@_mustachio/openauth 0.9.2 → 0.10.0

package/src/adapters/d1/index.ts

@@ -0,0 +1,41 @@
+/**
+ * Cloudflare D1 adapter set.
+ *
+ * Per AD8 + the D1 read-replication caveat in `ports/CONSISTENCY.md`, every
+ * operation on the security-critical paths (`TokenStore`, `SessionStore`)
+ * wraps its statement in `db.withSession("first-primary")` so reads observe
+ * the latest write. Read-eventual paths (`ConfigStore`, `KeyStore.signingKeys`,
+ * `MethodStore`, `AuditLog`) use the plain `D1Database` and benefit from
+ * replica reads when available.
+ *
+ * Feature detection — if the `D1Database` runtime predates the Sessions API,
+ * the helper degrades to plain `prepare`. This keeps the adapter compatible
+ * with older Workers runtimes and test shims (bun:sqlite via the
+ * `test/adapters/d1.test.ts` harness) at the cost of relying on
+ * single-replica consistency in those environments.
+ *
+ * @example
+ *   export default {
+ *     async fetch(req, env) {
+ *       const keyStore = new D1KeyStore({ db: env.AUTH })
+ *       const tokenStore = new D1TokenStore({ db: env.AUTH, keyStore })
+ *       // ...
+ *     }
+ *   }
+ */
+export { D1AuditLog, type D1AuditLogOptions } from "./audit-log"
+export { D1ConfigStore, type D1ConfigStoreOptions } from "./config-store"
+export { D1KeyStore, type D1KeyStoreOptions } from "./key-store"
+export { D1MethodStore, type D1MethodStoreOptions } from "./method-store"
+export { D1SessionStore, type D1SessionStoreOptions } from "./session-store"
+export { D1TokenStore, type D1TokenStoreOptions } from "./token-store"
+
+export { INITIAL_SCHEMA_SQL, migrate } from "./migrations"
+export { isSessionsCapable, primarySession } from "./session"
+export {
+  type AnyD1Database,
+  type D1DatabaseSession,
+  type D1DatabaseWithSessions,
+  type D1SessionBookmark,
+  type D1SessionConstraint,
+} from "./types"

package/src/adapters/d1/key-store.ts

@@ -0,0 +1,218 @@
+/**
+ * D1 `KeyStore`. JWK material persisted as JSON-in-TEXT; encryption key
+ * material as BLOB. Auto-generates a signing + encryption key on first read
+ * so deployments don't need a bootstrap step (production users provisioning
+ * keys out-of-band see the existing rows and skip auto-gen).
+ */
+import type { JWK } from "jose"
+import { exportJWK, generateKeyPair, importJWK } from "jose"
+
+import { generateSymmetricKey, randomId } from "../../domain/crypto"
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store"
+import { authError } from "../../types/error"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+
+import { primarySession } from "./session"
+import type { AnyD1Database } from "./types"
+
+export type D1KeyStoreOptions = {
+  db: AnyD1Database
+  clock?: () => number
+  signingAlg?: "ES256" | "EdDSA"
+}
+
+export class D1KeyStore implements KeyStore {
+  #db: AnyD1Database
+  #clock: () => number
+  #signingAlg: "ES256" | "EdDSA"
+  #privateKeyCache = new Map<string, unknown>()
+
+  constructor(opts: D1KeyStoreOptions) {
+    this.#db = opts.db
+    this.#clock = opts.clock ?? (() => Date.now())
+    this.#signingAlg = opts.signingAlg ?? "ES256"
+  }
+
+  async currentSigningKey(): Promise<Result<SigningKey>> {
+    await this.#ensureSigningKey()
+    const row = await primarySession(this.#db)
+      .prepare(
+        `SELECT kid, alg, crv, public_jwk, private_jwk, status, created_at, rotated_at
+           FROM openauth_signing_keys WHERE status = 'active' LIMIT 1`,
+      )
+      .first<SigningRow>()
+    if (!row) {
+      return err(
+        authError.internalError(
+          "no active signing key (should be unreachable)",
+        ),
+      )
+    }
+    return ok(await this.#hydrateSigning(row))
+  }
+
+  async signingKeys(): Promise<Result<SigningKey[]>> {
+    await this.#ensureSigningKey()
+    const result = await primarySession(this.#db)
+      .prepare(
+        `SELECT kid, alg, crv, public_jwk, private_jwk, status, created_at, rotated_at
+           FROM openauth_signing_keys WHERE status IN ('active','next','retired')`,
+      )
+      .all<SigningRow>()
+    const keys = await Promise.all(
+      result.results.map((r) => this.#hydrateSigning(r)),
+    )
+    return ok(keys)
+  }
+
+  async currentEncryptionKey(): Promise<Result<EncryptionKey>> {
+    await this.#ensureEncryptionKey()
+    const row = await primarySession(this.#db)
+      .prepare(
+        `SELECT kid, alg, key_material, status, created_at, rotated_at
+           FROM openauth_encryption_keys WHERE status = 'active' LIMIT 1`,
+      )
+      .first<EncryptionRow>()
+    if (!row) {
+      return err(
+        authError.internalError(
+          "no active encryption key (should be unreachable)",
+        ),
+      )
+    }
+    return ok(this.#hydrateEncryption(row))
+  }
+
+  async getEncryptionKey(kid: string): Promise<Result<EncryptionKey>> {
+    const row = await primarySession(this.#db)
+      .prepare(
+        `SELECT kid, alg, key_material, status, created_at, rotated_at
+           FROM openauth_encryption_keys WHERE kid = ?1`,
+      )
+      .bind(kid)
+      .first<EncryptionRow>()
+    if (!row) {
+      return err(authError.internalError(`encryption key "${kid}" not found`))
+    }
+    return ok(this.#hydrateEncryption(row))
+  }
+
+  async #ensureSigningKey(): Promise<void> {
+    const existing = await primarySession(this.#db)
+      .prepare(
+        `SELECT 1 AS one FROM openauth_signing_keys WHERE status = 'active' LIMIT 1`,
+      )
+      .first<{ one: number }>()
+    if (existing) return
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true,
+    })
+    const publicJwk = await exportJWK(publicKey)
+    const privateJwk = await exportJWK(privateKey)
+    const kid = randomId()
+    await primarySession(this.#db)
+      .prepare(
+        `INSERT OR IGNORE INTO openauth_signing_keys
+           (kid, alg, crv, public_jwk, private_jwk, status, created_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, 'active', ?6)`,
+      )
+      .bind(
+        kid,
+        this.#signingAlg,
+        publicJwk.crv ?? null,
+        JSON.stringify(publicJwk),
+        JSON.stringify(privateJwk),
+        this.#clock(),
+      )
+      .run()
+  }
+
+  async #ensureEncryptionKey(): Promise<void> {
+    const existing = await primarySession(this.#db)
+      .prepare(
+        `SELECT 1 AS one FROM openauth_encryption_keys WHERE status = 'active' LIMIT 1`,
+      )
+      .first<{ one: number }>()
+    if (existing) return
+    const kid = randomId()
+    const keyMaterial = generateSymmetricKey()
+    await primarySession(this.#db)
+      .prepare(
+        `INSERT OR IGNORE INTO openauth_encryption_keys
+           (kid, alg, key_material, status, created_at)
+         VALUES (?1, ?2, ?3, 'active', ?4)`,
+      )
+      .bind(kid, "A256GCM", keyMaterial, this.#clock())
+      .run()
+  }
+
+  async #hydrateSigning(row: SigningRow): Promise<SigningKey> {
+    let imported = this.#privateKeyCache.get(row.kid)
+    if (!imported) {
+      const privateJwk = JSON.parse(row.private_jwk) as JWK
+      imported = await importJWK(privateJwk, row.alg)
+      this.#privateKeyCache.set(row.kid, imported)
+    }
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      ...(row.crv ? { crv: row.crv } : {}),
+      publicJwk: JSON.parse(row.public_jwk) as Record<string, unknown>,
+      privateKeyRef: imported,
+      status: row.status as SigningKey["status"],
+      createdAt: Number(row.created_at),
+      ...(row.rotated_at !== null && row.rotated_at !== undefined
+        ? { rotatedAt: Number(row.rotated_at) }
+        : {}),
+    }
+  }
+
+  #hydrateEncryption(row: EncryptionRow): EncryptionKey {
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      keyRef: ensureBytes(row.key_material),
+      status: row.status as EncryptionKey["status"],
+      createdAt: Number(row.created_at),
+      ...(row.rotated_at !== null && row.rotated_at !== undefined
+        ? { rotatedAt: Number(row.rotated_at) }
+        : {}),
+    }
+  }
+}
+
+type SigningRow = {
+  kid: string
+  alg: string
+  crv: string | null
+  public_jwk: string
+  private_jwk: string
+  status: string
+  created_at: number
+  rotated_at: number | null
+}
+
+type EncryptionRow = {
+  kid: string
+  alg: string
+  // D1 / bun:sqlite return BLOB columns as ArrayBuffer | Uint8Array depending
+  // on the runtime. Accept both.
+  key_material: Uint8Array | ArrayBuffer | { type: string; data: number[] }
+  status: string
+  created_at: number
+  rotated_at: number | null
+}
+
+function ensureBytes(value: EncryptionRow["key_material"]): Uint8Array {
+  if (value instanceof Uint8Array) return value
+  if (value instanceof ArrayBuffer) return new Uint8Array(value)
+  if (
+    value &&
+    typeof value === "object" &&
+    "data" in (value as Record<string, unknown>)
+  ) {
+    return new Uint8Array((value as { data: number[] }).data)
+  }
+  throw new Error("D1KeyStore: unsupported BLOB representation")
+}

package/src/adapters/d1/method-store.ts

@@ -0,0 +1,103 @@
+/**
+ * D1 `MethodStore`. `(tenant_id, method_id)` composite key, JSON-as-TEXT
+ * config blob.
+ */
+import type { MethodStore } from "../../ports/method-store"
+import { authError } from "../../types/error"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+import type { MethodConfig, TenantId } from "../../types/tenant"
+
+import type { AnyD1Database } from "./types"
+
+export type D1MethodStoreOptions = {
+  db: AnyD1Database
+  clock?: () => number
+}
+
+export class D1MethodStore implements MethodStore {
+  #db: AnyD1Database
+  #clock: () => number
+
+  constructor(opts: D1MethodStoreOptions) {
+    this.#db = opts.db
+    this.#clock = opts.clock ?? (() => Date.now())
+  }
+
+  async listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>> {
+    try {
+      const result = await this.#db
+        .prepare(
+          `SELECT config FROM openauth_methods WHERE tenant_id = ?1 ORDER BY method_id`,
+        )
+        .bind(tenantId)
+        .all<{ config: string }>()
+      return ok(result.results.map((r) => JSON.parse(r.config) as MethodConfig))
+    } catch (e) {
+      return err(authError.internalError("listMethods: query failed", e))
+    }
+  }
+
+  async getMethodConfig(
+    tenantId: TenantId,
+    methodId: string,
+  ): Promise<Result<MethodConfig>> {
+    let row: { config: string } | null
+    try {
+      row = await this.#db
+        .prepare(
+          `SELECT config FROM openauth_methods WHERE tenant_id = ?1 AND method_id = ?2`,
+        )
+        .bind(tenantId, methodId)
+        .first<{ config: string }>()
+    } catch (e) {
+      return err(authError.internalError("getMethodConfig: query failed", e))
+    }
+    if (!row) {
+      return err(
+        authError.methodNotFound(
+          `method "${methodId}" not found for tenant "${tenantId}"`,
+          { methodId },
+        ),
+      )
+    }
+    return ok(JSON.parse(row.config) as MethodConfig)
+  }
+
+  async putMethodConfig(
+    tenantId: TenantId,
+    method: MethodConfig,
+  ): Promise<Result<void>> {
+    try {
+      await this.#db
+        .prepare(
+          `INSERT INTO openauth_methods (tenant_id, method_id, config, updated_at) VALUES (?1, ?2, ?3, ?4)
+           ON CONFLICT(tenant_id, method_id) DO UPDATE SET config = excluded.config, updated_at = excluded.updated_at`,
+        )
+        .bind(tenantId, method.id, JSON.stringify(method), this.#clock())
+        .run()
+    } catch (e) {
+      return err(authError.internalError("putMethodConfig: insert failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async deleteMethodConfig(
+    tenantId: TenantId,
+    methodId: string,
+  ): Promise<Result<void>> {
+    try {
+      await this.#db
+        .prepare(
+          `DELETE FROM openauth_methods WHERE tenant_id = ?1 AND method_id = ?2`,
+        )
+        .bind(tenantId, methodId)
+        .run()
+    } catch (e) {
+      return err(
+        authError.internalError("deleteMethodConfig: delete failed", e),
+      )
+    }
+    return ok(undefined)
+  }
+}

package/src/adapters/d1/migrations.ts

@@ -0,0 +1,89 @@
+/**
+ * D1 / SQLite schema for the IdP adapters. Mirrors the Postgres schema
+ * exactly with SQLite-flavored types (TEXT for JSON, BLOB for bytes,
+ * INTEGER for timestamps and serials).
+ *
+ * The auth-code payload is encrypted at rest by the adapter before the
+ * ciphertext lands in `openauth_codes.ciphertext` — the DB only ever sees
+ * the JWE compact string.
+ */
+import type { AnyD1Database } from "./types"
+
+export const INITIAL_SCHEMA_SQL = [
+  `CREATE TABLE IF NOT EXISTS openauth_tenants (
+    id TEXT PRIMARY KEY,
+    config TEXT NOT NULL,
+    updated_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_methods (
+    tenant_id TEXT NOT NULL,
+    method_id TEXT NOT NULL,
+    config TEXT NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (tenant_id, method_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_signing_keys (
+    kid TEXT PRIMARY KEY,
+    alg TEXT NOT NULL,
+    crv TEXT,
+    public_jwk TEXT NOT NULL,
+    private_jwk TEXT NOT NULL,
+    status TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    rotated_at INTEGER
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_encryption_keys (
+    kid TEXT PRIMARY KEY,
+    alg TEXT NOT NULL,
+    key_material BLOB NOT NULL,
+    status TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    rotated_at INTEGER
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_codes (
+    code TEXT PRIMARY KEY,
+    ciphertext TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_refresh_tokens (
+    token TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    subject_id TEXT NOT NULL,
+    family TEXT NOT NULL,
+    expires_at INTEGER NOT NULL,
+    consumed_at INTEGER,
+    payload TEXT NOT NULL
+  )`,
+  `CREATE INDEX IF NOT EXISTS openauth_refresh_family_idx ON openauth_refresh_tokens (family)`,
+  `CREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx ON openauth_refresh_tokens (tenant_id, subject_id)`,
+  `CREATE TABLE IF NOT EXISTS openauth_flows (
+    flow_id TEXT PRIMARY KEY,
+    payload TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_sessions (
+    session_id TEXT PRIMARY KEY,
+    payload TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_audit_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts INTEGER NOT NULL,
+    kind TEXT NOT NULL,
+    payload TEXT NOT NULL
+  )`,
+  `CREATE INDEX IF NOT EXISTS openauth_audit_kind_idx ON openauth_audit_events (kind)`,
+  `CREATE INDEX IF NOT EXISTS openauth_audit_ts_idx ON openauth_audit_events (ts)`,
+]
+
+/**
+ * Apply the initial schema to a D1 database. Idempotent — every statement
+ * is `CREATE … IF NOT EXISTS`. Deployments using `wrangler d1 migrations
+ * apply` can apply the SQL above directly.
+ */
+export async function migrate(db: AnyD1Database): Promise<void> {
+  for (const stmt of INITIAL_SCHEMA_SQL) {
+    await db.prepare(stmt).run()
+  }
+}

package/src/adapters/d1/session-store.ts

@@ -0,0 +1,230 @@
+/**
+ * D1 `SessionStore`. Flow records + optional long-lived sessions.
+ *
+ * `consumeFlow` is `DELETE … RETURNING payload, expires_at` — atomic
+ * single-winner. `updateFlowMethodState` re-serializes the entire payload
+ * blob (SQLite has no `jsonb_set`); the read-then-write is wrapped inside
+ * the same `primarySession` so the bookmark advances atomically.
+ */
+import { authError } from "../../types/error"
+import type { FlowRecord } from "../../types/flow"
+import type { SessionRecord, SessionStore } from "../../ports/session-store"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+
+import { primarySession } from "./session"
+import type { AnyD1Database } from "./types"
+
+export type D1SessionStoreOptions = {
+  db: AnyD1Database
+  clock?: () => number
+}
+
+export class D1SessionStore implements SessionStore {
+  #db: AnyD1Database
+  #clock: () => number
+
+  constructor(opts: D1SessionStoreOptions) {
+    this.#db = opts.db
+    this.#clock = opts.clock ?? (() => Date.now())
+  }
+
+  async saveFlow(
+    flowId: string,
+    payload: FlowRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`),
+      )
+    }
+    const expiresAt = this.#clock() + ttl
+    try {
+      await primarySession(this.#db)
+        .prepare(
+          `INSERT INTO openauth_flows (flow_id, payload, expires_at) VALUES (?1, ?2, ?3)`,
+        )
+        .bind(flowId, JSON.stringify(payload), expiresAt)
+        .run()
+    } catch (e) {
+      return err(authError.internalError("saveFlow: insert failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async updateFlowMethodState(
+    flowId: string,
+    methodState: unknown,
+  ): Promise<Result<void>> {
+    const now = this.#clock()
+    const session = primarySession(this.#db)
+    let row: { payload: string; expires_at: number } | null
+    try {
+      row = await session
+        .prepare(
+          `SELECT payload, expires_at FROM openauth_flows WHERE flow_id = ?1`,
+        )
+        .bind(flowId)
+        .first<{ payload: string; expires_at: number }>()
+    } catch (e) {
+      return err(
+        authError.internalError("updateFlowMethodState: read failed", e),
+      )
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`))
+    }
+    if (now >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    let parsed: FlowRecord
+    try {
+      parsed = JSON.parse(row.payload) as FlowRecord
+    } catch (e) {
+      return err(
+        authError.internalError("updateFlowMethodState: parse failed", e),
+      )
+    }
+    const next = { ...parsed, methodState }
+    try {
+      // Conditional write — only update if the row still exists AND has
+      // matching expiry. If a concurrent consume snuck in, the WHERE clause
+      // misses and we surface `unknown_state`.
+      const result = await session
+        .prepare(
+          `UPDATE openauth_flows SET payload = ?1
+            WHERE flow_id = ?2 AND expires_at > ?3
+            RETURNING 1 AS hit`,
+        )
+        .bind(JSON.stringify(next), flowId, now)
+        .first<{ hit: number }>()
+      if (!result) {
+        return err(
+          authError.unknownState(`flow "${flowId}" unknown or expired`),
+        )
+      }
+    } catch (e) {
+      return err(
+        authError.internalError("updateFlowMethodState: update failed", e),
+      )
+    }
+    return ok(undefined)
+  }
+
+  async readFlow(flowId: string): Promise<Result<FlowRecord>> {
+    let row: { payload: string; expires_at: number } | null
+    try {
+      row = await primarySession(this.#db)
+        .prepare(
+          `SELECT payload, expires_at FROM openauth_flows WHERE flow_id = ?1`,
+        )
+        .bind(flowId)
+        .first<{ payload: string; expires_at: number }>()
+    } catch (e) {
+      return err(authError.internalError("readFlow: query failed", e))
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`))
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await primarySession(this.#db)
+          .prepare(`DELETE FROM openauth_flows WHERE flow_id = ?1`)
+          .bind(flowId)
+          .run()
+      } catch {}
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    return ok(JSON.parse(row.payload) as FlowRecord)
+  }
+
+  async consumeFlow(flowId: string): Promise<Result<FlowRecord>> {
+    let row: { payload: string; expires_at: number } | null
+    try {
+      row = await primarySession(this.#db)
+        .prepare(
+          `DELETE FROM openauth_flows WHERE flow_id = ?1 RETURNING payload, expires_at`,
+        )
+        .bind(flowId)
+        .first<{ payload: string; expires_at: number }>()
+    } catch (e) {
+      return err(authError.internalError("consumeFlow: query failed", e))
+    }
+    if (!row) {
+      return err(
+        authError.unknownState(`flow "${flowId}" unknown or already consumed`),
+      )
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    return ok(JSON.parse(row.payload) as FlowRecord)
+  }
+
+  async createSession(
+    sessionId: string,
+    payload: SessionRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(
+          `createSession: ttl must be positive, got ${ttl}`,
+        ),
+      )
+    }
+    const expiresAt = this.#clock() + ttl
+    try {
+      await primarySession(this.#db)
+        .prepare(
+          `INSERT INTO openauth_sessions (session_id, payload, expires_at) VALUES (?1, ?2, ?3)
+           ON CONFLICT(session_id) DO UPDATE SET payload = excluded.payload, expires_at = excluded.expires_at`,
+        )
+        .bind(sessionId, JSON.stringify(payload), expiresAt)
+        .run()
+    } catch (e) {
+      return err(authError.internalError("createSession: insert failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async readSession(sessionId: string): Promise<Result<SessionRecord>> {
+    let row: { payload: string; expires_at: number } | null
+    try {
+      row = await primarySession(this.#db)
+        .prepare(
+          `SELECT payload, expires_at FROM openauth_sessions WHERE session_id = ?1`,
+        )
+        .bind(sessionId)
+        .first<{ payload: string; expires_at: number }>()
+    } catch (e) {
+      return err(authError.internalError("readSession: query failed", e))
+    }
+    if (!row) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`))
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await primarySession(this.#db)
+          .prepare(`DELETE FROM openauth_sessions WHERE session_id = ?1`)
+          .bind(sessionId)
+          .run()
+      } catch {}
+      return err(authError.invalidRequest(`session "${sessionId}" expired`))
+    }
+    return ok(JSON.parse(row.payload) as SessionRecord)
+  }
+
+  async revokeSession(sessionId: string): Promise<Result<void>> {
+    try {
+      await primarySession(this.#db)
+        .prepare(`DELETE FROM openauth_sessions WHERE session_id = ?1`)
+        .bind(sessionId)
+        .run()
+    } catch (e) {
+      return err(authError.internalError("revokeSession: delete failed", e))
+    }
+    return ok(undefined)
+  }
+}