Storage is a port (SPEC §7). The module receives a store the way Ring receives a session store, and never opens a database of its own.
take-challenge! is the load-bearing one: it must be atomic. "Redeemed at
most once" is the whole security of a secret that travels by email, and an
implementation that reads and then deletes has a window in which two readers
both see the row. Every implementation of this protocol has to make the read
and the removal one act, and a test that does not run the two concurrently has
not tested it.
What the port deliberately does not carry: a clock. Expiry is policy and the
ceremony owns it, so take-challenge! hands back the row it removed —
identifier and expiry — and consumes a spent challenge whether or not it had
expired. A challenge that expires is still a challenge that cannot be used
twice.
Storage is a port (SPEC §7). The module receives a store the way Ring receives a session store, and never opens a database of its own. `take-challenge!` is the load-bearing one: **it must be atomic**. "Redeemed at most once" is the whole security of a secret that travels by email, and an implementation that reads and then deletes has a window in which two readers both see the row. Every implementation of this protocol has to make the read and the removal one act, and a test that does not run the two concurrently has not tested it. What the port deliberately does not carry: a clock. Expiry is policy and the ceremony owns it, so `take-challenge!` hands back the row it removed — identifier *and* expiry — and consumes a spent challenge whether or not it had expired. A challenge that expires is still a challenge that cannot be used twice.
(in-memory)(in-memory {:keys [subjects clock]})The implementation that ships with the library, so the harness runs with no
infrastructure at all (SPEC §7). :subjects seeds the accounts that exist —
identifier to subject, the subject being whatever opaque value the host wants
back. :clock is only this implementation's own, for pruning; the ceremony's
clock is a separate thing and expiry policy stays there.
The implementation that ships with the library, so the harness runs with no infrastructure at all (SPEC §7). `:subjects` seeds the accounts that exist — identifier to subject, the subject being whatever opaque value the host wants back. `:clock` is only this implementation's own, for pruning; the ceremony's clock is a separate thing and expiry policy stays there.
(bump-generation! store subject)Ends every session of subject by moving its generation on. Returns the
new generation. It must work for a subject with no account row.
Ends every session of `subject` by moving its generation on. Returns the new generation. It must work for a subject with no account row.
(generation store subject)The subject's revocation generation, a non-negative integer. A subject the store has never seen is generation 0 — the bootstrap identities of SPEC §12 have no row anywhere and still hold sessions.
The subject's revocation generation, a non-negative integer. A subject the store has never seen is generation 0 — the bootstrap identities of SPEC §12 have no row anywhere and still hold sessions.
(put-challenge! store token identifier expires-at)Records token against identifier until expires-at (epoch
milliseconds). Returns the store.
An implementation that reads the stored expiries — to expire rows, to
index them — must refuse a non-numeric expires-at in this call and
before writing anything. One bad row otherwise throws from some later
call that has nothing to do with whoever wrote it, and the login is
wedged for everybody.
Records `token` against `identifier` until `expires-at` (epoch milliseconds). Returns the store. An implementation that reads the stored expiries — to expire rows, to index them — must refuse a non-numeric `expires-at` **in this call and before writing anything**. One bad row otherwise throws from some later call that has nothing to do with whoever wrote it, and the login is wedged for everybody.
(subject-for store identifier)The subject this identifier belongs to, or nil. It must not create one: an account comes into being by the host's act, never as a side effect of someone typing an address (SPEC §15).
The subject this identifier belongs to, or nil. It must not create one: an account comes into being by the host's act, never as a side effect of someone typing an address (SPEC §15).
(take-challenge! store token)Removes token and returns the row it held — {:ab/identifier id :ab/expires-at ms} — or nil. Single use: never returns the same row
twice, under any interleaving.
Removes `token` and returns the row it held — `{:ab/identifier id
:ab/expires-at ms}` — or nil. **Single use: never returns the same row
twice, under any interleaving.**cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |