Download this file
| 1 | -- A magic link's address is at rest between send and click. It is sealed |
| 2 | -- there (sealed_address), and gate 1 reads the raw file, the WAL and the |
| 3 | -- SHM to prove it. |
| 4 | -- |
| 5 | -- There is no redeemed_at column and its absence is the design. A row |
| 6 | -- that survives redemption lets a handler tell "already used" apart from |
| 7 | -- "never existed", which is an oracle; and marking it redeemed makes the |
| 8 | -- take a read-then-write race, where two clicks that both read a NULL |
| 9 | -- both mint a session. Taking a link is therefore one DELETE ... RETURNING |
| 10 | -- statement, and unknown, expired and already-used are all "no row" by |
| 11 | -- construction rather than by remembering to make them so. |
| 12 | -- |
| 13 | -- Deleting is safe here where it would not be elsewhere: the column is |
| 14 | -- sealed, so the bytes Litestream keeps are bytes nobody can read. That |
| 15 | -- is also why PRAGMA secure_delete is on regardless (internal/home/db.go). |
| 16 | CREATE TABLE signin_links ( |
| 17 | token_hash TEXT PRIMARY KEY, |
| 18 | sealed_address BLOB NOT NULL, |
| 19 | purpose TEXT NOT NULL, |
| 20 | expires_at TEXT NOT NULL |
| 21 | ); |
| 22 | |
| 23 | -- The sweep deletes by expiry, and it runs on every put. |
| 24 | CREATE INDEX idx_signin_links_expires_at ON signin_links(expires_at); |
| 25 | |
amadan