Struct OAuthRefreshTokens

pub struct OAuthRefreshTokens {
    pub digest: Digest,
    pub user_id: Uuid,
    pub client_id: Uuid,
    pub expires_at: DateTime<Utc>,
    pub scopes: Vec<String>,
    pub audience: Option<Vec<String>>,
    pub jti: Uuid,
    pub dpop_jkt: Option<String>,
    pub metadata: Value,
    pub revoked: bool,
    pub rotated_from: Option<Digest>,
}

INTERNAL/DATABASE-ONLY MODEL - DO NOT EXPOSE TO CLIENTS

This struct is a database model that contains a Digest field, which contains raw bytes and uses custom (de)serialization. This model must never be serialized into external API payloads or returned directly to clients.

For external-facing responses, use DTOs such as TokenResponse, UserInfoResponse, or an explicit redacting wrapper that strips or converts Digest fields to safe types (e.g., strings).

Rationale: The Digest type contains sensitive raw bytes and uses custom serialization that is not suitable for external APIs. Exposing this model directly could leak internal implementation details or cause serialization issues.

Fields

digest: Digest

user_id: Uuid

client_id: Uuid

expires_at: DateTime<Utc>

scopes: Vec<String>

audience: Option<Vec<String>>

jti: Uuid

dpop_jkt: Option<String>

Optional DPoP sender constraint

metadata: Value

revoked: bool

rotated_from: Option<Digest>

Implementations

impl OAuthRefreshTokens

pub async fn insert( conn: &mut PgConnection, params: NewRefreshTokenParams<'_>, ) -> ModelResult<()>

pub async fn find_valid( conn: &mut PgConnection, digest: Digest, ) -> ModelResult<OAuthRefreshTokens>

pub async fn find_valid_for_sender( conn: &mut PgConnection, digest: Digest, presented_jkt: Option<&str>, ) -> ModelResult<OAuthRefreshTokens>

Optional stricter variant: if the RT is sender-constrained (has dpop_jkt), require a matching presented_jkt.

pub async fn revoke_by_digest( conn: &mut PgConnection, digest: Digest, ) -> ModelResult<()>

pub async fn revoke_all_by_user_client( conn: &mut PgConnection, user_id: Uuid, client_id: Uuid, ) -> ModelResult<()>

pub async fn consume_in_transaction( tx: &mut Transaction<'_, Postgres>, digest: Digest, client_id: Uuid, ) -> ModelResult<OAuthRefreshTokens>

Consume a refresh token within an existing transaction.

Transaction Requirements

This method must be called within an existing database transaction. The caller is responsible for managing the transaction (begin, commit, rollback).

Returns the consumed token data.

pub async fn complete_refresh_token_rotation_in_transaction( tx: &mut Transaction<'_, Postgres>, old_token: &OAuthRefreshTokens, params: RotateRefreshTokenParams<'_>, ) -> ModelResult<()>

Complete refresh token rotation within an existing transaction after token has been consumed.

Transaction Requirements

This method must be called within an existing database transaction. The caller is responsible for managing the transaction (begin, commit, rollback).

Revokes all tokens for user/client, inserts new refresh token, and inserts new access token.

pub async fn issue_tokens_from_auth_code_in_transaction( tx: &mut Transaction<'_, Postgres>, params: IssueTokensFromAuthCodeParams<'_>, ) -> ModelResult<()>

Issue tokens from authorization code within an existing transaction.

Transaction Requirements

This method must be called within an existing database transaction. The caller is responsible for managing the transaction (begin, commit, rollback).

Inserts access token, revokes all refresh tokens for user/client, and inserts new refresh token.

Trait Implementations

impl Debug for OAuthRefreshTokens

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OAuthRefreshTokens

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<'a, R: Row> FromRow<'a, R> for OAuthRefreshTokens

where &'a str: ColumnIndex<R>, Digest: Decode<'a, R::Database> + Type<R::Database>, Uuid: Decode<'a, R::Database> + Type<R::Database>, DateTime<Utc>: Decode<'a, R::Database> + Type<R::Database>, Vec<String>: Decode<'a, R::Database> + Type<R::Database>, Option<Vec<String>>: Decode<'a, R::Database> + Type<R::Database>, Option<String>: Decode<'a, R::Database> + Type<R::Database>, Value: Decode<'a, R::Database> + Type<R::Database>, bool: Decode<'a, R::Database> + Type<R::Database>, Option<Digest>: Decode<'a, R::Database> + Type<R::Database>,

fn from_row(__row: &'a R) -> Result<Self>

impl Serialize for OAuthRefreshTokens

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.