fix: sync temp auth key expiry boundaries

internal/store/postgres/sqlcgen/authkey.sql.go

@@ -1,55 +0,0 @@
-// Code generated by sqlc. DO NOT EDIT.
-// versions:
-//   sqlc v1.31.1
-// source: authkey.sql
-
-package sqlcgen
-
-import (
-	"context"
-
-	"github.com/jackc/pgx/v5/pgtype"
-)
-
-const getAuthKey = `-- name: GetAuthKey :one
-SELECT auth_key_id, body, server_salt, created_at
-FROM auth_keys
-WHERE auth_key_id = $1
-`
-
-type GetAuthKeyRow struct {
-	AuthKeyID  int64
-	Body       []byte
-	ServerSalt int64
-	CreatedAt  pgtype.Timestamptz
-}
-
-func (q *Queries) GetAuthKey(ctx context.Context, authKeyID int64) (GetAuthKeyRow, error) {
-	row := q.db.QueryRow(ctx, getAuthKey, authKeyID)
-	var i GetAuthKeyRow
-	err := row.Scan(
-		&i.AuthKeyID,
-		&i.Body,
-		&i.ServerSalt,
-		&i.CreatedAt,
-	)
-	return i, err
-}
-
-const upsertAuthKey = `-- name: UpsertAuthKey :exec
-INSERT INTO auth_keys (auth_key_id, body, server_salt)
-VALUES ($1, $2, $3)
-ON CONFLICT (auth_key_id) DO UPDATE
-SET body = EXCLUDED.body, server_salt = EXCLUDED.server_salt
-`
-
-type UpsertAuthKeyParams struct {
-	AuthKeyID  int64
-	Body       []byte
-	ServerSalt int64
-}
-
-func (q *Queries) UpsertAuthKey(ctx context.Context, arg UpsertAuthKeyParams) error {
-	_, err := q.db.Exec(ctx, upsertAuthKey, arg.AuthKeyID, arg.Body, arg.ServerSalt)
-	return err
-}

internal/store/postgres/sqlcgen/models.go

@@ -175,6 +175,7 @@ type AuthKey struct {
 	ApiID         int32
 	AppVersion    string
 	LastUsedAt    pgtype.Timestamptz
+	ExpiresAt     int32
 }
 
 type Authorization struct {

internal/store/postgres/sqlcgen/temp_auth_key.sql.go

@@ -10,13 +10,18 @@ import (
 )
 
 const deleteExpiredTempAuthKeys = `-- name: DeleteExpiredTempAuthKeys :execrows
-DELETE FROM auth_keys
-WHERE auth_key_id IN (
-  SELECT temp_auth_key_id
-  FROM temp_auth_key_bindings
-  WHERE expires_at < $1
+WITH candidates AS (
+  SELECT candidate_key.auth_key_id
+  FROM auth_keys AS candidate_key
+  WHERE candidate_key.expires_at > 0
+    AND candidate_key.expires_at < $1
+  ORDER BY candidate_key.expires_at, candidate_key.auth_key_id
   LIMIT $2
+  FOR UPDATE SKIP LOCKED
 )
+DELETE FROM auth_keys AS k
+USING candidates AS c
+WHERE k.auth_key_id = c.auth_key_id
 `
 
 type DeleteExpiredTempAuthKeysParams struct {
@@ -67,18 +72,24 @@ func (q *Queries) GetTempAuthKeyBinding(ctx context.Context, tempAuthKeyID int64
 	return i, err
 }
 
-const upsertTempAuthKeyBinding = `-- name: UpsertTempAuthKeyBinding :exec
+const upsertTempAuthKeyBinding = `-- name: UpsertTempAuthKeyBinding :execrows
 INSERT INTO temp_auth_key_bindings (
   temp_auth_key_id, perm_auth_key_id, nonce, temp_session_id, expires_at, encrypted_message
 )
-VALUES ($1, $2, $3, $4, $5, $6)
+SELECT $1, $2, $3, $4, $5, $6
+FROM auth_keys AS temp_key
+JOIN auth_keys AS perm_key ON perm_key.auth_key_id = $2
+WHERE temp_key.auth_key_id = $1
+  AND temp_key.expires_at = $5
+  AND temp_key.expires_at > 0
+  AND perm_key.expires_at = 0
 ON CONFLICT (temp_auth_key_id) DO UPDATE SET
-  perm_auth_key_id = EXCLUDED.perm_auth_key_id,
   nonce = EXCLUDED.nonce,
   temp_session_id = EXCLUDED.temp_session_id,
   expires_at = EXCLUDED.expires_at,
   encrypted_message = EXCLUDED.encrypted_message,
   created_at = now()
+WHERE temp_auth_key_bindings.perm_auth_key_id = EXCLUDED.perm_auth_key_id
 `
 
 type UpsertTempAuthKeyBindingParams struct {
@@ -90,8 +101,8 @@ type UpsertTempAuthKeyBindingParams struct {
 	EncryptedMessage []byte
 }
 
-func (q *Queries) UpsertTempAuthKeyBinding(ctx context.Context, arg UpsertTempAuthKeyBindingParams) error {
-	_, err := q.db.Exec(ctx, upsertTempAuthKeyBinding,
+func (q *Queries) UpsertTempAuthKeyBinding(ctx context.Context, arg UpsertTempAuthKeyBindingParams) (int64, error) {
+	result, err := q.db.Exec(ctx, upsertTempAuthKeyBinding,
 		arg.TempAuthKeyID,
 		arg.PermAuthKeyID,
 		arg.Nonce,
@@ -99,5 +110,8 @@ func (q *Queries) UpsertTempAuthKeyBinding(ctx context.Context, arg UpsertTempAu
 		arg.ExpiresAt,
 		arg.EncryptedMessage,
 	)
-	return err
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
 }