@sixb/core 0.0.1

package/src/storage/auth/in-memory/invitations.ts

@@ -0,0 +1,165 @@
+import { paginate } from "../../pagination"
+import { AuthStorageError } from "../errors"
+import type {
+  AuthInvitationStore,
+  CreateOrUpdateAuthInvitationInput,
+  InvitationRecord,
+  ListAuthInvitationsInput,
+  ListAuthInvitationsResult,
+} from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  assertNonEmpty,
+  cloneDate,
+  cloneOptionalRecord,
+  cloneRecord,
+  compareByCreatedAt,
+  dateOrNow,
+  getActiveInvitationByEmail,
+  invitationKey,
+  normalizeEmail,
+  normalizeGroupIds,
+} from "./shared"
+
+export class InMemoryAuthInvitationStore implements AuthInvitationStore {
+  constructor(private readonly state: AuthStorageState) {}
+
+  async createOrUpdateActive(input: CreateOrUpdateAuthInvitationInput): Promise<InvitationRecord> {
+    const id = assertNonEmpty(input.id, "Invitation id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const email = normalizeEmail(input.email)
+    const groupIds = normalizeGroupIds(input.groupIds)
+    const now = dateOrNow(input.updatedAt ?? input.createdAt)
+    const existingActive = getActiveInvitationByEmail(this.state, projectId, email, now)
+
+    if (existingActive) {
+      const next: InvitationRecord = {
+        ...existingActive,
+        groupIds,
+        createdByPrincipal: input.createdByPrincipal,
+        createdBySessionId: input.createdBySessionId,
+        expiresAt: cloneDate(input.expiresAt),
+        updatedAt: now,
+      }
+      this.state.invitations.set(invitationKey(projectId, existingActive.id), cloneRecord(next))
+      return cloneRecord(next)
+    }
+
+    const key = invitationKey(projectId, id)
+    if (this.state.invitations.has(key)) {
+      throw new AuthStorageError(
+        "duplicate_invitation",
+        `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`
+      )
+    }
+
+    const invitation: InvitationRecord = {
+      id,
+      projectId,
+      email,
+      groupIds,
+      status: "pending",
+      createdByPrincipal: input.createdByPrincipal,
+      createdBySessionId: input.createdBySessionId,
+      createdAt: dateOrNow(input.createdAt),
+      updatedAt: now,
+      expiresAt: cloneDate(input.expiresAt),
+    }
+    this.state.invitations.set(key, cloneRecord(invitation))
+    return cloneRecord(invitation)
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<InvitationRecord | null> {
+    const record = this.state.invitations.get(invitationKey(params.projectId, params.id)) ?? null
+    return cloneOptionalRecord(record)
+  }
+
+  async getActiveByEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly now: Date
+  }): Promise<InvitationRecord | null> {
+    return cloneOptionalRecord(
+      getActiveInvitationByEmail(this.state, params.projectId, params.email, params.now)
+    )
+  }
+
+  async list(input: ListAuthInvitationsInput): Promise<ListAuthInvitationsResult> {
+    if (input.statuses?.length === 0 || input.groupIds?.length === 0) {
+      return { invitations: [], hasMore: false, total: 0 }
+    }
+
+    const statuses = input.statuses ? new Set(input.statuses) : null
+    const groupIds = input.groupIds ? new Set(input.groupIds) : null
+    const email = input.email ? normalizeEmail(input.email) : null
+    const order = input.order ?? "desc"
+    const invitations = [...this.state.invitations.values()]
+      .filter((invitation) => invitation.projectId === input.projectId)
+      .filter((invitation) => (email ? invitation.email === email : true))
+      .filter((invitation) => (statuses ? statuses.has(invitation.status) : true))
+      .filter((invitation) =>
+        groupIds ? invitation.groupIds.some((groupId) => groupIds.has(groupId)) : true
+      )
+      .sort((a, b) => compareByCreatedAt(a, b, order))
+
+    const page = paginate(invitations, input)
+    return {
+      invitations: page.page.map(cloneRecord),
+      hasMore: page.hasMore,
+      total: page.total,
+    }
+  }
+
+  async accept(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly acceptedAt: Date
+  }): Promise<InvitationRecord> {
+    const key = invitationKey(params.projectId, params.id)
+    const existing = this.state.invitations.get(key)
+
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_invitation",
+        `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`
+      )
+    }
+
+    const next: InvitationRecord = {
+      ...existing,
+      status: "accepted",
+      acceptedAt: cloneDate(params.acceptedAt),
+      updatedAt: cloneDate(params.acceptedAt),
+    }
+    this.state.invitations.set(key, cloneRecord(next))
+    return cloneRecord(next)
+  }
+
+  async revoke(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly revokedAt: Date
+  }): Promise<InvitationRecord> {
+    const key = invitationKey(params.projectId, params.id)
+    const existing = this.state.invitations.get(key)
+
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_invitation",
+        `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`
+      )
+    }
+
+    const next: InvitationRecord = {
+      ...existing,
+      status: "revoked",
+      revokedAt: cloneDate(params.revokedAt),
+      updatedAt: cloneDate(params.revokedAt),
+    }
+    this.state.invitations.set(key, cloneRecord(next))
+    return cloneRecord(next)
+  }
+}

package/src/storage/auth/in-memory/magic-links.ts

@@ -0,0 +1,98 @@
+import { resolveAuthSessionAudience } from "../../../auth/audience"
+import { AuthStorageError } from "../errors"
+import type { AuthMagicLinkStore, CreateAuthMagicLinkInput, MagicLinkRecord } from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  assertNonEmpty,
+  cloneDate,
+  cloneOptionalRecord,
+  cloneRecord,
+  compareByCreatedAt,
+  consumeMagicLinkRecord,
+  isActiveMagicLink,
+  magicLinkKey,
+  normalizeEmail,
+  revokeActiveMagicLinksForEmail,
+} from "./shared"
+
+export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
+  constructor(private readonly state: AuthStorageState) {}
+
+  async create(input: CreateAuthMagicLinkInput): Promise<MagicLinkRecord> {
+    const id = assertNonEmpty(input.id, "Magic link id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+    const audience = resolveAuthSessionAudience(input.audience)
+    const email = normalizeEmail(input.email)
+    const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
+    const key = magicLinkKey(projectId, id)
+
+    if (this.state.magicLinks.has(key)) {
+      throw new AuthStorageError(
+        "duplicate_magic_link",
+        `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`
+      )
+    }
+
+    revokeActiveMagicLinksForEmail(this.state, projectId, email, input.createdAt)
+
+    const link: MagicLinkRecord = {
+      id,
+      projectId,
+      strategyId,
+      audience,
+      email,
+      tokenHash,
+      returnTo: input.returnTo,
+      createdAt: cloneDate(input.createdAt),
+      expiresAt: cloneDate(input.expiresAt),
+    }
+    this.state.magicLinks.set(key, cloneRecord(link))
+    return cloneRecord(link)
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<MagicLinkRecord | null> {
+    const record = this.state.magicLinks.get(magicLinkKey(params.projectId, params.id)) ?? null
+    return cloneOptionalRecord(record)
+  }
+
+  async getActiveByEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly now: Date
+  }): Promise<MagicLinkRecord | null> {
+    const email = normalizeEmail(params.email)
+    const links = [...this.state.magicLinks.values()]
+      .filter((link) => link.projectId === params.projectId)
+      .filter((link) => link.email === email)
+      .filter((link) => isActiveMagicLink(link, params.now))
+      .sort((a, b) => compareByCreatedAt(a, b, "desc"))
+
+    return cloneOptionalRecord(links[0] ?? null)
+  }
+
+  async consume(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly consumedAt: Date
+  }): Promise<MagicLinkRecord> {
+    return cloneRecord(consumeMagicLinkRecord(this.state, params))
+  }
+
+  async revokeActiveForEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly revokedAt: Date
+  }): Promise<readonly MagicLinkRecord[]> {
+    return revokeActiveMagicLinksForEmail(
+      this.state,
+      params.projectId,
+      params.email,
+      params.revokedAt
+    ).map(cloneRecord)
+  }
+}

package/src/storage/auth/in-memory/oidc-attempts.ts

@@ -0,0 +1,75 @@
+import { resolveAuthSessionAudience } from "../../../auth/audience"
+import { AuthStorageError } from "../errors"
+import type {
+  AuthOidcAuthorizationAttemptStore,
+  CreateOidcAuthorizationAttemptInput,
+  OidcAuthorizationAttemptRecord,
+} from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  assertNonEmpty,
+  cloneDate,
+  cloneOptionalRecord,
+  cloneRecord,
+  consumeOidcAttemptRecord,
+  oidcAttemptKey,
+} from "./shared"
+
+export class InMemoryAuthOidcAuthorizationAttemptStore
+  implements AuthOidcAuthorizationAttemptStore
+{
+  constructor(private readonly state: AuthStorageState) {}
+
+  async create(
+    input: CreateOidcAuthorizationAttemptInput
+  ): Promise<OidcAuthorizationAttemptRecord> {
+    const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+    const audience = resolveAuthSessionAudience(input.audience)
+    const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
+    const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
+    const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
+    const key = oidcAttemptKey(projectId, id)
+
+    if (this.state.oidcAuthorizationAttempts.has(key)) {
+      throw new AuthStorageError(
+        "duplicate_oidc_attempt",
+        `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`
+      )
+    }
+
+    const attempt: OidcAuthorizationAttemptRecord = {
+      id,
+      projectId,
+      strategyId,
+      audience,
+      stateHash,
+      nonceHash,
+      codeVerifier,
+      returnTo: input.returnTo,
+      createdAt: cloneDate(input.createdAt),
+      expiresAt: cloneDate(input.expiresAt),
+    }
+    this.state.oidcAuthorizationAttempts.set(key, cloneRecord(attempt))
+    return cloneRecord(attempt)
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<OidcAuthorizationAttemptRecord | null> {
+    const record =
+      this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(params.projectId, params.id)) ?? null
+    return cloneOptionalRecord(record)
+  }
+
+  async consume(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly stateHash: string
+    readonly consumedAt: Date
+  }): Promise<OidcAuthorizationAttemptRecord> {
+    return cloneRecord(consumeOidcAttemptRecord(this.state, params))
+  }
+}

package/src/storage/auth/in-memory/service-account-group-memberships.ts

@@ -0,0 +1,102 @@
+import { AuthStorageError } from "../errors"
+import type {
+  AuthServiceAccountGroupMembershipStore,
+  ReconcileAuthServiceAccountGroupMembershipsInput,
+  ServiceAccountGroupMembershipRecord,
+  UpsertAuthServiceAccountGroupMembershipInput,
+} from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  assertNonEmpty,
+  cloneRecord,
+  dateOrNow,
+  normalizeGroupIds,
+  serviceAccountGroupMembershipKey,
+  serviceAccountKey,
+  upsertServiceAccountGroupMembershipRecord,
+} from "./shared"
+
+export class InMemoryAuthServiceAccountGroupMembershipStore
+  implements AuthServiceAccountGroupMembershipStore
+{
+  constructor(private readonly state: AuthStorageState) {}
+
+  async upsert(
+    input: UpsertAuthServiceAccountGroupMembershipInput
+  ): Promise<ServiceAccountGroupMembershipRecord> {
+    return cloneRecord(upsertServiceAccountGroupMembershipRecord(this.state, input))
+  }
+
+  async reconcileForServiceAccount(
+    input: ReconcileAuthServiceAccountGroupMembershipsInput
+  ): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const serviceAccountId = assertNonEmpty(input.serviceAccountId, "Service account id")
+    if (!this.state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`
+      )
+    }
+
+    const groupIds = normalizeGroupIds(input.groupIds)
+    const desired = new Set(groupIds)
+    for (const [key, membership] of this.state.serviceAccountGroupMemberships) {
+      if (
+        membership.projectId === projectId &&
+        membership.serviceAccountId === serviceAccountId &&
+        membership.source === input.source &&
+        !desired.has(membership.groupId)
+      ) {
+        this.state.serviceAccountGroupMemberships.delete(key)
+      }
+    }
+
+    const updatedAt = dateOrNow(input.updatedAt)
+    for (const groupId of groupIds) {
+      const key = serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId)
+      const existing = this.state.serviceAccountGroupMemberships.get(key)
+      if (existing) {
+        this.state.serviceAccountGroupMemberships.set(
+          key,
+          cloneRecord({ ...existing, source: input.source })
+        )
+        continue
+      }
+      this.state.serviceAccountGroupMemberships.set(
+        key,
+        cloneRecord({
+          projectId,
+          serviceAccountId,
+          groupId,
+          source: input.source,
+          createdAt: updatedAt,
+        })
+      )
+    }
+
+    return this.listForServiceAccount({ projectId, serviceAccountId })
+  }
+
+  async listForServiceAccount(params: {
+    readonly projectId: string
+    readonly serviceAccountId: string
+  }): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    return [...this.state.serviceAccountGroupMemberships.values()]
+      .filter((membership) => membership.projectId === params.projectId)
+      .filter((membership) => membership.serviceAccountId === params.serviceAccountId)
+      .sort((a, b) => a.groupId.localeCompare(b.groupId))
+      .map(cloneRecord)
+  }
+
+  async listForGroup(params: {
+    readonly projectId: string
+    readonly groupId: string
+  }): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    return [...this.state.serviceAccountGroupMemberships.values()]
+      .filter((membership) => membership.projectId === params.projectId)
+      .filter((membership) => membership.groupId === params.groupId)
+      .sort((a, b) => a.serviceAccountId.localeCompare(b.serviceAccountId))
+      .map(cloneRecord)
+  }
+}

package/src/storage/auth/in-memory/service-accounts.ts

@@ -0,0 +1,80 @@
+import { AuthStorageError } from "../errors"
+import type {
+  AuthServiceAccountStore,
+  CreateAuthServiceAccountInput,
+  ListAuthServiceAccountsInput,
+  ListAuthServiceAccountsResult,
+  ServiceAccountRecord,
+  UpdateAuthServiceAccountInput,
+} from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  assertNonEmpty,
+  cloneDate,
+  cloneOptionalRecord,
+  cloneRecord,
+  compareByCreatedAt,
+  createServiceAccountRecord,
+  serviceAccountKey,
+} from "./shared"
+
+export class InMemoryAuthServiceAccountStore implements AuthServiceAccountStore {
+  constructor(private readonly state: AuthStorageState) {}
+
+  async create(input: CreateAuthServiceAccountInput): Promise<ServiceAccountRecord> {
+    return cloneRecord(createServiceAccountRecord(this.state, input))
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<ServiceAccountRecord | null> {
+    const record =
+      this.state.serviceAccounts.get(serviceAccountKey(params.projectId, params.id)) ?? null
+    return cloneOptionalRecord(record)
+  }
+
+  async update(input: UpdateAuthServiceAccountInput): Promise<ServiceAccountRecord> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const id = assertNonEmpty(input.id, "Service account id")
+    const key = serviceAccountKey(projectId, id)
+    const existing = this.state.serviceAccounts.get(key)
+
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${id}' not found for project '${projectId}'.`
+      )
+    }
+
+    const next: ServiceAccountRecord = {
+      ...existing,
+      name:
+        input.name === undefined
+          ? existing.name
+          : assertNonEmpty(input.name, "Service account name"),
+      description: input.description === undefined ? existing.description : input.description,
+      status: input.status ?? existing.status,
+      updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : new Date(),
+    }
+    this.state.serviceAccounts.set(key, cloneRecord(next))
+    return cloneRecord(next)
+  }
+
+  async list(input: ListAuthServiceAccountsInput): Promise<ListAuthServiceAccountsResult> {
+    const statuses = input.statuses ? new Set(input.statuses) : null
+    const order = input.order ?? "asc"
+    const offset = input.offset ?? 0
+    const rows = [...this.state.serviceAccounts.values()]
+      .filter((serviceAccount) => serviceAccount.projectId === input.projectId)
+      .filter((serviceAccount) => !statuses || statuses.has(serviceAccount.status))
+      .sort((a, b) => compareByCreatedAt(a, b, order))
+    const page = rows.slice(offset, input.limit === undefined ? undefined : offset + input.limit)
+
+    return {
+      serviceAccounts: page.map(cloneRecord),
+      hasMore: input.limit === undefined ? false : offset + input.limit < rows.length,
+      total: rows.length,
+    }
+  }
+}

package/src/storage/auth/in-memory/sessions.ts

@@ -0,0 +1,177 @@
+import type { AuthSessionAudience } from "../../../auth/audience"
+import { AuthStorageError } from "../errors"
+import type { AuthSessionStore, CreateAuthSessionInput, SessionRecord } from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  cloneDate,
+  cloneOptionalRecord,
+  cloneRecord,
+  compareByCreatedAt,
+  createSessionRecord,
+  isActiveSession,
+  revokeActiveSessionsForUser,
+  sessionKey,
+} from "./shared"
+
+export class InMemoryAuthSessionStore implements AuthSessionStore {
+  constructor(private readonly state: AuthStorageState) {}
+
+  async create(input: CreateAuthSessionInput): Promise<SessionRecord> {
+    return cloneRecord(createSessionRecord(this.state, input))
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<SessionRecord | null> {
+    const record = this.state.sessions.get(sessionKey(params.projectId, params.id)) ?? null
+    return cloneOptionalRecord(record)
+  }
+
+  async getActiveByUserId(params: {
+    readonly projectId: string
+    readonly userId: string
+    readonly audience: AuthSessionAudience
+    readonly now: Date
+  }): Promise<SessionRecord | null> {
+    const sessions = [...this.state.sessions.values()]
+      .filter((session) => session.projectId === params.projectId)
+      .filter((session) => session.userId === params.userId)
+      .filter((session) => session.audience === params.audience)
+      .filter((session) => isActiveSession(session, params.now))
+      .sort((a, b) => compareByCreatedAt(a, b, "desc"))
+
+    return cloneOptionalRecord(sessions[0] ?? null)
+  }
+
+  async listActiveByUserId(params: {
+    readonly projectId: string
+    readonly userId: string
+    readonly now: Date
+  }): Promise<readonly SessionRecord[]> {
+    return [...this.state.sessions.values()]
+      .filter((session) => session.projectId === params.projectId)
+      .filter((session) => session.userId === params.userId)
+      .filter((session) => isActiveSession(session, params.now))
+      .sort((a, b) => {
+        const activity =
+          (b.lastSeenAt ?? b.createdAt).getTime() - (a.lastSeenAt ?? a.createdAt).getTime()
+        if (activity !== 0) return activity
+        const created = b.createdAt.getTime() - a.createdAt.getTime()
+        return created !== 0 ? created : b.id.localeCompare(a.id)
+      })
+      .map(cloneRecord)
+  }
+
+  async findValidByTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly audience: AuthSessionAudience
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null> {
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.id))
+    if (
+      !session ||
+      session.audience !== params.audience ||
+      session.tokenHash !== params.tokenHash ||
+      !isActiveSession(session, params.now)
+    ) {
+      return null
+    }
+
+    return cloneRecord(session)
+  }
+
+  async renewIfValid(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly audience: AuthSessionAudience
+    readonly tokenHash: string
+    readonly now: Date
+    readonly expiresAt: Date
+  }): Promise<SessionRecord | null> {
+    const key = sessionKey(params.projectId, params.id)
+    const session = this.state.sessions.get(key)
+    if (
+      !session ||
+      session.audience !== params.audience ||
+      session.tokenHash !== params.tokenHash ||
+      !isActiveSession(session, params.now)
+    ) {
+      return null
+    }
+
+    const requestedExpiresAt = session.absoluteExpiresAt
+      ? new Date(Math.min(params.expiresAt.getTime(), session.absoluteExpiresAt.getTime()))
+      : params.expiresAt
+    const next: SessionRecord = {
+      ...session,
+      expiresAt: new Date(Math.max(session.expiresAt.getTime(), requestedExpiresAt.getTime())),
+      lastSeenAt: cloneDate(params.now),
+    }
+    this.state.sessions.set(key, cloneRecord(next))
+    return cloneRecord(next)
+  }
+
+  async revoke(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly revokedAt: Date
+  }): Promise<SessionRecord> {
+    const key = sessionKey(params.projectId, params.id)
+    const existing = this.state.sessions.get(key)
+
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_session",
+        `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`
+      )
+    }
+
+    const next: SessionRecord = {
+      ...existing,
+      revokedAt: cloneDate(params.revokedAt),
+    }
+    this.state.sessions.set(key, cloneRecord(next))
+    return cloneRecord(next)
+  }
+
+  async revokeActiveForUser(params: {
+    readonly projectId: string
+    readonly userId: string
+    readonly audience?: AuthSessionAudience
+    readonly revokedAt: Date
+  }): Promise<readonly SessionRecord[]> {
+    return revokeActiveSessionsForUser(
+      this.state,
+      params.projectId,
+      params.userId,
+      params.revokedAt,
+      params.audience
+    ).map(cloneRecord)
+  }
+
+  async touch(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly lastSeenAt: Date
+  }): Promise<SessionRecord> {
+    const key = sessionKey(params.projectId, params.id)
+    const existing = this.state.sessions.get(key)
+
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_session",
+        `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`
+      )
+    }
+
+    const next: SessionRecord = {
+      ...existing,
+      lastSeenAt: cloneDate(params.lastSeenAt),
+    }
+    this.state.sessions.set(key, cloneRecord(next))
+    return cloneRecord(next)
+  }
+}