KeyKind,
+    /// Optional label.
+    pub name: Option<String>,
+    /// `SHA256:…` (SSH) or hex (GPG) fingerprint.
+    pub fingerprint: String,
+    /// The `authorized_keys` line or armored block.
+    pub public_key: String,
+}
+impl Store {
+    /// Register a key, assigning the next ordinal for its owner.
+    ///
+    /// Ordinals are assigned unique **per user** (across both kinds), not merely
+    /// per `(user, kind)`, so `fabrica key del <user> <index>` needs no `--type` to
+    /// be unambiguous. Deleting a key never renumbers the survivors.
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Conflict`] if the fingerprint is already registered.
+    /// * [`StoreError::Query`] on any other database failure.
+    pub async fn create_key(&self, new: NewKey) -> Result<Key, StoreError> {
+        let next: i64 = sqlx::query(
+            "SELECT COALESCE(MAX(ordinal), 0) + 1 AS next FROM keys WHERE user_id = $1",
+        )
+        .bind(&new.user_id)
+        .fetch_one(&self.pool)
+        .await?
+        .try_get("next")?;
+        let key = Key {
+            id: new_id(),
+            user_id: new.user_id,
+            kind: new.kind,
+            name: new.name,
+            fingerprint: new.fingerprint,
+            public_key: new.public_key,
+            ordinal: next,
+            last_used_at: None,
+            created_at: now_ms(),
+        };
+        let sql = "INSERT INTO keys \
+             (id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, created_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)";
+        sqlx::query(sql)
+            .bind(key.id.clone())
+            .bind(key.user_id.clone())
+            .bind(key.kind.as_str())
+            .bind(key.name.clone())
+            .bind(key.fingerprint.clone())
+            .bind(key.public_key.clone())
+            .bind(key.ordinal)
+            .bind(key.last_used_at)
+            .bind(key.created_at)
+            .execute(&self.pool)
+            .await
+            .map_err(|e| map_conflict(e, "key", &[("fingerprint", "fingerprint")]))?;
+        Ok(key)
+    }
+    /// List a user's keys, ordered by ordinal (i.e. registration order).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn keys_by_user(&self, user_id: &str) -> Result<Vec<Key>, StoreError> {
+        let sql = format!("SELECT {KEY_COLUMNS} FROM keys WHERE user_id = $1 ORDER BY ordinal ASC");
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .bind(user_id)
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(map_key)
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    /// Fetch a user's key by its 1-based ordinal, or `None`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn key_by_ordinal(
+        &self,
+        user_id: &str,
+        ordinal: i64,
+    ) -> Result<Option<Key>, StoreError> {
+        let sql = format!("SELECT {KEY_COLUMNS} FROM keys WHERE user_id = $1 AND ordinal = $2");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(user_id)
+            .bind(ordinal)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(map_key).transpose()?)
+    }
+    /// Look up any key by `(kind, fingerprint)` — used to reject a duplicate before
+    /// insert and name the existing owner, and by SSH auth to bind a session.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn key_by_fingerprint(
+        &self,
+        kind: KeyKind,
+        fingerprint: &str,
+    ) -> Result<Option<Key>, StoreError> {
+        let sql = format!("SELECT {KEY_COLUMNS} FROM keys WHERE kind = $1 AND fingerprint = $2");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(kind.as_str())
+            .bind(fingerprint)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(map_key).transpose()?)
+    }
+    /// Delete a key by id. Returns `true` if a row was removed.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_key(&self, key_id: &str) -> Result<bool, StoreError> {
+        let deleted = sqlx::query("DELETE FROM keys WHERE id = $1")
+            .bind(key_id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted > 0)
+    }
+}
+/// Map a `keys` row (selected via [`KEY_COLUMNS`]) to a [`Key`].
+fn map_key(row: &AnyRow) -> Result<Key, sqlx::Error> {
+    let kind_str: String = row.try_get("kind")?;
+    let kind = KeyKind::from_token(&kind_str)
+        .ok_or_else(|| sqlx::Error::Decode(format!("invalid key kind {kind_str:?}").into()))?;
+    Ok(Key {
+        id: row.try_get("id")?,
+        user_id: row.try_get("user_id")?,
+        kind,
+        name: row.try_get("name")?,
+        fingerprint: row.try_get("fingerprint")?,
+        public_key: row.try_get("public_key")?,
+        ordinal: row.try_get("ordinal")?,
+        last_used_at: row.try_get("last_used_at")?,
+        created_at: row.try_get("created_at")?,
+    })
+}

 //! Migrations live in `migrations/{sqlite,postgres}/NNNN_name.sql`; the matching
 //! set is embedded at build time and selected at runtime by [`Store::migrate`].
+mod groups;
+mod keys;
 mod repos;
+mod tokens;
 mod users;
 use std::sync::Once;
 use sqlx::any::{AnyPoolOptions, AnyRow};
 use sqlx::migrate::Migrator;
+pub use crate::keys::NewKey;
 pub use crate::repos::NewRepo;
+pub use crate::tokens::NewToken;
 pub use crate::users::NewUser;
 /// Migrations for the SQLite dialect, embedded at build time.

             .map_err(Into::into)
+    }
+    /// Fetch a repository by id, or `None`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn repo_by_id(&self, id: &str) -> Result<Option<Repo>, StoreError> {
+        let sql = format!("SELECT {REPO_COLUMNS} FROM repos WHERE id = $1");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_repo(r)).transpose()?)
+    }
+    /// List every repository, ordered by owner then path. Used by `repo list`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn list_repos(&self) -> Result<Vec<Repo>, StoreError> {
+        let sql = format!("SELECT {REPO_COLUMNS} FROM repos ORDER BY owner_id ASC, path ASC");
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(|r| self.map_repo(r))
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    /// Rename a repository: update its leaf `name` and materialized `path`
+    /// (metadata only — the on-disk directory is keyed by id and never moves).
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Name`] if `new_name` is invalid.
+    /// * [`StoreError::Conflict`] if the owner already has a repo at `new_path`.
+    /// * [`StoreError::Query`] on any other database failure.
+    pub async fn rename_repo(
+        &self,
+        repo_id: &str,
+        new_name: &str,
+        new_path: &str,
+    ) -> Result<bool, StoreError> {
+        model::validate_name(new_name)?;
+        let updated =
+            sqlx::query("UPDATE repos SET name = $1, path = $2, updated_at = $3 WHERE id = $4")
+                .bind(new_name)
+                .bind(new_path)
+                .bind(now_ms())
+                .bind(repo_id)
+                .execute(&self.pool)
+                .await
+                .map_err(|e| map_conflict(e, "repo", &[("path", "path")]))?
+                .rows_affected();
+        Ok(updated > 0)
+    }
+    /// Delete a repository row (cascading to collaborators). The caller is
+    /// responsible for the on-disk directory — moving it to trash, or purging it.
+    /// Returns `true` if a row was removed.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_repo(&self, repo_id: &str) -> Result<bool, StoreError> {
+        let deleted = sqlx::query("DELETE FROM repos WHERE id = $1")
+            .bind(repo_id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted > 0)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {

 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+use model::KeyKind;
 use tempfile::TempDir;
-use super::{Backend, NewRepo, NewUser, Store, StoreError};
+use super::{Backend, NewKey, NewRepo, NewToken, NewUser, Store, StoreError};
 /// A migrated store plus any temp directory that must outlive it.
 struct Fixture {
         .unwrap_or("")
+}
+#[tokio::test]
+async fn ensure_group_path_creates_intermediates_and_reuses() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("g", "g@example.com"))
+            .await
+            .unwrap();
+        let leaf = fx
+            .store
+            .ensure_group_path(&owner.id, "backend/service/v1")
+            .await
+            .unwrap();
+        assert_eq!(leaf.name, "v1");
+        assert_eq!(leaf.path, "backend/service/v1");
+        // Every intermediate was created, parents linked.
+        let all = fx.store.groups_by_owner(&owner.id).await.unwrap();
+        let paths: Vec<&str> = all.iter().map(|g| g.path.as_str()).collect();
+        assert_eq!(paths, ["backend", "backend/service", "backend/service/v1"]);
+        let api = all.iter().find(|g| g.path == "backend/service").unwrap();
+        let backend = all.iter().find(|g| g.path == "backend").unwrap();
+        assert_eq!(api.parent_id.as_deref(), Some(backend.id.as_str()));
+        assert!(backend.parent_id.is_none());
+        // Re-ensuring reuses existing groups (no duplicates, same leaf id).
+        let again = fx
+            .store
+            .ensure_group_path(&owner.id, "backend/service/v1")
+            .await
+            .unwrap();
+        assert_eq!(again.id, leaf.id);
+        assert_eq!(fx.store.groups_by_owner(&owner.id).await.unwrap().len(), 3);
+        assert!(fx.store.delete_group(&backend.id).await.unwrap());
+        // Deleting the top group cascades to its descendants.
+        assert!(
+            fx.store
+                .groups_by_owner(&owner.id)
+                .await
+                .unwrap()
+                .is_empty()
+        );
+    }
+}
+#[tokio::test]
+async fn keys_get_stable_per_user_ordinals() {
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("k", "k@example.com"))
+            .await
+            .unwrap();
+        let new_key = |fp: &str, kind| NewKey {
+            user_id: user.id.clone(),
+            kind,
+            name: None,
+            fingerprint: fp.to_string(),
+            public_key: format!("material-{fp}"),
+        };
+        let k1 = fx
+            .store
+            .create_key(new_key("SHA256:a", KeyKind::Ssh))
+            .await
+            .unwrap();
+        let k2 = fx
+            .store
+            .create_key(new_key("fp-b", KeyKind::Gpg))
+            .await
+            .unwrap();
+        // Ordinals are unique per user across kinds, so `key del <index>` needs no
+        // type.
+        assert_eq!(k1.ordinal, 1);
+        assert_eq!(k2.ordinal, 2);
+        // Duplicate fingerprint is rejected.
+        let err = fx
+            .store
+            .create_key(new_key("SHA256:a", KeyKind::Ssh))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, StoreError::Conflict { entity: "key", .. }),
+            "got {err:?}"
+        );
+        // Delete the first; the second keeps its ordinal (no renumbering).
+        assert!(fx.store.delete_key(&k1.id).await.unwrap());
+        let remaining = fx.store.keys_by_user(&user.id).await.unwrap();
+        assert_eq!(remaining.len(), 1);
+        assert_eq!(remaining[0].ordinal, 2);
+        // A new key takes max(ordinal)+1, not a filled gap.
+        let k3 = fx
+            .store
+            .create_key(new_key("SHA256:c", KeyKind::Ssh))
+            .await
+            .unwrap();
+        assert_eq!(k3.ordinal, 3);
+        let by_ord = fx.store.key_by_ordinal(&user.id, 2).await.unwrap().unwrap();
+        assert_eq!(by_ord.id, k2.id);
+        let by_fp = fx
+            .store
+            .key_by_fingerprint(KeyKind::Gpg, "fp-b")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(by_fp.id, k2.id);
+    }
+}
+#[tokio::test]
+async fn tokens_create_list_and_revoke() {
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("t", "t@example.com"))
+            .await
+            .unwrap();
+        let first = fx
+            .store
+            .create_token(NewToken {
+                user_id: user.id.clone(),
+                name: "ci".to_string(),
+                scopes: "repo:read".to_string(),
+                expires_at: None,
+            })
+            .await
+            .unwrap();
+        fx.store
+            .create_token(NewToken {
+                user_id: user.id.clone(),
+                name: "deploy".to_string(),
+                scopes: "repo:read,repo:write".to_string(),
+                expires_at: Some(now_plus_a_day()),
+            })
+            .await
+            .unwrap();
+        let listed = fx.store.tokens_by_user(&user.id).await.unwrap();
+        assert_eq!(listed.len(), 2);
+        assert_eq!(listed[0].name, "ci", "ordered by creation");
+        // Revocation is what makes a token invalid to the API.
+        assert!(fx.store.revoke_token(&first.id).await.unwrap());
+        let revoked = fx.store.token_by_id(&first.id).await.unwrap().unwrap();
+        assert!(revoked.revoked_at.is_some());
+        // Revoking again is a no-op (already revoked).
+        assert!(!fx.store.revoke_token(&first.id).await.unwrap());
+        assert!(fx.store.delete_token(&first.id).await.unwrap());
+        assert!(fx.store.token_by_id(&first.id).await.unwrap().is_none());
+    }
+}
+fn now_plus_a_day() -> i64 {
+    super::now_ms() + 86_400_000
+}
+#[tokio::test]
+async fn rename_and_delete_repo() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("r", "r@example.com"))
+            .await
+            .unwrap();
+        let repo = fx
+            .store
+            .create_repo(NewRepo {
+                owner_id: owner.id.clone(),
+                group_id: None,
+                name: "old".to_string(),
+                path: "old".to_string(),
+                description: None,
+                is_private: true,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap();
+        assert!(fx.store.rename_repo(&repo.id, "new", "new").await.unwrap());
+        assert!(
+            fx.store
+                .repo_by_owner_path(&owner.id, "old")
+                .await
+                .unwrap()
+                .is_none()
+        );
+        let renamed = fx.store.repo_by_id(&repo.id).await.unwrap().unwrap();
+        assert_eq!(renamed.name, "new");
+        assert_eq!(renamed.path, "new");
+        assert!(fx.store.delete_repo(&repo.id).await.unwrap());
+        assert!(fx.store.repo_by_id(&repo.id).await.unwrap().is_none());
+        assert!(!fx.store.delete_repo(&repo.id).await.unwrap());
+    }
+}
 /// Postgres round-trips, mirroring the SQLite ones. Ignored unless the
 /// `postgres-tests` feature is on and `FABRICA_TEST_POSTGRES_URL` points at a
 /// reachable database; the test cleans up the rows it creates so it can rerun.

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! API tokens: the revocation-tracking rows behind the stateless JWTs.
+//!
+//! The JWT itself is never stored. This row exists so a token can be listed and
+//! revoked: every API request validates the JWT signature *and* checks that the
+//! `jti` row is present and `revoked_at IS NULL`, which is what makes revocation
+//! real.
+use model::ApiToken;
+use sqlx::any::AnyRow;
+use sqlx::{AssertSqlSafe, Row};
+use crate::{Store, StoreError, new_id, now_ms};
+/// The columns of `api_tokens` in a fixed order, shared by every `SELECT`.
+const TOKEN_COLUMNS: &str =
+    "id, user_id, name, scopes, expires_at, revoked_at, last_used_at, created_at";
+/// Fields needed to mint a token row. The store generates the id, which the caller
+/// then embeds in the JWT as its `jti`.
+#[derive(Debug, Clone)]
+pub struct NewToken {
+    /// Owning user id.
+    pub user_id: String,
+    /// Human label.
+    pub name: String,
+    /// Comma-separated scope list.
+    pub scopes: String,
+    /// Expiry, or `None` for a non-expiring token.
+    pub expires_at: Option<i64>,
+}
+impl Store {
+    /// Create a token row and return it; the returned `id` is the JWT `jti` the
+    /// caller signs into the token.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn create_token(&self, new: NewToken) -> Result<ApiToken, StoreError> {
+        let token = ApiToken {
+            id: new_id(),
+            user_id: new.user_id,
+            name: new.name,
+            scopes: new.scopes,
+            expires_at: new.expires_at,
+            revoked_at: None,
+            last_used_at: None,
+            created_at: now_ms(),
+        };
+        let sql = "INSERT INTO api_tokens \
+             (id, user_id, name, scopes, expires_at, revoked_at, last_used_at, created_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8)";
+        sqlx::query(sql)
+            .bind(token.id.clone())
+            .bind(token.user_id.clone())
+            .bind(token.name.clone())
+            .bind(token.scopes.clone())
+            .bind(token.expires_at)
+            .bind(token.revoked_at)
+            .bind(token.last_used_at)
+            .bind(token.created_at)
+            .execute(&self.pool)
+            .await?;
+        Ok(token)
+    }
+    /// List a user's tokens, newest last (ordered by creation), so the 1-based list
+    /// position is stable for `token del <user> <index>`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn tokens_by_user(&self, user_id: &str) -> Result<Vec<ApiToken>, StoreError> {
+        let sql = format!(
+            "SELECT {TOKEN_COLUMNS} FROM api_tokens WHERE user_id = $1 ORDER BY created_at ASC, id ASC"
+        );
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .bind(user_id)
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(map_token)
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    /// Fetch a token row by id (`jti`), or `None`. Used by the API to enforce
+    /// revocation on every request.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn token_by_id(&self, id: &str) -> Result<Option<ApiToken>, StoreError> {
+        let sql = format!("SELECT {TOKEN_COLUMNS} FROM api_tokens WHERE id = $1");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(map_token).transpose()?)
+    }
+    /// Mark a token revoked (idempotent). Returns `true` if a row was updated.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn revoke_token(&self, id: &str) -> Result<bool, StoreError> {
+        let updated = sqlx::query(
+            "UPDATE api_tokens SET revoked_at = $1 WHERE id = $2 AND revoked_at IS NULL",
+        )
+        .bind(now_ms())
+        .bind(id)
+        .execute(&self.pool)
+        .await?
+        .rows_affected();
+        Ok(updated > 0)
+    }
+    /// Delete a token row by id. Returns `true` if a row was removed.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_token(&self, id: &str) -> Result<bool, StoreError> {
+        let deleted = sqlx::query("DELETE FROM api_tokens WHERE id = $1")
+            .bind(id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted > 0)
+    }
+    /// Record that a token was just used, at most once a minute per token (the
+    /// `last_used_at` throttle the spec calls for).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn touch_token(&self, id: &str) -> Result<(), StoreError> {
+        let now = now_ms();
+        let minute_ago = now - 60_000;
+        sqlx::query(
+            "UPDATE api_tokens SET last_used_at = $1 \
+             WHERE id = $2 AND (last_used_at IS NULL OR last_used_at < $3)",
+        )
+        .bind(now)
+        .bind(id)
+        .bind(minute_ago)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+}
+/// Map an `api_tokens` row (selected via [`TOKEN_COLUMNS`]) to an [`ApiToken`].
+fn map_token(row: &AnyRow) -> Result<ApiToken, sqlx::Error> {
+    Ok(ApiToken {
+        id: row.try_get("id")?,
+        user_id: row.try_get("user_id")?,
+        name: row.try_get("name")?,
+        scopes: row.try_get("scopes")?,
+        expires_at: row.try_get("expires_at")?,
+        revoked_at: row.try_get("revoked_at")?,
+        last_used_at: row.try_get("last_used_at")?,
+        created_at: row.try_get("created_at")?,
+    })
+}