Phil Skentelbery
05b4ff7a6b
Phase 3 Implementation: - Token service with secure token generation and validation - Token endpoint (POST /token) with OAuth 2.0 compliance - Database migration 003 for tokens table - Authorization code validation and single-use enforcement Phase 1 Updates: - Enhanced CodeStore to support dict values with JSON serialization - Maintains backward compatibility Phase 2 Updates: - Authorization codes now include PKCE fields, used flag, timestamps - Complete metadata structure for token exchange Security: - 256-bit cryptographically secure tokens (secrets.token_urlsafe) - SHA-256 hashed storage (no plaintext) - Constant-time comparison for validation - Single-use code enforcement with replay detection Testing: - 226 tests passing (100%) - 87.27% coverage (exceeds 80% requirement) - OAuth 2.0 compliance verified This completes the v1.0.0 MVP with full IndieAuth authorization code flow. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
24 lines
1.1 KiB
SQL
24 lines
1.1 KiB
SQL
-- Migration 003: Create tokens table
|
|
-- Purpose: Store access token metadata (hashed tokens)
|
|
-- Per ADR-004: Opaque tokens with database storage
|
|
|
|
CREATE TABLE IF NOT EXISTS tokens (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
token_hash TEXT NOT NULL UNIQUE, -- SHA-256 hash of token
|
|
me TEXT NOT NULL, -- User's domain URL
|
|
client_id TEXT NOT NULL, -- Client application URL
|
|
scope TEXT NOT NULL DEFAULT '', -- Requested scopes (empty for v1.0.0)
|
|
issued_at TIMESTAMP NOT NULL, -- When token was created
|
|
expires_at TIMESTAMP NOT NULL, -- When token expires
|
|
revoked BOOLEAN NOT NULL DEFAULT 0 -- Revocation flag (future use)
|
|
);
|
|
|
|
-- Indexes for performance
|
|
CREATE INDEX IF NOT EXISTS idx_tokens_hash ON tokens(token_hash);
|
|
CREATE INDEX IF NOT EXISTS idx_tokens_expires ON tokens(expires_at);
|
|
CREATE INDEX IF NOT EXISTS idx_tokens_me ON tokens(me);
|
|
CREATE INDEX IF NOT EXISTS idx_tokens_client ON tokens(client_id);
|
|
|
|
-- Record this migration
|
|
INSERT INTO migrations (version, description) VALUES (3, 'Create tokens table for access token storage');
|